linux/drivers/net/netdevsim
Haimin Zhang 27358aa81a netdevsim: Zero-initialize memory for new map's value in function nsim_bpf_map_alloc
[ Upstream commit 481221775d ]

Zero-initialize memory for new map's value in function nsim_bpf_map_alloc
since it may cause a potential kernel information leak issue, as follows:
1. nsim_bpf_map_alloc calls nsim_map_alloc_elem to allocate elements for
a new map.
2. nsim_map_alloc_elem uses kmalloc to allocate map's value, but doesn't
zero it.
3. A user application can use IOCTL BPF_MAP_LOOKUP_ELEM to get specific
element's information in the map.
4. The kernel function map_lookup_elem will call bpf_map_copy_value to get
the information allocated at step-2, then use copy_to_user to copy to the
user buffer.
This can only leak information for an array map.

Fixes: 395cacb5f1 ("netdevsim: bpf: support fake map offload")
Suggested-by: Jakub Kicinski <kuba@kernel.org>
Acked-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Haimin Zhang <tcs.kernel@gmail.com>
Link: https://lore.kernel.org/r/20211215111530.72103-1-tcs.kernel@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-12-22 09:32:44 +01:00
..
Makefile netdevsim: Add dummy psample implementation 2021-03-14 15:00:43 -07:00
bpf.c netdevsim: Zero-initialize memory for new map's value in function nsim_bpf_map_alloc 2021-12-22 09:32:44 +01:00
bus.c Driver core update for 5.15-rc1 2021-09-01 08:44:42 -07:00
dev.c devlink: Set device as early as possible 2021-08-09 10:21:40 +01:00
ethtool.c netdevsim: don't overwrite read only ethtool parms 2021-12-22 09:32:40 +01:00
fib.c netdevsim: make array res_ids static const, makes object smaller 2021-08-02 09:12:24 -07:00
health.c netdevsim: switch to memdup_user_nul() 2021-03-24 16:26:58 -07:00
ipsec.c net: netdevsim: use xso.real_dev instead of xso.dev in callback functions of struct xfrmdev_ops 2021-07-06 10:36:59 -07:00
netdev.c netdevsim: Add multi-queue support 2021-07-16 11:17:56 -07:00
netdevsim.h netdevsim: Protect both reload_down and reload_up paths 2021-08-06 10:36:36 +01:00
psample.c netdevsim: Only use sampling truncation length when valid 2021-04-22 13:23:56 -07:00
udp_tunnels.c netdevsim: set .owner to THIS_MODULE 2020-11-17 14:08:59 -08:00