netdev - [PATCH iproute2 master] bpf: test for valid type in bpf_get_work

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <31298439f86c34288a26fd4c3d2bcac262d37565.1488801657.git.daniel@iogearbox.net>
Date:   Mon,  6 Mar 2017 13:06:00 +0100
From:   Daniel Borkmann <daniel@...earbox.net>
To:     stephen@...workplumber.org
Cc:     alexei.starovoitov@...il.com, janerik@...iger.net,
        netdev@...r.kernel.org, Daniel Borkmann <daniel@...earbox.net>
Subject: [PATCH iproute2 master] bpf: test for valid type in bpf_get_work_dir

Jan-Erik reported an assertion in bpf_prog_to_subdir() failed where
type was BPF_PROG_TYPE_UNSPEC, which is only used in bpf_init_env()
to auto-mount and cache the bpf fs mount point.

Therefore, make sure when bpf_init_env() is called multiple times
(f.e. eBPF classifier with eBPF action attached) and bpf_mnt_cached
is set already that the type is also valid. In bpf_init_env(), we're
only interested in the mount point and not a type-specific subdir.

Fixes: e42256699cac ("bpf: make tc's bpf loader generic and move into lib")
Reported-by: Jan-Erik Rediger <janerik@...iger.net>
Signed-off-by: Daniel Borkmann <daniel@...earbox.net>
---
 lib/bpf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/bpf.c b/lib/bpf.c
index 211c3d1..04ee1ab 100644
--- a/lib/bpf.c
+++ b/lib/bpf.c
@@ -596,7 +596,7 @@ static const char *bpf_get_work_dir(enum bpf_prog_type type)
 	if (bpf_mnt_cached) {
 		const char *out = mnt;
 
-		if (out) {
+		if (out && type) {
 			snprintf(bpf_tmp, sizeof(bpf_tmp), "%s%s/",
 				 out, bpf_prog_to_subdir(type));
 			out = bpf_tmp;
-- 
1.9.3