netdev - Re: [PATCH -next] bpf: fix error return code in map_lookup_and_delete

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <5813e11c-9aba-8273-e935-1ddb5a3f9b47@iogearbox.net>
Date:   Thu, 30 Apr 2020 16:26:23 +0200
From:   Daniel Borkmann <daniel@...earbox.net>
To:     Wei Yongjun <weiyongjun1@...wei.com>,
        Alexei Starovoitov <ast@...nel.org>,
        Martin KaFai Lau <kafai@...com>,
        Song Liu <songliubraving@...com>, Yonghong Song <yhs@...com>,
        Andrii Nakryiko <andriin@...com>,
        John Fastabend <john.fastabend@...il.com>,
        KP Singh <kpsingh@...omium.org>,
        Mauricio Vasquez B <mauricio.vasquez@...ito.it>
Cc:     netdev@...r.kernel.org, bpf@...r.kernel.org,
        kernel-janitors@...r.kernel.org
Subject: Re: [PATCH -next] bpf: fix error return code in
 map_lookup_and_delete_elem()

On 4/30/20 10:18 AM, Wei Yongjun wrote:
> Fix to return negative error code -EFAULT from the copy_to_user() error
> handling case instead of 0, as done elsewhere in this function.
> 
> Fixes: bd513cd08f10 ("bpf: add MAP_LOOKUP_AND_DELETE_ELEM syscall")
> Signed-off-by: Wei Yongjun <weiyongjun1@...wei.com>
> ---
>   kernel/bpf/syscall.c | 4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
> index 3cea7602de78..68c22e9420fa 100644
> --- a/kernel/bpf/syscall.c
> +++ b/kernel/bpf/syscall.c
> @@ -1492,8 +1492,10 @@ static int map_lookup_and_delete_elem(union bpf_attr *attr)
>   	if (err)
>   		goto free_value;
>   
> -	if (copy_to_user(uvalue, value, value_size) != 0)
> +	if (copy_to_user(uvalue, value, value_size) != 0) {
> +		err = -EFAULT;
>   		goto free_value;
> +	}
>   

Good catch! Applied to bpf, thanks!