diff options
author | David S. Miller <davem@davemloft.net> | 2020-05-24 22:47:27 +0200 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2020-05-24 22:47:27 +0200 |
commit | 13209a8f7304a34158f4366e8ea07a1965c05ac7 (patch) | |
tree | f25ba4846fe02a32d4a14ef1a6be3227363da919 /kernel/bpf | |
parent | ethtool: propagate get_coalesce return value (diff) | |
parent | Merge tag 'efi-urgent-2020-05-24' of git://git.kernel.org/pub/scm/linux/kerne... (diff) | |
download | linux-13209a8f7304a34158f4366e8ea07a1965c05ac7.tar.xz linux-13209a8f7304a34158f4366e8ea07a1965c05ac7.zip |
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
The MSCC bug fix in 'net' had to be slightly adjusted because the
register accesses are done slightly differently in net-next.
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'kernel/bpf')
-rw-r--r-- | kernel/bpf/syscall.c | 17 |
1 files changed, 14 insertions, 3 deletions
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c index 431241c74614..aaa29fb6f363 100644 --- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c @@ -627,9 +627,20 @@ static int bpf_map_mmap(struct file *filp, struct vm_area_struct *vma) mutex_lock(&map->freeze_mutex); - if ((vma->vm_flags & VM_WRITE) && map->frozen) { - err = -EPERM; - goto out; + if (vma->vm_flags & VM_WRITE) { + if (map->frozen) { + err = -EPERM; + goto out; + } + /* map is meant to be read-only, so do not allow mapping as + * writable, because it's possible to leak a writable page + * reference and allows user-space to still modify it after + * freezing, while verifier will assume contents do not change + */ + if (map->map_flags & BPF_F_RDONLY_PROG) { + err = -EACCES; + goto out; + } } /* set default open/close callbacks */ |