summaryrefslogtreecommitdiffstats
path: root/kernel/bpf
diff options
context:
space:
mode:
authorDavid S. Miller <davem@davemloft.net>2020-05-24 22:47:27 +0200
committerDavid S. Miller <davem@davemloft.net>2020-05-24 22:47:27 +0200
commit13209a8f7304a34158f4366e8ea07a1965c05ac7 (patch)
treef25ba4846fe02a32d4a14ef1a6be3227363da919 /kernel/bpf
parentethtool: propagate get_coalesce return value (diff)
parentMerge tag 'efi-urgent-2020-05-24' of git://git.kernel.org/pub/scm/linux/kerne... (diff)
downloadlinux-13209a8f7304a34158f4366e8ea07a1965c05ac7.tar.xz
linux-13209a8f7304a34158f4366e8ea07a1965c05ac7.zip
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
The MSCC bug fix in 'net' had to be slightly adjusted because the register accesses are done slightly differently in net-next. Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'kernel/bpf')
-rw-r--r--kernel/bpf/syscall.c17
1 files changed, 14 insertions, 3 deletions
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 431241c74614..aaa29fb6f363 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -627,9 +627,20 @@ static int bpf_map_mmap(struct file *filp, struct vm_area_struct *vma)
mutex_lock(&map->freeze_mutex);
- if ((vma->vm_flags & VM_WRITE) && map->frozen) {
- err = -EPERM;
- goto out;
+ if (vma->vm_flags & VM_WRITE) {
+ if (map->frozen) {
+ err = -EPERM;
+ goto out;
+ }
+ /* map is meant to be read-only, so do not allow mapping as
+ * writable, because it's possible to leak a writable page
+ * reference and allows user-space to still modify it after
+ * freezing, while verifier will assume contents do not change
+ */
+ if (map->map_flags & BPF_F_RDONLY_PROG) {
+ err = -EACCES;
+ goto out;
+ }
}
/* set default open/close callbacks */