diff options
| author | Yafang Shao <laoar.shao@gmail.com> | 2024-02-17 12:41:51 +0100 |
|---|---|---|
| committer | Daniel Borkmann <daniel@iogearbox.net> | 2024-02-19 12:28:15 +0100 |
| commit | 5f2ae606cb5a90839a9be9d22388c4200f820e75 (patch) | |
| tree | 95d2c6a9b5d7acb4ea4d1581f15b7e5dc3aa480d /kernel/bpf | |
| parent | selftests/bpf: Test racing between bpf_timer_cancel_and_free and bpf_timer_ca... (diff) | |
| download | linux-5f2ae606cb5a90839a9be9d22388c4200f820e75.tar.xz linux-5f2ae606cb5a90839a9be9d22388c4200f820e75.zip | |
bpf: Fix an issue due to uninitialized bpf_iter_task
Failure to initialize it->pos, coupled with the presence of an invalid
value in the flags variable, can lead to it->pos referencing an invalid
task, potentially resulting in a kernel panic. To mitigate this risk, it's
crucial to ensure proper initialization of it->pos to NULL.
Fixes: ac8148d957f5 ("bpf: bpf_iter_task_next: use next_task(kit->task) rather than next_task(kit->pos)")
Signed-off-by: Yafang Shao <laoar.shao@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Yonghong Song <yonghong.song@linux.dev>
Acked-by: Oleg Nesterov <oleg@redhat.com>
Link: https://lore.kernel.org/bpf/20240217114152.1623-2-laoar.shao@gmail.com
Diffstat (limited to 'kernel/bpf')
| -rw-r--r-- | kernel/bpf/task_iter.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/kernel/bpf/task_iter.c b/kernel/bpf/task_iter.c index e5c3500443c6..ec4e97c61eef 100644 --- a/kernel/bpf/task_iter.c +++ b/kernel/bpf/task_iter.c @@ -978,6 +978,8 @@ __bpf_kfunc int bpf_iter_task_new(struct bpf_iter_task *it, BUILD_BUG_ON(__alignof__(struct bpf_iter_task_kern) != __alignof__(struct bpf_iter_task)); + kit->pos = NULL; + switch (flags) { case BPF_TASK_ITER_ALL_THREADS: case BPF_TASK_ITER_ALL_PROCS: |