diff options
| author | Alexei Starovoitov <ast@plumgrid.com> | 2015-01-23 02:11:08 +0100 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2015-01-27 02:20:40 +0100 |
| commit | 8ebe667c41e054384df19f2f382bc415badfaee1 (patch) | |
| tree | 45c41bc68790f63aba66c5ab65492a89423587db /samples/bpf | |
| parent | net: sctp: fix slab corruption from use after free on INIT collisions (diff) | |
| download | linux-8ebe667c41e054384df19f2f382bc415badfaee1.tar.xz linux-8ebe667c41e054384df19f2f382bc415badfaee1.zip | |
bpf: rcu lock must not be held when calling copy_to_user()
BUG: sleeping function called from invalid context at mm/memory.c:3732
in_atomic(): 0, irqs_disabled(): 0, pid: 671, name: test_maps
1 lock held by test_maps/671:
#0: (rcu_read_lock){......}, at: [<0000000000264190>] map_lookup_elem+0xe8/0x260
Call Trace:
([<0000000000115b7e>] show_trace+0x12e/0x150)
[<0000000000115c40>] show_stack+0xa0/0x100
[<00000000009b163c>] dump_stack+0x74/0xc8
[<000000000017424a>] ___might_sleep+0x23a/0x248
[<00000000002b58e8>] might_fault+0x70/0xe8
[<0000000000264230>] map_lookup_elem+0x188/0x260
[<0000000000264716>] SyS_bpf+0x20e/0x840
Fix it by allocating temporary buffer to store map element value.
Fixes: db20fd2b0108 ("bpf: add lookup/update/delete/iterate methods to BPF maps")
Reported-by: Michael Holzheu <holzheu@linux.vnet.ibm.com>
Signed-off-by: Alexei Starovoitov <ast@plumgrid.com>
Acked-by: Daniel Borkmann <dborkman@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'samples/bpf')
0 files changed, 0 insertions, 0 deletions