bpf: Do not copy spin lock field from user in bpf_selem_alloc
authorXu Kuohai <xukuohai@huawei.com>
Mon, 14 Nov 2022 13:47:19 +0000 (08:47 -0500)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 8 Dec 2022 10:28:39 +0000 (11:28 +0100)
commite3761831674af03b17f0ba2ab0cbeb257427fb69
tree1c87c27148d8e6369ccc062fa913ef1c0d4005bf
parent45f6e81863747c0d7bc6a95ec51129900e71467a
bpf: Do not copy spin lock field from user in bpf_selem_alloc

[ Upstream commit 836e49e103dfeeff670c934b7d563cbd982fce87 ]

bpf_selem_alloc function is used by inode_storage, sk_storage and
task_storage maps to set map value, for these map types, there may
be a spin lock in the map value, so if we use memcpy to copy the whole
map value from user, the spin lock field may be initialized incorrectly.

Since the spin lock field is zeroed by kzalloc, call copy_map_value
instead of memcpy to skip copying the spin lock field to fix it.

Fixes: 6ac99e8f23d4 ("bpf: Introduce bpf sk local storage")
Signed-off-by: Xu Kuohai <xukuohai@huawei.com>
Link: https://lore.kernel.org/r/20221114134720.1057939-2-xukuohai@huawei.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
kernel/bpf/bpf_local_storage.c