diff options
| author | David S. Miller | 2020-05-24 13:47:27 -0700 |
|---|---|---|
| committer | David S. Miller | 2020-05-24 13:47:27 -0700 |
| commit | 13209a8f7304a34158f4366e8ea07a1965c05ac7 (patch) | |
| tree | f25ba4846fe02a32d4a14ef1a6be3227363da919 /kernel/bpf | |
| parent | 316107119f473e764cf5e50437333c8b83bec0da (diff) | |
| parent | 98790bbac4db1697212ce9462ec35ca09c4a2810 (diff) | |
Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
The MSCC bug fix in 'net' had to be slightly adjusted because the
register accesses are done slightly differently in net-next.
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'kernel/bpf')
| -rw-r--r-- | kernel/bpf/syscall.c | 17 |
1 files changed, 14 insertions, 3 deletions
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c index 431241c74614..aaa29fb6f363 100644 --- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c @@ -627,9 +627,20 @@ static int bpf_map_mmap(struct file *filp, struct vm_area_struct *vma) mutex_lock(&map->freeze_mutex); - if ((vma->vm_flags & VM_WRITE) && map->frozen) { - err = -EPERM; - goto out; + if (vma->vm_flags & VM_WRITE) { + if (map->frozen) { + err = -EPERM; + goto out; + } + /* map is meant to be read-only, so do not allow mapping as + * writable, because it's possible to leak a writable page + * reference and allows user-space to still modify it after + * freezing, while verifier will assume contents do not change + */ + if (map->map_flags & BPF_F_RDONLY_PROG) { + err = -EACCES; + goto out; + } } /* set default open/close callbacks */ |