]> git.proxmox.com Git - mirror_ubuntu-hirsute-kernel.git/commit
media, bpf: Do not copy more entries than user space requested
authorSean Young <sean@mess.org>
Wed, 23 Jun 2021 21:37:54 +0000 (22:37 +0100)
committerStefan Bader <stefan.bader@canonical.com>
Mon, 20 Sep 2021 13:39:05 +0000 (15:39 +0200)
commit14eb7161b2b946f11ad83d548e2b4e985adcbf75
tree55dc378eab0b0b879e7c8c790b650ed8a2b7143a
parent4dfe1a56ee95a515dae917574b808c233c050cf2
media, bpf: Do not copy more entries than user space requested

BugLink: https://bugs.launchpad.net/bugs/1939450
[ Upstream commit 647d446d66e493d23ca1047fa8492b0269674530 ]

The syscall bpf(BPF_PROG_QUERY, &attr) should use the prog_cnt field to
see how many entries user space provided and return ENOSPC if there are
more programs than that. Before this patch, this is not checked and
ENOSPC is never returned.

Note that one lirc device is limited to 64 bpf programs, and user space
I'm aware of -- ir-keytable -- always gives enough space for 64 entries
already. However, we should not copy program ids than are requested.

Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20210623213754.632-1-sean@mess.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
drivers/media/rc/bpf-lirc.c