Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

bpf: Fix swapped arguments in calls to check_buffer_access

There are a couple of arguments of the boolean flag zero_size_allowed and
the char pointer buf_info when calling to function check_buffer_access that
are swapped by mistake. Fix these by swapping them to correct the argument
ordering.

Fixes: afbf21dce668 ("bpf: Support readonly/readwrite buffers in verifier")
Addresses-Coverity: ("Array compared to 0")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Yonghong Song <yhs@fb.com>
Link: https://lore.kernel.org/bpf/20200727175411.155179-1-colin.king@canonical.com

authored by

Colin Ian King and committed by
Daniel Borkmann
f6dfbe31 363885d7

+4 -4
+4 -4
kernel/bpf/verifier.c
··· 3477 3477 regno, reg_type_str[reg->type]); 3478 3478 return -EACCES; 3479 3479 } 3480 - err = check_buffer_access(env, reg, regno, off, size, "rdonly", 3481 - false, 3480 + err = check_buffer_access(env, reg, regno, off, size, false, 3481 + "rdonly", 3482 3482 &env->prog->aux->max_rdonly_access); 3483 3483 if (!err && value_regno >= 0) 3484 3484 mark_reg_unknown(env, regs, value_regno); 3485 3485 } else if (reg->type == PTR_TO_RDWR_BUF) { 3486 - err = check_buffer_access(env, reg, regno, off, size, "rdwr", 3487 - false, 3486 + err = check_buffer_access(env, reg, regno, off, size, false, 3487 + "rdwr", 3488 3488 &env->prog->aux->max_rdwr_access); 3489 3489 if (!err && t == BPF_READ && value_regno >= 0) 3490 3490 mark_reg_unknown(env, regs, value_regno);