diff options
| author | Alexei Starovoitov <ast@plumgrid.com> | 2015-01-22 17:11:08 -0800 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2015-01-26 17:20:40 -0800 |
| commit | 8ebe667c41e054384df19f2f382bc415badfaee1 (patch) | |
| tree | 45c41bc68790f63aba66c5ab65492a89423587db /kernel/user_namespace.c | |
| parent | 600ddd6825543962fb807884169e57b580dba208 (diff) | |
| download | linux-8ebe667c41e054384df19f2f382bc415badfaee1.tar.bz2 | |
bpf: rcu lock must not be held when calling copy_to_user()
BUG: sleeping function called from invalid context at mm/memory.c:3732
in_atomic(): 0, irqs_disabled(): 0, pid: 671, name: test_maps
1 lock held by test_maps/671:
#0: (rcu_read_lock){......}, at: [<0000000000264190>] map_lookup_elem+0xe8/0x260
Call Trace:
([<0000000000115b7e>] show_trace+0x12e/0x150)
[<0000000000115c40>] show_stack+0xa0/0x100
[<00000000009b163c>] dump_stack+0x74/0xc8
[<000000000017424a>] ___might_sleep+0x23a/0x248
[<00000000002b58e8>] might_fault+0x70/0xe8
[<0000000000264230>] map_lookup_elem+0x188/0x260
[<0000000000264716>] SyS_bpf+0x20e/0x840
Fix it by allocating temporary buffer to store map element value.
Fixes: db20fd2b0108 ("bpf: add lookup/update/delete/iterate methods to BPF maps")
Reported-by: Michael Holzheu <holzheu@linux.vnet.ibm.com>
Signed-off-by: Alexei Starovoitov <ast@plumgrid.com>
Acked-by: Daniel Borkmann <dborkman@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'kernel/user_namespace.c')
0 files changed, 0 insertions, 0 deletions