iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/kernel/bpf
History
Yonghong Song db2baf82b0 bpf: Fix an incorrect verification success with movsx insn 
syzbot reports a verifier bug which triggers a runtime panic.
The test bpf program is:
   0: (62) *(u32 *)(r10 -8) = 553656332
   1: (bf) r1 = (s16)r10
   2: (07) r1 += -8
   3: (b7) r2 = 3
   4: (bd) if r2 <= r1 goto pc+0
   5: (85) call bpf_trace_printk#-138320
   6: (b7) r0 = 0
   7: (95) exit

At insn 1, the current implementation keeps 'r1' as a frame pointer,
which caused later bpf_trace_printk helper call crash since frame
pointer address is not valid any more. Note that at insn 4,
the 'pointer vs. scalar' comparison is allowed for privileged
prog run.

To fix the problem with above insn 1, the fix in the patch adopts
similar pattern to existing 'R1 = (u32) R2' handling. For unprivileged
prog run, verification will fail with 'R<num> sign-extension part of pointer'.
For privileged prog run, the dst_reg 'r1' will be marked as
an unknown scalar, so later 'bpf_trace_pointk' helper will complain
since it expected certain pointers.

Reported-by: syzbot+d61b595e9205573133b3@syzkaller.appspotmail.com
Fixes: 8100928c8814 ("bpf: Support new sign-extension mov insns")
Signed-off-by: Yonghong Song <yonghong.song@linux.dev>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20230807175721.671696-1-yonghong.song@linux.dev
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
2023-08-07 16:23:35 -07:00
..
preload
bpf: make preloaded map iterators to display map elements count
2023-07-06 12:42:25 -07:00
arraymap.c
bpf: return long from bpf_map_ops funcs
2023-03-22 15:11:30 -07:00
bloom_filter.c
bpf: Centralize permissions checks for all BPF map types
2023-06-19 14:04:04 +02:00
bpf_cgrp_storage.c
bpf: Teach verifier that certain helpers accept NULL pointer.
2023-04-04 16:57:16 -07:00
bpf_inode_storage.c
Networking changes for 6.4.
2023-04-26 16:07:23 -07:00
bpf_iter.c
bpf: implement numbers iterator
2023-03-08 16:19:51 -08:00
bpf_local_storage.c
bpf: Centralize permissions checks for all BPF map types
2023-06-19 14:04:04 +02:00
bpf_lru_list.c
bpf: Address KCSAN report on bpf_lru_list
2023-05-12 12:01:03 -07:00
bpf_lru_list.h
bpf: Address KCSAN report on bpf_lru_list
2023-05-12 12:01:03 -07:00
bpf_lsm.c
bpf: Fix the kernel crash caused by bpf_setsockopt().
2023-01-26 23:26:40 -08:00
bpf_struct_ops_types.h
bpf: Add dummy BPF STRUCT_OPS for test purpose
2021-11-01 14:10:00 -07:00
bpf_struct_ops.c
bpf: bpf_struct_ops: Remove unnecessary initial values of variables
2023-08-03 17:54:35 -07:00
bpf_task_storage.c
bpf: Teach verifier that certain helpers accept NULL pointer.
2023-04-04 16:57:16 -07:00
btf.c
net: invert the netdevice.h vs xdp.h dependency
2023-08-03 08:38:07 -07:00
cgroup_iter.c
cgroup: bpf: use cgroup_lock()/cgroup_unlock() wrappers
2023-03-17 12:07:13 -10:00
cgroup.c
bpf-next-for-netdev
2023-05-16 19:50:05 -07:00
core.c
bpf: fix bpf_probe_read_kernel prototype mismatch
2023-08-02 14:14:17 -07:00
cpumap.c
pull-request: bpf-next 2023-08-03
2023-08-03 15:34:36 -07:00
cpumask.c
bpf: Convert bpf_cpumask to bpf_mem_cache_free_rcu.
2023-07-12 23:45:23 +02:00
devmap.c
bpf, devmap: Remove unused dtab field from bpf_dtab_netdev
2023-07-31 18:26:08 -07:00
disasm.c
bpf: change bpf_alu_sign_string and bpf_movsx_string to static
2023-08-04 16:15:50 -07:00
disasm.h
bpf: Relicense disassembler as GPL-2.0-only OR BSD-2-Clause
2021-09-02 14:49:23 +02:00
dispatcher.c
bpf: Synchronize dispatcher update with bpf_dispatcher_xdp_func
2022-12-14 12:02:14 -08:00
hashtab.c
bpf: populate the per-cpu insertions/deletions counters for hashmaps
2023-07-06 12:42:25 -07:00
helpers.c
bpf: fix bpf_dynptr_slice() to stop return an ERR_PTR.
2023-08-04 14:53:15 -07:00
inode.c
bpf: Support O_PATH FDs in BPF_OBJ_PIN and BPF_OBJ_GET commands
2023-05-23 23:31:42 +02:00
Kconfig
bpf: Add fd-based tcx multi-prog infra with link support
2023-07-19 10:07:27 -07:00
link_iter.c
bpf: Add bpf_link iterator
2022-05-10 11:20:45 -07:00
local_storage.c
cgroup changes for v6.4-rc1
2023-04-29 10:05:22 -07:00
log.c
bpf: drop unnecessary user-triggerable WARN_ONCE in verifierl log
2023-05-16 22:34:50 -07:00
lpm_trie.c
bpf: Centralize permissions checks for all BPF map types
2023-06-19 14:04:04 +02:00
Makefile
bpf: Add fd-based tcx multi-prog infra with link support
2023-07-19 10:07:27 -07:00
map_in_map.c
bpf: Fix elem_size not being set for inner maps
2023-06-02 16:22:12 -07:00
map_in_map.h
…
map_iter.c
bpf: allow any program to use the bpf_map_sum_elem_count kfunc
2023-07-19 09:48:53 -07:00
memalloc.c
bpf: Non-atomically allocate freelist during prefill
2023-07-28 09:41:10 -07:00
mmap_unlock_work.h
bpf: Introduce helper bpf_find_vma
2021-11-07 11:54:51 -08:00
mprog.c
bpf: Fix mprog detachment for empty mprog entry
2023-08-04 09:35:39 -07:00
net_namespace.c
net: Add includes masked by netdevice.h including uapi/bpf.h
2021-12-29 20:03:05 -08:00
offload.c
net: invert the netdevice.h vs xdp.h dependency
2023-08-03 08:38:07 -07:00
percpu_freelist.c
bpf: Initialize same number of free nodes for each pcpu_freelist
2022-11-11 12:05:14 -08:00
percpu_freelist.h
…
prog_iter.c
…
queue_stack_maps.c
bpf: Centralize permissions checks for all BPF map types
2023-06-19 14:04:04 +02:00
reuseport_array.c
bpf: Centralize permissions checks for all BPF map types
2023-06-19 14:04:04 +02:00
ringbuf.c
bpf: Remove unnecessary ring buffer size check
2023-07-05 14:09:45 +02:00
stackmap.c
bpf: Centralize permissions checks for all BPF map types
2023-06-19 14:04:04 +02:00
syscall.c
bpf: Add fd-based tcx multi-prog infra with link support
2023-07-19 10:07:27 -07:00
sysfs_btf.c
…
task_iter.c
bpf: keep a reference to the mm, in case the task is dead.
2022-12-28 14:11:48 -08:00
tcx.c
tcx: Fix splat during dev unregister
2023-07-31 14:44:02 -07:00
tnum.c
bpf, tnums: Provably sound, faster, and more precise algorithm for tnum_mul
2021-06-01 13:34:15 +02:00
trampoline.c
bpf: Fix memleak due to fentry attach failure
2023-05-15 23:41:59 +02:00
verifier.c
bpf: Fix an incorrect verification success with movsx insn
2023-08-07 16:23:35 -07:00