lkml.org 
[lkml]   [2020]   [Apr]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 5.6 77/79] bpf: Propagate expected_attach_type when verifying freplace programs
    Date
    From: Toke Høiland-Jørgensen <toke@redhat.com>

    [ Upstream commit 03f87c0b45b177ba5f6b4a9bbe9f95e4aba31026 ]

    For some program types, the verifier relies on the expected_attach_type of
    the program being verified in the verification process. However, for
    freplace programs, the attach type was not propagated along with the
    verifier ops, so the expected_attach_type would always be zero for freplace
    programs.

    This in turn caused the verifier to sometimes make the wrong call for
    freplace programs. For all existing uses of expected_attach_type for this
    purpose, the result of this was only false negatives (i.e., freplace
    functions would be rejected by the verifier even though they were valid
    programs for the target they were replacing). However, should a false
    positive be introduced, this can lead to out-of-bounds accesses and/or
    crashes.

    The fix introduced in this patch is to propagate the expected_attach_type
    to the freplace program during verification, and reset it after that is
    done.

    Fixes: be8704ff07d2 ("bpf: Introduce dynamic program extensions")
    Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
    Signed-off-by: Alexei Starovoitov <ast@kernel.org>
    Link: https://lore.kernel.org/bpf/158773526726.293902.13257293296560360508.stgit@toke.dk
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    kernel/bpf/verifier.c | 8 ++++++++
    1 file changed, 8 insertions(+)

    diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
    index 1381913cb10ba..1c53ccbd5b5d6 100644
    --- a/kernel/bpf/verifier.c
    +++ b/kernel/bpf/verifier.c
    @@ -9892,6 +9892,7 @@ static int check_attach_btf_id(struct bpf_verifier_env *env)
    return -EINVAL;
    }
    env->ops = bpf_verifier_ops[tgt_prog->type];
    + prog->expected_attach_type = tgt_prog->expected_attach_type;
    }
    if (!tgt_prog->jited) {
    verbose(env, "Can attach to only JITed progs\n");
    @@ -10225,6 +10226,13 @@ err_release_maps:
    * them now. Otherwise free_used_maps() will release them.
    */
    release_maps(env);
    +
    + /* extension progs temporarily inherit the attach_type of their targets
    + for verification purposes, so set it back to zero before returning
    + */
    + if (env->prog->type == BPF_PROG_TYPE_EXT)
    + env->prog->expected_attach_type = 0;
    +
    *prog = env->prog;
    err_unlock:
    if (!is_priv)
    --
    2.20.1
    \
     
     \ /
      Last update: 2020-04-30 16:09    [W:4.878 / U:0.004 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site