lkml.org 
[lkml]   [2020]   [May]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.6 059/106] bpf: Fix handling of XADD on BTF memory
    Date
    From: Jann Horn <jannh@google.com>

    commit 8ff3571f7e1bf3f293cc5e3dc14f2943f4fa7fcf upstream.

    check_xadd() can cause check_ptr_to_btf_access() to be executed with
    atype==BPF_READ and value_regno==-1 (meaning "just check whether the access
    is okay, don't tell me what type it will result in").
    Handle that case properly and skip writing type information, instead of
    indexing into the registers at index -1 and writing into out-of-bounds
    memory.

    Note that at least at the moment, you can't actually write through a BTF
    pointer, so check_xadd() will reject the program after calling
    check_ptr_to_btf_access with atype==BPF_WRITE; but that's after the
    verifier has already corrupted memory.

    This patch assumes that BTF pointers are not available in unprivileged
    programs.

    Fixes: 9e15db66136a ("bpf: Implement accurate raw_tp context access via BTF")
    Signed-off-by: Jann Horn <jannh@google.com>
    Signed-off-by: Alexei Starovoitov <ast@kernel.org>
    Link: https://lore.kernel.org/bpf/20200417000007.10734-2-jannh@google.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    kernel/bpf/verifier.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- a/kernel/bpf/verifier.c
    +++ b/kernel/bpf/verifier.c
    @@ -2885,7 +2885,7 @@ static int check_ptr_to_btf_access(struc
    if (ret < 0)
    return ret;

    - if (atype == BPF_READ) {
    + if (atype == BPF_READ && value_regno >= 0) {
    if (ret == SCALAR_VALUE) {
    mark_reg_unknown(env, regs, value_regno);
    return 0;

    \
     
     \ /
      Last update: 2020-05-01 15:44    [W:6.335 / U:0.024 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site