lkml.org 
[lkml]   [2022]   [Jan]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.16 0376/1039] bpf: Fix verifier support for validation of async callbacks
    Date
    From: Kris Van Hees <kris.van.hees@oracle.com>

    [ Upstream commit a5bebc4f00dee47113eed48098c68e88b5ba70e8 ]

    Commit bfc6bb74e4f1 ("bpf: Implement verifier support for validation of async callbacks.")
    added support for BPF_FUNC_timer_set_callback to
    the __check_func_call() function. The test in __check_func_call() is
    flaweed because it can mis-interpret a regular BPF-to-BPF pseudo-call
    as a BPF_FUNC_timer_set_callback callback call.

    Consider the conditional in the code:

    if (insn->code == (BPF_JMP | BPF_CALL) &&
    insn->imm == BPF_FUNC_timer_set_callback) {

    The BPF_FUNC_timer_set_callback has value 170. This means that if you
    have a BPF program that contains a pseudo-call with an instruction delta
    of 170, this conditional will be found to be true by the verifier, and
    it will interpret the pseudo-call as a callback. This leads to a mess
    with the verification of the program because it makes the wrong
    assumptions about the nature of this call.

    Solution: include an explicit check to ensure that insn->src_reg == 0.
    This ensures that calls cannot be mis-interpreted as an async callback
    call.

    Fixes: bfc6bb74e4f1 ("bpf: Implement verifier support for validation of async callbacks.")
    Signed-off-by: Kris Van Hees <kris.van.hees@oracle.com>
    Signed-off-by: Alexei Starovoitov <ast@kernel.org>
    Link: https://lore.kernel.org/bpf/20220105210150.GH1559@oracle.com
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    kernel/bpf/verifier.c | 1 +
    1 file changed, 1 insertion(+)

    diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
    index 45d5e71cd64e6..d48000b90eb8a 100644
    --- a/kernel/bpf/verifier.c
    +++ b/kernel/bpf/verifier.c
    @@ -5965,6 +5965,7 @@ static int __check_func_call(struct bpf_verifier_env *env, struct bpf_insn *insn
    }

    if (insn->code == (BPF_JMP | BPF_CALL) &&
    + insn->src_reg == 0 &&
    insn->imm == BPF_FUNC_timer_set_callback) {
    struct bpf_verifier_state *async_cb;

    --
    2.34.1


    \
     
     \ /
      Last update: 2022-01-24 23:40    [W:3.473 / U:1.332 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site