Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d93080cd authored by Daniel Borkmann's avatar Daniel Borkmann Committed by Greg Kroah-Hartman
Browse files

bpf: fix partial copy of map_ptr when dst is scalar 



commit 0962590e553331db2cc0aef2dc35c57f6300dbbe upstream.

ALU operations on pointers such as scalar_reg += map_value_ptr are
handled in adjust_ptr_min_max_vals(). Problem is however that map_ptr
and range in the register state share a union, so transferring state
through dst_reg->range = ptr_reg->range is just buggy as any new
map_ptr in the dst_reg is then truncated (or null) for subsequent
checks. Fix this by adding a raw member and use it for copying state
over to dst_reg.

Fixes: f1174f77 ("bpf/verifier: rework value tracking")
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Cc: Edward Cree <ecree@solarflare.com>
Acked-by: default avatarAlexei Starovoitov <ast@kernel.org>
Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
Acked-by: default avatarEdward Cree <ecree@solarflare.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 07a03b97

include/linux/bpf_verifier.h

+3 −0
Original line number Original line Diff line number Diff line
@@ -50,6 +50,9 @@ struct bpf_reg_state { 
		 *   PTR_TO_MAP_VALUE_OR_NULL

		 *   PTR_TO_MAP_VALUE_OR_NULL

		 */

		 */

		struct bpf_map *map_ptr;

		struct bpf_map *map_ptr;



		/* Max size from any of the above. */

		unsigned long raw;

	};

	};

	/* Fixed part of pointer offset, pointer types only */

	/* Fixed part of pointer offset, pointer types only */

	s32 off;

	s32 off;

kernel/bpf/verifier.c

+6 −4
Original line number Original line Diff line number Diff line
@@ -2762,7 +2762,7 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env, 
			dst_reg->umax_value = umax_ptr;

			dst_reg->umax_value = umax_ptr;

			dst_reg->var_off = ptr_reg->var_off;

			dst_reg->var_off = ptr_reg->var_off;

			dst_reg->off = ptr_reg->off + smin_val;

			dst_reg->off = ptr_reg->off + smin_val;

			dst_reg->range = ptr_reg->range;

			dst_reg->raw = ptr_reg->raw;

			break;

			break;

		}

		}

		/* A new variable offset is created.  Note that off_reg->off

		/* A new variable offset is created.  Note that off_reg->off
@@ -2792,10 +2792,11 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env, 
		}

		}

		dst_reg->var_off = tnum_add(ptr_reg->var_off, off_reg->var_off);

		dst_reg->var_off = tnum_add(ptr_reg->var_off, off_reg->var_off);

		dst_reg->off = ptr_reg->off;

		dst_reg->off = ptr_reg->off;

		dst_reg->raw = ptr_reg->raw;

		if (reg_is_pkt_pointer(ptr_reg)) {

		if (reg_is_pkt_pointer(ptr_reg)) {

			dst_reg->id = ++env->id_gen;

			dst_reg->id = ++env->id_gen;

			/* something was added to pkt_ptr, set range to zero */

			/* something was added to pkt_ptr, set range to zero */

			dst_reg->range = 0;

			dst_reg->raw = 0;

		}

		}

		break;

		break;

	case BPF_SUB:

	case BPF_SUB:
@@ -2824,7 +2825,7 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env, 
			dst_reg->var_off = ptr_reg->var_off;

			dst_reg->var_off = ptr_reg->var_off;

			dst_reg->id = ptr_reg->id;

			dst_reg->id = ptr_reg->id;

			dst_reg->off = ptr_reg->off - smin_val;

			dst_reg->off = ptr_reg->off - smin_val;

			dst_reg->range = ptr_reg->range;

			dst_reg->raw = ptr_reg->raw;

			break;

			break;

		}

		}

		/* A new variable offset is created.  If the subtrahend is known

		/* A new variable offset is created.  If the subtrahend is known
@@ -2850,11 +2851,12 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env, 
		}

		}

		dst_reg->var_off = tnum_sub(ptr_reg->var_off, off_reg->var_off);

		dst_reg->var_off = tnum_sub(ptr_reg->var_off, off_reg->var_off);

		dst_reg->off = ptr_reg->off;

		dst_reg->off = ptr_reg->off;

		dst_reg->raw = ptr_reg->raw;

		if (reg_is_pkt_pointer(ptr_reg)) {

		if (reg_is_pkt_pointer(ptr_reg)) {

			dst_reg->id = ++env->id_gen;

			dst_reg->id = ++env->id_gen;

			/* something was added to pkt_ptr, set range to zero */

			/* something was added to pkt_ptr, set range to zero */

			if (smin_val < 0)

			if (smin_val < 0)

				dst_reg->range = 0;

				dst_reg->raw = 0;

		}

		}

		break;

		break;

	case BPF_AND:

	case BPF_AND: