Kernel/linux-next
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git synced 2025-01-07 22:42:04 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge branch 'add-missing-size-check-for-btf-based-ctx-access'

Browse Source 
Kumar Kartikeya Dwivedi says:

====================
Add missing size check for BTF-based ctx access

This set fixes a issue reported for tracing and struct ops programs
using btf_ctx_access for ctx checks, where loading a pointer argument
from the ctx doesn't enforce a BPF_DW access size check. The original
report is at link [0]. Also add a regression test along with the fix.

  [0]: https://lore.kernel.org/bpf/51338.1732985814@localhost
====================

Link: https://patch.msgid.link/20241212092050.3204165-1-memxor@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
This commit is contained in:
Alexei Starovoitov 2024-12-12 11:40:18 -08:00
commit e4c80f6975
3 changed files with 46 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
kernel/bpf/btf.c
View File

@ -6543,6 +6543,12 @@ bool btf_ctx_access(int off, int size, enum bpf_access_type type,
return false;
}
if (size != sizeof(u64)) {
bpf_log(log, "func '%s' size %d must be 8\n",
tname, size);
return false;
}
/* check for PTR_TO_RDONLY_BUF_OR_NULL or PTR_TO_RDWR_BUF_OR_NULL */
for (i = 0; i < prog->aux->ctx_arg_info_size; i++) {
const struct bpf_ctx_arg_aux *ctx_arg_info = &prog->aux->ctx_arg_info[i];

40
tools/testing/selftests/bpf/progs/verifier_btf_ctx_access.c
View File

@ -11,7 +11,7 @@ __success __retval(0)
__naked void btf_ctx_access_accept(void)
{
asm volatile (" \
r2 = *(u32*)(r1 + 8); /* load 2nd argument value (int pointer) */\
r2 = *(u64 *)(r1 + 8); /* load 2nd argument value (int pointer) */\
r0 = 0; \
exit; \
" ::: __clobber_all);
@ -23,7 +23,43 @@ __success __retval(0)
__naked void ctx_access_u32_pointer_accept(void)
{
asm volatile (" \
r2 = *(u32*)(r1 + 0); /* load 1nd argument value (u32 pointer) */\
r2 = *(u64 *)(r1 + 0); /* load 1nd argument value (u32 pointer) */\
r0 = 0; \
exit; \
" ::: __clobber_all);
}
SEC("fentry/bpf_fentry_test9")
__description("btf_ctx_access u32 pointer reject u32")
__failure __msg("size 4 must be 8")
__naked void ctx_access_u32_pointer_reject_32(void)
{
asm volatile (" \
r2 = *(u32 *)(r1 + 0); /* load 1st argument with narrow load */\
r0 = 0; \
exit; \
" ::: __clobber_all);
}
SEC("fentry/bpf_fentry_test9")
__description("btf_ctx_access u32 pointer reject u16")
__failure __msg("size 2 must be 8")
__naked void ctx_access_u32_pointer_reject_16(void)
{
asm volatile (" \
r2 = *(u16 *)(r1 + 0); /* load 1st argument with narrow load */\
r0 = 0; \
exit; \
" ::: __clobber_all);
}
SEC("fentry/bpf_fentry_test9")
__description("btf_ctx_access u32 pointer reject u8")
__failure __msg("size 1 must be 8")
__naked void ctx_access_u32_pointer_reject_8(void)
{
asm volatile (" \
r2 = *(u8 *)(r1 + 0); /* load 1st argument with narrow load */\
r0 = 0; \
exit; \
" ::: __clobber_all);

4
tools/testing/selftests/bpf/progs/verifier_d_path.c
View File

@ -11,7 +11,7 @@ __success __retval(0)
__naked void d_path_accept(void)
{
asm volatile (" \
r1 = *(u32*)(r1 + 0); \
r1 = *(u64 *)(r1 + 0); \
r2 = r10; \
r2 += -8; \
r6 = 0; \
@ -31,7 +31,7 @@ __failure __msg("helper call is not allowed in probe")
__naked void d_path_reject(void)
{
asm volatile (" \
r1 = *(u32*)(r1 + 0); \
r1 = *(u64 *)(r1 + 0); \
r2 = r10; \
r2 += -8; \
r6 = 0; \