Unverified Commit 4d0f562f authored Aug 02, 2024 by openeuler-ci-bot Committed by Gitee Aug 02, 2024

!10351 bpf: Fix null-pointer-deref in resolve_prog_type()

Merge Pull Request from: @ci-robot 
 
PR sync from: Tengda Wu <wutengda2@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/MCAECRX6BCKMZCGGS6DAMD5ZRQAKKH52/ 
This patchset is going to fix null-pointer-deref in resolve_prog_type()
for BPF_PROG_TYPE_EXT.

`prog->aux->dst_prog` in resolve_prog_type() is assigned by
`attach_prog_fd`, and would be NULL if `attach_prog_fd` is not
provided. Loading EXT prog with bpf_dynptr_from_skb() kfunc call
in this way will lead to null-pointer-deref.

In last version we fix it by forcing `attach_prog_fd` non-empty
at load time, which leads to libbpf_probe_prog_types() api broken.
Currently, we fix it by just adding null check for EXT prog in
resolve_prog_type() as the old way did.

For the sake of safety, we compared the full test logs of selftest
before and after applying these changes, and the results show that
the two test logs were consistent.

Tengda Wu (2):
  bpf: Fix null pointer dereference in resolve_prog_type() for
    BPF_PROG_TYPE_EXT
  selftests/bpf: Test for null-pointer-deref bugfix in
    resolve_prog_type()


-- 
2.34.1
 
https://gitee.com/openeuler/kernel/issues/IAD7R8 
 
Link:https://gitee.com/openeuler/kernel/pulls/10351

 

Reviewed-by: Ye Weihua <yeweihua4@huawei.com>
Signed-off-by: Zhang Peng <zhangpeng362@huawei.com>

parents 50ac61bf cfd49b5a

include/linux/bpf_verifier.h

+1 −1

Original line number	Diff line number	Diff line
		@@ -800,7 +800,7 @@ static inline u32 type_flag(u32 type)
		/* only use after check_attach_btf_id() */
		static inline enum bpf_prog_type resolve_prog_type(const struct bpf_prog *prog)
		{
		return prog->type == BPF_PROG_TYPE_EXT ?
		return (prog->type == BPF_PROG_TYPE_EXT && prog->aux->dst_prog) ?
		prog->aux->dst_prog->type : prog->type;
		}

tools/testing/selftests/bpf/verifier/calls.c

+13 −0

Original line number	Diff line number	Diff line
		@@ -275,6 +275,19 @@
		.result_unpriv = REJECT,
		.result = ACCEPT,
		},
		{
		"calls: invalid kfunc call: must provide (attach_prog_fd, btf_id) pair when freplace",
		.insns = {
		BPF_RAW_INSN(BPF_JMP \| BPF_CALL, 0, BPF_PSEUDO_KFUNC_CALL, 0, 0),
		BPF_EXIT_INSN(),
		},
		.prog_type = BPF_PROG_TYPE_EXT,
		.result = REJECT,
		.errstr = "Tracing programs must provide btf_id",
		.fixup_kfunc_btf_id = {
		{ "bpf_dynptr_from_skb", 0 },
		},
		},
		{
		"calls: basic sanity",
		.insns = {