Unverified Commit 559a0276 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!14874 bpf: Check size for BTF-based ctx access of pointer members 

Merge Pull Request from: @ci-robot 
 
PR sync from: Tengda Wu <wutengda2@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/OO45I3X2U4LQ2ZTCFQ2X6AESMQS5BCEB/ 
 
https://gitee.com/openeuler/kernel/issues/IBHYOV 
 
Link:https://gitee.com/openeuler/kernel/pulls/14874

 

Reviewed-by: default avatarYe Weihua <yeweihua4@huawei.com>
Signed-off-by: default avatarZhang Peng <zhangpeng362@huawei.com>
parents dbf11ffc 91d45007

kernel/bpf/btf.c

+6 −0
Original line number Diff line number Diff line
@@ -6127,6 +6127,12 @@ bool btf_ctx_access(int off, int size, enum bpf_access_type type, 
		return false;

	}



	if (size != sizeof(u64)) {

		bpf_log(log, "func '%s' size %d must be 8\n",

			tname, size);

		return false;

	}



	/* check for PTR_TO_RDONLY_BUF_OR_NULL or PTR_TO_RDWR_BUF_OR_NULL */

	for (i = 0; i < prog->aux->ctx_arg_info_size; i++) {

		const struct bpf_ctx_arg_aux *ctx_arg_info = &prog->aux->ctx_arg_info[i];

tools/testing/selftests/bpf/progs/verifier_btf_ctx_access.c

+2 −2
Original line number Diff line number Diff line
@@ -11,7 +11,7 @@ __success __retval(0) 
__naked void btf_ctx_access_accept(void)

{

	asm volatile ("					\

	r2 = *(u32*)(r1 + 8);		/* load 2nd argument value (int pointer) */\

	r2 = *(u64 *)(r1 + 8);		/* load 2nd argument value (int pointer) */\

	r0 = 0;						\

	exit;						\

"	::: __clobber_all);
@@ -23,7 +23,7 @@ __success __retval(0) 
__naked void ctx_access_u32_pointer_accept(void)

{

	asm volatile ("					\

	r2 = *(u32*)(r1 + 0);		/* load 1nd argument value (u32 pointer) */\

	r2 = *(u64 *)(r1 + 0);		/* load 1nd argument value (u32 pointer) */\

	r0 = 0;						\

	exit;						\

"	::: __clobber_all);

tools/testing/selftests/bpf/progs/verifier_d_path.c

+2 −2
Original line number Diff line number Diff line
@@ -11,7 +11,7 @@ __success __retval(0) 
__naked void d_path_accept(void)

{

	asm volatile ("					\

	r1 = *(u32*)(r1 + 0);				\

	r1 = *(u64 *)(r1 + 0);				\

	r2 = r10;					\

	r2 += -8;					\

	r6 = 0;						\
@@ -31,7 +31,7 @@ __failure __msg("helper call is not allowed in probe") 
__naked void d_path_reject(void)

{

	asm volatile ("					\

	r1 = *(u32*)(r1 + 0);				\

	r1 = *(u64 *)(r1 + 0);				\

	r2 = r10;					\

	r2 += -8;					\

	r6 = 0;						\