Commit 628d938d authored by Xu Kuohai's avatar Xu Kuohai Committed by Tengda Wu
Browse files

bpf: Fix compare error in function retval_range_within 

mainline inclusion
from mainline-v6.12-rc1
commit 763aa759d3b2c4f95b11855e3d37b860860107e2
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYPJF
CVE: CVE-2024-47703

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=763aa759d3b2c4f95b11855e3d37b860860107e2



--------------------------------

After checking lsm hook return range in verifier, the test case
"test_progs -t test_lsm" failed, and the failure log says:

libbpf: prog 'test_int_hook': BPF program load failed: Invalid argument
libbpf: prog 'test_int_hook': -- BEGIN PROG LOAD LOG --
0: R1=ctx() R10=fp0
; int BPF_PROG(test_int_hook, struct vm_area_struct *vma, @ lsm.c:89
0: (79) r0 = *(u64 *)(r1 +24)         ; R0_w=scalar(smin=smin32=-4095,smax=smax32=0) R1=ctx()

[...]

24: (b4) w0 = -1                      ; R0_w=0xffffffff
; int BPF_PROG(test_int_hook, struct vm_area_struct *vma, @ lsm.c:89
25: (95) exit
At program exit the register R0 has smin=4294967295 smax=4294967295 should have been in [-4095, 0]

It can be seen that instruction "w0 = -1" zero extended -1 to 64-bit
register r0, setting both smin and smax values of r0 to 4294967295.
This resulted in a false reject when r0 was checked with range [-4095, 0].

Given bpf lsm does not return 64-bit values, this patch fixes it by changing
the compare between r0 and return range from 64-bit operation to 32-bit
operation for bpf lsm.

Fixes: 8fa4ecd49b81 ("bpf: enforce exact retval range on subprog/callback exit")
Signed-off-by: default avatarXu Kuohai <xukuohai@huawei.com>
Acked-by: default avatarShung-Hsi Yu <shung-hsi.yu@suse.com>
Link: https://lore.kernel.org/r/20240719110059.797546-5-xukuohai@huaweicloud.com


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
Signed-off-by: default avatarAndrii Nakryiko <andrii@kernel.org>

Conflicts:
	kernel/bpf/verifier.c
[Did not backport b9ae0c9dd0ac ("bpf: Add support for custom exception
callbacks") and 0ef24c8dfae2 ("bpf: unify async callback and program
retval checks")]
Signed-off-by: default avatarTengda Wu <wutengda2@huawei.com>
parent 74674bdf

kernel/bpf/verifier.c

+12 −6
Original line number Diff line number Diff line
@@ -9676,8 +9676,12 @@ static bool in_rbtree_lock_required_cb(struct bpf_verifier_env *env) 
	return is_rbtree_lock_required_kfunc(kfunc_btf_id);

}









static bool retval_range_within(struct bpf_retval_range range, const struct bpf_reg_state *reg)









static bool retval_range_within(struct bpf_retval_range range, const struct bpf_reg_state *reg,









				bool return_32bit)









{









	if (return_32bit)









		return range.minval <= reg->s32_min_value && reg->s32_max_value <= range.maxval;









	else









		return range.minval <= reg->smin_value && reg->smax_value <= range.maxval;









}


















@@ -9715,8 +9719,8 @@ static int prepare_func_exit(struct bpf_verifier_env *env, int *insn_idx)







		if (err)









			return err;

















		/* enforce R0 return value range */









		if (!retval_range_within(callee->callback_ret_range, r0)) {









		/* enforce R0 return value range, and bpf_callback_t returns 64bit */









		if (!retval_range_within(callee->callback_ret_range, r0, false)) {









			verbose_invalid_scalar(env, r0, callee->callback_ret_range,









					       "callback return", "R0");









			return -EINVAL;










@@ -14999,6 +15003,7 @@ static int check_return_code(struct bpf_verifier_env *env)







	int err;









	struct bpf_func_state *frame = env->cur_state->frame[0];









	const bool is_subprog = frame->subprogno;









	bool return_32bit = false;

















	/* LSM and struct_ops func-ptr's return type could be "void" */









	if (!is_subprog) {










@@ -15042,7 +15047,7 @@ static int check_return_code(struct bpf_verifier_env *env)







			return -EINVAL;









		}

















		if (!retval_range_within(const_0, reg)) {









		if (!retval_range_within(const_0, reg, false)) {









			verbose_invalid_scalar(env, reg, const_0, "async callback", "R0");









			return -EINVAL;









		}










@@ -15115,6 +15120,7 @@ static int check_return_code(struct bpf_verifier_env *env)







			/* no restricted range, any return value is allowed */









			if (range.minval == S32_MIN && range.maxval == S32_MAX)









				return 0;









			return_32bit = true;









		} else if (!env->prog->aux->attach_func_proto->type) {









			/* Make sure programs that attach to void









			 * hooks don't try to modify return value.










@@ -15140,7 +15146,7 @@ static int check_return_code(struct bpf_verifier_env *env)







		return -EINVAL;









	}

















	if (!retval_range_within(range, reg)) {









	if (!retval_range_within(range, reg, return_32bit)) {









		verbose_invalid_scalar(env, reg, range, "program exit", "R0");









		if (prog->expected_attach_type == BPF_LSM_CGROUP &&









		    prog_type == BPF_PROG_TYPE_LSM &&