Commit 720f0587 authored by Daniel Borkmann's avatar Daniel Borkmann Committed by Xiaomeng Zhang
Browse files

bpf: Improve check_raw_mode_ok test for MEM_UNINIT-tagged types 

mainline inclusion
from mainline-v6.12-rc1
commit 18752d73c1898fd001569195ba4b0b8c43255f4a
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYQOP
CVE: CVE-2024-49861

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=18752d73c189



--------------------------------

When checking malformed helper function signatures, also take other argument
types into account aside from just ARG_PTR_TO_UNINIT_MEM.

This concerns (formerly) ARG_PTR_TO_{INT,LONG} given uninitialized memory can
be passed there, too.

The func proto sanity check goes back to commit 435faee1 ("bpf, verifier:
add ARG_PTR_TO_RAW_STACK type"), and its purpose was to detect wrong func protos
which had more than just one MEM_UNINIT-tagged type as arguments.

The reason more than one is currently not supported is as we mark stack slots with
STACK_MISC in check_helper_call() in case of raw mode based on meta.access_size to
allow uninitialized stack memory to be passed to helpers when they just write into
the buffer.

Probing for base type as well as MEM_UNINIT tagging ensures that other types do not
get missed (as it used to be the case for ARG_PTR_TO_{INT,LONG}).

Fixes: 57c3bb72 ("bpf: Introduce ARG_PTR_TO_{INT,LONG} arg types")
Reported-by: default avatarShung-Hsi Yu <shung-hsi.yu@suse.com>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Acked-by: default avatarAndrii Nakryiko <andrii@kernel.org>
Acked-by: default avatarShung-Hsi Yu <shung-hsi.yu@suse.com>
Link: https://lore.kernel.org/r/20240913191754.13290-4-daniel@iogearbox.net


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
Conflicts:
	kernel/bpf/verifier.c
[The conflicts were due to some minor issue]
Signed-off-by: default avatarXiaomeng Zhang <zhangxiaomeng13@huawei.com>
parent bb1ea0bb

kernel/bpf/verifier.c

+11 −5
Original line number Diff line number Diff line
@@ -4706,6 +4706,12 @@ static bool arg_type_is_mem_size(enum bpf_arg_type type) 
	       type == ARG_CONST_SIZE_OR_ZERO;

}



static bool arg_type_is_raw_mem(enum bpf_arg_type type)

{

	return base_type(type) == ARG_PTR_TO_MEM &&

		type & MEM_UNINIT;

}



static bool arg_type_is_alloc_size(enum bpf_arg_type type)

{

	return type == ARG_CONST_ALLOC_SIZE_OR_ZERO;
@@ -5343,15 +5349,15 @@ static bool check_raw_mode_ok(const struct bpf_func_proto *fn) 
{

	int count = 0;



	if (fn->arg1_type == ARG_PTR_TO_UNINIT_MEM)

	if (arg_type_is_raw_mem(fn->arg1_type))

		count++;

	if (fn->arg2_type == ARG_PTR_TO_UNINIT_MEM)

	if (arg_type_is_raw_mem(fn->arg2_type))

		count++;

	if (fn->arg3_type == ARG_PTR_TO_UNINIT_MEM)

	if (arg_type_is_raw_mem(fn->arg3_type))

		count++;

	if (fn->arg4_type == ARG_PTR_TO_UNINIT_MEM)

	if (arg_type_is_raw_mem(fn->arg4_type))

		count++;

	if (fn->arg5_type == ARG_PTR_TO_UNINIT_MEM)

	if (arg_type_is_raw_mem(fn->arg5_type))

		count++;



	/* We only support one arg being in raw mode at the moment,