Commit f06f3897 authored by Daniel Borkmann's avatar Daniel Borkmann Committed by Zheng Zengkai
Browse files

bpf: Wrap aux data inside bpf_sanitize_info container 



stable inclusion
from stable-5.10.41
commit 4e2c7b297431457663a90d4186e666b61d5da86c
bugzilla: 51890
CVE: NA

--------------------------------

commit 3d0220f6 upstream.

Add a container structure struct bpf_sanitize_info which holds
the current aux info, and update call-sites to sanitize_ptr_alu()
to pass it in. This is needed for passing in additional state
later on.

Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Reviewed-by: default avatarPiotr Krysiuk <piotras@gmail.com>
Acked-by: default avatarAlexei Starovoitov <ast@kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarChen Jun <chenjun102@huawei.com>
Acked-by: default avatarWeilong Chen <chenweilong@huawei.com>
Signed-off-by: default avatarZheng Zengkai <zhengzengkai@huawei.com>
parent 2a5cda5c

kernel/bpf/verifier.c

+11 −7
Original line number Diff line number Diff line
@@ -5743,15 +5743,19 @@ static bool sanitize_needed(u8 opcode) 
	return opcode == BPF_ADD || opcode == BPF_SUB;

}



struct bpf_sanitize_info {

	struct bpf_insn_aux_data aux;

};



static int sanitize_ptr_alu(struct bpf_verifier_env *env,

			    struct bpf_insn *insn,

			    const struct bpf_reg_state *ptr_reg,

			    const struct bpf_reg_state *off_reg,

			    struct bpf_reg_state *dst_reg,

			    struct bpf_insn_aux_data *tmp_aux,

			    struct bpf_sanitize_info *info,

			    const bool commit_window)

{

	struct bpf_insn_aux_data *aux = commit_window ? cur_aux(env) : tmp_aux;

	struct bpf_insn_aux_data *aux = commit_window ? cur_aux(env) : &info->aux;

	struct bpf_verifier_state *vstate = env->cur_state;

	bool off_is_imm = tnum_is_const(off_reg->var_off);

	bool off_is_neg = off_reg->smin_value < 0;
@@ -5780,8 +5784,8 @@ static int sanitize_ptr_alu(struct bpf_verifier_env *env, 
		/* In commit phase we narrow the masking window based on

		 * the observed pointer move after the simulated operation.

		 */

		alu_state = tmp_aux->alu_state;

		alu_limit = abs(tmp_aux->alu_limit - alu_limit);

		alu_state = info->aux.alu_state;

		alu_limit = abs(info->aux.alu_limit - alu_limit);

	} else {

		alu_state  = off_is_neg ? BPF_ALU_NEG_VALUE : 0;

		alu_state |= off_is_imm ? BPF_ALU_IMMEDIATE : 0;
@@ -5942,7 +5946,7 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env, 
	    smin_ptr = ptr_reg->smin_value, smax_ptr = ptr_reg->smax_value;

	u64 umin_val = off_reg->umin_value, umax_val = off_reg->umax_value,

	    umin_ptr = ptr_reg->umin_value, umax_ptr = ptr_reg->umax_value;

	struct bpf_insn_aux_data tmp_aux = {};

	struct bpf_sanitize_info info = {};

	u8 opcode = BPF_OP(insn->code);

	u32 dst = insn->dst_reg;

	int ret;
@@ -6011,7 +6015,7 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env, 


	if (sanitize_needed(opcode)) {

		ret = sanitize_ptr_alu(env, insn, ptr_reg, off_reg, dst_reg,

				       &tmp_aux, false);

				       &info, false);

		if (ret < 0)

			return sanitize_err(env, insn, ret, off_reg, dst_reg);

	}
@@ -6152,7 +6156,7 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env, 
		return -EACCES;

	if (sanitize_needed(opcode)) {

		ret = sanitize_ptr_alu(env, insn, dst_reg, off_reg, dst_reg,

				       &tmp_aux, true);

				       &info, true);

		if (ret < 0)

			return sanitize_err(env, insn, ret, off_reg, dst_reg);

	}