Commit f586a770 authored by Alexei Starovoitov's avatar Alexei Starovoitov
Browse files

Merge branch 'bpf-fix-an-issue-in-verifing-allow_ptr_leaks' 

Yafang Shao says:

====================
bpf: Fix an issue in verifing allow_ptr_leaks

Patch #1: An issue found in our local 6.1 kernel.
          This issue also exists in bpf-next.
Patch #2: Selftess for #1

v1->v2:
  - Add acked-by from Eduard
  - Fix build error reported by Alexei
====================

Link: https://lore.kernel.org/r/20230823020703.3790-1-laoar.shao@gmail.com


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parents 29d67fde 0072e362

kernel/bpf/verifier.c

+9 −8
Original line number Diff line number Diff line
@@ -14041,6 +14041,12 @@ static int check_cond_jmp_op(struct bpf_verifier_env *env, 
		return -EINVAL;

	}









	/* check src2 operand */









	err = check_reg_arg(env, insn->dst_reg, SRC_OP);









	if (err)









		return err;

















	dst_reg = &regs[insn->dst_reg];









	if (BPF_SRC(insn->code) == BPF_X) {









		if (insn->imm != 0) {









			verbose(env, "BPF_JMP/JMP32 uses reserved fields\n");








@@ -14052,12 +14058,13 @@ static int check_cond_jmp_op(struct bpf_verifier_env *env,







		if (err)









			return err;

















		if (is_pointer_value(env, insn->src_reg)) {









		src_reg = &regs[insn->src_reg];









		if (!(reg_is_pkt_pointer_any(dst_reg) && reg_is_pkt_pointer_any(src_reg)) &&









		    is_pointer_value(env, insn->src_reg)) {









			verbose(env, "R%d pointer comparison prohibited\n",









				insn->src_reg);









			return -EACCES;









		}









		src_reg = &regs[insn->src_reg];









	} else {









		if (insn->src_reg != BPF_REG_0) {









			verbose(env, "BPF_JMP/JMP32 uses reserved fields\n");








@@ -14065,12 +14072,6 @@ static int check_cond_jmp_op(struct bpf_verifier_env *env,







		}









	}

















	/* check src2 operand */









	err = check_reg_arg(env, insn->dst_reg, SRC_OP);









	if (err)









		return err;

















	dst_reg = &regs[insn->dst_reg];









	is_jmp32 = BPF_CLASS(insn->code) == BPF_JMP32;

















	if (BPF_SRC(insn->code) == BPF_K) {
































tools/testing/selftests/bpf/prog_tests/tc_bpf.c



+35
−1






























Original line number
Diff line number
Diff line







@@ -3,6 +3,7 @@







#include <test_progs.h>









#include <linux/pkt_cls.h>



















#include "cap_helpers.h"









#include "test_tc_bpf.skel.h"



















#define LO_IFINDEX 1








@@ -327,7 +328,7 @@ static int test_tc_bpf_api(struct bpf_tc_hook *hook, int fd)







	return 0;









}



















void test_tc_bpf(void)









void tc_bpf_root(void)









{









	DECLARE_LIBBPF_OPTS(bpf_tc_hook, hook, .ifindex = LO_IFINDEX,









			    .attach_point = BPF_TC_INGRESS);








@@ -393,3 +394,36 @@ void test_tc_bpf(void)







	}









	test_tc_bpf__destroy(skel);









}



















void tc_bpf_non_root(void)









{









	struct test_tc_bpf *skel = NULL;









	__u64 caps = 0;









	int ret;



















	/* In case CAP_BPF and CAP_PERFMON is not set */









	ret = cap_enable_effective(1ULL << CAP_BPF | 1ULL << CAP_NET_ADMIN, &caps);









	if (!ASSERT_OK(ret, "set_cap_bpf_cap_net_admin"))









		return;









	ret = cap_disable_effective(1ULL << CAP_SYS_ADMIN | 1ULL << CAP_PERFMON, NULL);









	if (!ASSERT_OK(ret, "disable_cap_sys_admin"))









		goto restore_cap;



















	skel = test_tc_bpf__open_and_load();









	if (!ASSERT_OK_PTR(skel, "test_tc_bpf__open_and_load"))









		goto restore_cap;



















	test_tc_bpf__destroy(skel);



















restore_cap:









	if (caps)









		cap_enable_effective(caps, NULL);









}



















void test_tc_bpf(void)









{









	if (test__start_subtest("tc_bpf_root"))









		tc_bpf_root();









	if (test__start_subtest("tc_bpf_non_root"))









		tc_bpf_non_root();









}
























tools/testing/selftests/bpf/progs/test_tc_bpf.c



+13
−0






























Original line number
Diff line number
Diff line







@@ -2,6 +2,8 @@

















#include <linux/bpf.h>









#include <bpf/bpf_helpers.h>









#include <linux/if_ether.h>









#include <linux/ip.h>



















/* Dummy prog to test TC-BPF API */


















@@ -10,3 +12,14 @@ int cls(struct __sk_buff *skb)







{









	return 0;









}



















/* Prog to verify tc-bpf without cap_sys_admin and cap_perfmon */









SEC("tcx/ingress")









int pkt_ptr(struct __sk_buff *skb)









{









	struct iphdr *iph = (void *)(long)skb->data + sizeof(struct ethhdr);



















	if ((long)(iph + 1) > (long)skb->data_end)









		return 1;









	return 0;









}