diff options
| author |   Alexei Starovoitov <ast@kernel.org> | 2024-12-02 17:47:57 -0800 |
|---|---|---|
| committer | Alexei Starovoitov <ast@kernel.org> | 2024-12-02 17:48:06 -0800 |
| commit | d4c44354bcaffed729c4eba8c0f2ecfd61fea743 (patch) | |
| tree | e8560c8a31d366717a26eab0ff8132aa3f505694 /kernel | |
| parent | tools: Override makefile ARCH variable if defined, but empty (diff) | |
| parent | selftests/bpf: Add tests for iter arg check (diff) | |
| download | wireguard-linux-d4c44354bcaffed729c4eba8c0f2ecfd61fea743.tar.xz wireguard-linux-d4c44354bcaffed729c4eba8c0f2ecfd61fea743.zip | |
Merge branch 'fix-missing-process_iter_arg-type-check'
Kumar Kartikeya Dwivedi says:
====================
Fix missing process_iter_arg type check
I am taking over Tao's earlier patch set that can be found at [0], after
an offline discussion. The bug reported in that thread is that
process_iter_arg missed a reg->type == PTR_TO_STACK check. Fix this by
adding it in, and also address comments from Andrii on the earlier
attempt. Include more selftests to ensure the error is caught.
[0]: https://lore.kernel.org/bpf/20241107214736.347630-1-tao.lyu@epfl.ch
Changelog:
----------
v1 -> v2:
v1: https://lore.kernel.org/bpf/20241127230147.4158201-1-memxor@gmail.com
====================
Link: https://patch.msgid.link/20241203000238.3602922-1-memxor@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Diffstat (limited to 'kernel')
| -rw-r--r-- | kernel/bpf/verifier.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 1c4ebb326785..358a3566bb60 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -8189,6 +8189,11 @@ static int process_iter_arg(struct bpf_verifier_env *env, int regno, int insn_id const struct btf_type *t; int spi, err, i, nr_slots, btf_id; + if (reg->type != PTR_TO_STACK) { + verbose(env, "arg#%d expected pointer to an iterator on stack\n", regno - 1); + return -EINVAL; + } + /* For iter_{new,next,destroy} functions, btf_check_iter_kfuncs() * ensures struct convention, so we wouldn't need to do any BTF * validation here. But given iter state can be passed as a parameter |