diff options
| author |   Alexei Starovoitov <ast@kernel.org> | 2023-08-23 09:37:29 -0700 |
|---|---|---|
| committer | Alexei Starovoitov <ast@kernel.org> | 2023-08-23 09:37:29 -0700 |
| commit | f586a77030b38f1b7258aaea44d0ab52b1963859 (patch) | |
| tree | b5f8ff0e13ef88404f818844c28d33ae0264b88e /kernel | |
| parent | libbpf: Free btf_vmlinux when closing bpf_object (diff) | |
| parent | selftests/bpf: Add selftest for allow_ptr_leaks (diff) | |
| download | wireguard-linux-f586a77030b38f1b7258aaea44d0ab52b1963859.tar.xz wireguard-linux-f586a77030b38f1b7258aaea44d0ab52b1963859.zip | |
Merge branch 'bpf-fix-an-issue-in-verifing-allow_ptr_leaks'
Yafang Shao says:
====================
bpf: Fix an issue in verifing allow_ptr_leaks
Patch #1: An issue found in our local 6.1 kernel.
This issue also exists in bpf-next.
Patch #2: Selftess for #1
v1->v2:
- Add acked-by from Eduard
- Fix build error reported by Alexei
====================
Link: https://lore.kernel.org/r/20230823020703.3790-1-laoar.shao@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Diffstat (limited to 'kernel')
| -rw-r--r-- | kernel/bpf/verifier.c | 17 |
1 files changed, 9 insertions, 8 deletions
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 3d51c737a034..0680569f9bd0 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -14041,6 +14041,12 @@ static int check_cond_jmp_op(struct bpf_verifier_env *env, return -EINVAL; } + /* check src2 operand */ + err = check_reg_arg(env, insn->dst_reg, SRC_OP); + if (err) + return err; + + dst_reg = ®s[insn->dst_reg]; if (BPF_SRC(insn->code) == BPF_X) { if (insn->imm != 0) { verbose(env, "BPF_JMP/JMP32 uses reserved fields\n"); @@ -14052,12 +14058,13 @@ static int check_cond_jmp_op(struct bpf_verifier_env *env, if (err) return err; - if (is_pointer_value(env, insn->src_reg)) { + src_reg = ®s[insn->src_reg]; + if (!(reg_is_pkt_pointer_any(dst_reg) && reg_is_pkt_pointer_any(src_reg)) && + is_pointer_value(env, insn->src_reg)) { verbose(env, "R%d pointer comparison prohibited\n", insn->src_reg); return -EACCES; } - src_reg = ®s[insn->src_reg]; } else { if (insn->src_reg != BPF_REG_0) { verbose(env, "BPF_JMP/JMP32 uses reserved fields\n"); @@ -14065,12 +14072,6 @@ static int check_cond_jmp_op(struct bpf_verifier_env *env, } } - /* check src2 operand */ - err = check_reg_arg(env, insn->dst_reg, SRC_OP); - if (err) - return err; - - dst_reg = ®s[insn->dst_reg]; is_jmp32 = BPF_CLASS(insn->code) == BPF_JMP32; if (BPF_SRC(insn->code) == BPF_K) { |