[PATCH bpf-next] bpf: Check attach_func_proto more carefully in check_helper_call

[PATCH bpf-next] bpf: Check attach_func_proto more carefully in check_helper_call

[Stanislav Fomichev]

Syzkaller found a problem similar to d1a6edecc1fd ("bpf: Check
attach_func_proto more carefully in check_return_code") where
attach_func_proto might be NULL:

RIP: 0010:check_helper_call+0x3dcb/0x8d50 kernel/bpf/verifier.c:7330
 do_check kernel/bpf/verifier.c:12302 [inline]
 do_check_common+0x6e1e/0xb980 kernel/bpf/verifier.c:14610
 do_check_main kernel/bpf/verifier.c:14673 [inline]
 bpf_check+0x661e/0xc520 kernel/bpf/verifier.c:15243
 bpf_prog_load+0x11ae/0x1f80 kernel/bpf/syscall.c:2620

With the following reproducer:

  bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0xf, 0x4, &(0x7f0000000040)=@framed={{}, [@call={0x85, 0x0, 0x0, 0xbb}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80)

Let's do the same here, only check attach_func_proto for the prog types
where we are certain that attach_func_proto is defined.

Fixes: 69fd337a975c ("bpf: per-cgroup lsm flavor")
Reported-by: syzbot+0f8d989b1fba1addc5e0@syzkaller.appspotmail.com
Signed-off-by: Stanislav Fomichev <sdf@google.com>
---
 kernel/bpf/verifier.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index c59c3df0fea6..7c1e056624f9 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -7170,6 +7170,7 @@ static void update_loop_inline_state(struct bpf_verifier_env *env, u32 subprogno
 static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
 			     int *insn_idx_p)
 {
+	enum bpf_prog_type prog_type = resolve_prog_type(env->prog);
 	const struct bpf_func_proto *fn = NULL;
 	enum bpf_return_type ret_type;
 	enum bpf_type_flag ret_flag;
@@ -7331,7 +7332,8 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn
 		}
 		break;
 	case BPF_FUNC_set_retval:
-		if (env->prog->expected_attach_type == BPF_LSM_CGROUP) {
+		if (prog_type == BPF_PROG_TYPE_LSM &&
+		    env->prog->expected_attach_type == BPF_LSM_CGROUP) {
 			if (!env->prog->aux->attach_func_proto->type) {
 				/* Make sure programs that attach to void
 				 * hooks don't try to modify return value.
-- 
2.37.0.170.g444d1eabd0-goog

Re: [PATCH bpf-next] bpf: Check attach_func_proto more carefully in check_helper_call

[Martin KaFai Lau]

On Wed, Jul 20, 2022 at 09:47:29AM -0700, Stanislav Fomichev wrote:
> Syzkaller found a problem similar to d1a6edecc1fd ("bpf: Check
> attach_func_proto more carefully in check_return_code") where
> attach_func_proto might be NULL:
> 
> RIP: 0010:check_helper_call+0x3dcb/0x8d50 kernel/bpf/verifier.c:7330
>  do_check kernel/bpf/verifier.c:12302 [inline]
>  do_check_common+0x6e1e/0xb980 kernel/bpf/verifier.c:14610
>  do_check_main kernel/bpf/verifier.c:14673 [inline]
>  bpf_check+0x661e/0xc520 kernel/bpf/verifier.c:15243
>  bpf_prog_load+0x11ae/0x1f80 kernel/bpf/syscall.c:2620
> 
> With the following reproducer:
> 
>   bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0xf, 0x4, &(0x7f0000000040)=@framed={{}, [@call={0x85, 0x0, 0x0, 0xbb}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80)
Only BPF_PROG_TYPE_CGROUP_* (and the new lsm_cgroup) can get to
the set_retval func proto.  I thought all BPF_PROG_TYPE_CGROUP_* has enforced
expected_attach_type.  It turns out not true for BPF_PROG_TYPE_CGROUP_DEVICE and
BPF_PROG_TYPE_CGROUP_SYSCTL.

Acked-by: Martin KaFai Lau <kafai@fb.com>

Re: [PATCH bpf-next] bpf: Check attach_func_proto more carefully in check_helper_call

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to bpf/bpf-next.git (master)
by Daniel Borkmann <daniel@iogearbox.net>:

On Wed, 20 Jul 2022 09:47:29 -0700 you wrote:
> Syzkaller found a problem similar to d1a6edecc1fd ("bpf: Check
> attach_func_proto more carefully in check_return_code") where
> attach_func_proto might be NULL:
> 
> RIP: 0010:check_helper_call+0x3dcb/0x8d50 kernel/bpf/verifier.c:7330
>  do_check kernel/bpf/verifier.c:12302 [inline]
>  do_check_common+0x6e1e/0xb980 kernel/bpf/verifier.c:14610
>  do_check_main kernel/bpf/verifier.c:14673 [inline]
>  bpf_check+0x661e/0xc520 kernel/bpf/verifier.c:15243
>  bpf_prog_load+0x11ae/0x1f80 kernel/bpf/syscall.c:2620
> 
> [...]

Here is the summary with links:
  - [bpf-next] bpf: Check attach_func_proto more carefully in check_helper_call
    https://git.kernel.org/bpf/bpf-next/c/aef9d4a34a51

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html