From: Kumar Kartikeya Dwivedi <memxor@gmail.com>
To: bpf@vger.kernel.org
Cc: Alexei Starovoitov <ast@kernel.org>,
Andrii Nakryiko <andrii@kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>,
Dave Marchevsky <davemarchevsky@fb.com>,
Delyan Kratunov <delyank@fb.com>
Subject: [PATCH bpf-next v1 04/25] bpf: Fix slot type check in check_stack_write_var_off
Date: Tue, 11 Oct 2022 06:52:19 +0530 [thread overview]
Message-ID: <20221011012240.3149-5-memxor@gmail.com> (raw)
In-Reply-To: <20221011012240.3149-1-memxor@gmail.com>
For the case where allow_ptr_leaks is false, code is checking whether
slot type is STACK_INVALID and STACK_SPILL and rejecting other cases.
This is a consequence of incorrectly checking for register type instead
of the slot type (NOT_INIT and SCALAR_VALUE respectively). Fix the
check.
Fixes: 01f810ace9ed ("bpf: Allow variable-offset stack access")
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
---
kernel/bpf/verifier.c | 19 +++++++++++--------
1 file changed, 11 insertions(+), 8 deletions(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 48a10d79f1bf..bbbd44b0fd6f 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -3181,14 +3181,17 @@ static int check_stack_write_var_off(struct bpf_verifier_env *env,
stype = &state->stack[spi].slot_type[slot % BPF_REG_SIZE];
mark_stack_slot_scratched(env, spi);
- if (!env->allow_ptr_leaks
- && *stype != NOT_INIT
- && *stype != SCALAR_VALUE) {
- /* Reject the write if there's are spilled pointers in
- * range. If we didn't reject here, the ptr status
- * would be erased below (even though not all slots are
- * actually overwritten), possibly opening the door to
- * leaks.
+ if (!env->allow_ptr_leaks && *stype != STACK_MISC && *stype != STACK_ZERO) {
+ /* Reject the write if range we may write to has not
+ * been initialized beforehand. If we didn't reject
+ * here, the ptr status would be erased below (even
+ * though not all slots are actually overwritten),
+ * possibly opening the door to leaks.
+ *
+ * We do however catch STACK_INVALID case below, and
+ * only allow reading possibly uninitialized memory
+ * later for CAP_PERFMON, as the write may not happen to
+ * that slot.
*/
verbose(env, "spilled ptr in range of var-offset stack write; insn %d, ptr off: %d",
insn_idx, i);
--
2.34.1
next prev parent reply other threads:[~2022-10-11 1:23 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-10-11 1:22 [PATCH bpf-next v1 00/25] Local kptrs, BPF linked lists Kumar Kartikeya Dwivedi
2022-10-11 1:22 ` [PATCH bpf-next v1 01/25] bpf: Document UAPI details for special BPF types Kumar Kartikeya Dwivedi
2022-10-11 1:22 ` [PATCH bpf-next v1 02/25] bpf: Allow specifying volatile type modifier for kptrs Kumar Kartikeya Dwivedi
2022-10-11 1:22 ` [PATCH bpf-next v1 03/25] bpf: Clobber stack slot when writing over spilled PTR_TO_BTF_ID Kumar Kartikeya Dwivedi
2022-10-11 1:22 ` Kumar Kartikeya Dwivedi [this message]
2022-10-11 1:22 ` [PATCH bpf-next v1 05/25] bpf: Drop reg_type_may_be_refcounted_or_null Kumar Kartikeya Dwivedi
2022-10-11 1:22 ` [PATCH bpf-next v1 06/25] bpf: Refactor kptr_off_tab into fields_tab Kumar Kartikeya Dwivedi
2022-10-11 1:22 ` [PATCH bpf-next v1 07/25] bpf: Consolidate spin_lock, timer management " Kumar Kartikeya Dwivedi
2022-10-11 1:22 ` [PATCH bpf-next v1 08/25] bpf: Refactor map->off_arr handling Kumar Kartikeya Dwivedi
2022-10-11 1:22 ` [PATCH bpf-next v1 09/25] bpf: Support bpf_list_head in map values Kumar Kartikeya Dwivedi
2022-10-11 1:22 ` [PATCH bpf-next v1 10/25] bpf: Introduce local kptrs Kumar Kartikeya Dwivedi
2022-10-11 1:22 ` [PATCH bpf-next v1 11/25] bpf: Recognize bpf_{spin_lock,list_head,list_node} in " Kumar Kartikeya Dwivedi
2022-10-11 1:22 ` [PATCH bpf-next v1 12/25] bpf: Verify ownership relationships for owning types Kumar Kartikeya Dwivedi
2022-10-11 1:22 ` [PATCH bpf-next v1 13/25] bpf: Support locking bpf_spin_lock in local kptr Kumar Kartikeya Dwivedi
2022-10-11 1:22 ` [PATCH bpf-next v1 14/25] bpf: Allow locking bpf_spin_lock global variables Kumar Kartikeya Dwivedi
2022-10-11 1:22 ` [PATCH bpf-next v1 15/25] bpf: Rewrite kfunc argument handling Kumar Kartikeya Dwivedi
2022-10-11 1:22 ` [PATCH bpf-next v1 16/25] bpf: Drop kfunc bits from btf_check_func_arg_match Kumar Kartikeya Dwivedi
2022-10-11 1:22 ` [PATCH bpf-next v1 17/25] bpf: Support constant scalar arguments for kfuncs Kumar Kartikeya Dwivedi
2022-10-11 1:22 ` [PATCH bpf-next v1 18/25] bpf: Teach verifier about non-size constant arguments Kumar Kartikeya Dwivedi
2022-10-11 1:22 ` [PATCH bpf-next v1 19/25] bpf: Introduce bpf_kptr_new Kumar Kartikeya Dwivedi
2022-10-11 1:22 ` [PATCH bpf-next v1 20/25] bpf: Introduce bpf_kptr_drop Kumar Kartikeya Dwivedi
2022-10-11 1:22 ` [PATCH bpf-next v1 21/25] bpf: Permit NULL checking pointer with non-zero fixed offset Kumar Kartikeya Dwivedi
2022-10-11 1:22 ` [PATCH bpf-next v1 22/25] bpf: Introduce single ownership BPF linked list API Kumar Kartikeya Dwivedi
2022-10-11 1:22 ` [PATCH bpf-next v1 23/25] libbpf: Add support for private BSS map section Kumar Kartikeya Dwivedi
2022-10-11 1:22 ` [PATCH bpf-next v1 24/25] selftests/bpf: Add __contains macro to bpf_experimental.h Kumar Kartikeya Dwivedi
2022-10-11 1:22 ` [PATCH bpf-next v1 25/25] selftests/bpf: Add BPF linked list API tests Kumar Kartikeya Dwivedi
2022-10-11 1:51 ` [PATCH bpf-next v1 00/25] Local kptrs, BPF linked lists Kumar Kartikeya Dwivedi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20221011012240.3149-5-memxor@gmail.com \
--to=memxor@gmail.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=davemarchevsky@fb.com \
--cc=delyank@fb.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox