[PATCH bpf-next v2 0/2] bpf: bound rdonly/rdwr_buf_size kfunc return size

[Nicholas Dudar <main.kalliope@gmail.com>]

check_kfunc_args() stores a kfunc's rdonly_buf_size/rdwr_buf_size
argument into a u64 that check_kfunc_call() later narrows into the
returned register's u32 mem_size, so a value above U32_MAX truncates
instead of being rejected. Fix it and add a selftest for coverage.

Changelog:
----------
v1 -> v2 (v1 was a private report to security@kernel.org)

 * Split the fix and selftest into separate patches.
 * Target bpf-next instead of bpf.

Nicholas Dudar (2):
  bpf: reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max
  selftests/bpf: add test for oversized rdonly/rdwr_buf_size kfunc
    argument

 kernel/bpf/verifier.c                         |  5 +++
 .../selftests/bpf/prog_tests/kfunc_call.c     |  1 +
 .../selftests/bpf/progs/kfunc_call_fail.c     | 33 +++++++++++++++++++
 3 files changed, 39 insertions(+)


base-commit: 36ffa86c42f91c8a57071e024afc4ffb51a8958f
-- 
2.34.1