bpf: Undo ptr_to_map_key alu sanitation for now

Remove PTR_TO_MAP_KEY for the time being from being sanitized on pointer ALU
through sanitize_ptr_alu() mainly for 3 reasons:

  1) It's currently unused and not available from unprivileged. However that by
     itself is not yet a strong reason to drop the code.

  2) Commit 359bfbf9bf1e ("bpf: Add bpf_for_each_map_elem() helper") implemented
     the sanitation not fully correct in that unlike stack or map_value pointer
     it doesn't probe whether the access to the map key /after/ the simulated ALU
     operation is still in bounds. This means that the generated mask can truncate
     the offset in the non-speculative domain whereas it should only truncate in
     the speculative domain. The verifier should instead reject such program as
     we do for other types.

  3) Given the recent fixes from 7e6295643e04 ("bpf: Prohibit alu ops for pointer
     types not defining ptr_limit"), 253ad08e1798 ("bpf: Fix off-by-one for area
     size in creating mask to left"), 9aaf1c37b62a ("bpf: Simplify alu_limit masking
     for pointer arithmetic") as well as f28f2c98fa8e ("bpf: Add sanity check for
     upper ptr_limit") the code changed quite a bit and the merge in 85d94a61b7ed
     broke the PTR_TO_MAP_KEY case due to an incorrect merge conflict.

Remove the relevant pieces for the time being and we can rework the PTR_TO_MAP_KEY
case once everything settles.

Fixes: 85d94a61b7ed ("Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net")
Fixes: 359bfbf9bf1e ("bpf: Add bpf_for_each_map_elem() helper")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 210169c25ead042a597e45a3e04319c073338dda..85f9f842d15c2b0ee9f9cfa45ec0574c2b033059 100644 (file)
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -6062,19 +6062,6 @@ static int retrieve_ptr_limit(const struct bpf_reg_state *ptr_reg,
                else
                        *ptr_limit = -off - 1;
                return *ptr_limit >= max ? -ERANGE : 0;
-       case PTR_TO_MAP_KEY:
-               /* Currently, this code is not exercised as the only use
-                * is bpf_for_each_map_elem() helper which requires
-                * bpf_capble. The code has been tested manually for
-                * future use.
-                */
-               if (mask_to_left) {
-                       *ptr_limit = ptr_reg->umax_value + ptr_reg->off;
-               } else {
-                       off = ptr_reg->smin_value + ptr_reg->off;
-                       *ptr_limit = ptr_reg->map_ptr->key_size - off;
-               }
-               return 0;
        case PTR_TO_MAP_VALUE:
                max = ptr_reg->map_ptr->value_size;
                if (mask_to_left) {
@@ -6281,7 +6268,6 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env,
                verbose(env, "R%d pointer arithmetic on %s prohibited\n",
                        dst, reg_type_str[ptr_reg->type]);
                return -EACCES;
-       case PTR_TO_MAP_KEY:
        case PTR_TO_MAP_VALUE:
                if (!env->allow_ptr_leaks && !known && (smin_val < 0) != (smax_val < 0)) {
                        verbose(env, "R%d has unknown scalar with mixed signed bounds, pointer arithmetic with it prohibited for !root\n",