]> git.baikalelectronics.ru Git - kernel.git/commit
bpf: Local storage helpers should check nullness of owner ptr passed
authorKP Singh <kpsingh@kernel.org>
Tue, 12 Jan 2021 07:55:24 +0000 (07:55 +0000)
committerDaniel Borkmann <daniel@iogearbox.net>
Tue, 12 Jan 2021 15:07:56 +0000 (16:07 +0100)
commit2e8ff1b906029a712ad29f044665f46b9eda3078
tree6ad0a408dc69441a89b2c3feae81e7a090b0e135
parent32ce0687c42be074a9c711a3ed76d4e8aebcbf84
bpf: Local storage helpers should check nullness of owner ptr passed

The verifier allows ARG_PTR_TO_BTF_ID helper arguments to be NULL, so
helper implementations need to check this before dereferencing them.
This was already fixed for the socket storage helpers but not for task
and inode.

The issue can be reproduced by attaching an LSM program to
inode_rename hook (called when moving files) which tries to get the
inode of the new file without checking for its nullness and then trying
to move an existing file to a new path:

  mv existing_file new_file_does_not_exist

The report including the sample program and the steps for reproducing
the bug:

  https://lore.kernel.org/bpf/CANaYP3HWkH91SN=wTNO9FL_2ztHfqcXKX38SSE-JJ2voh+vssw@mail.gmail.com

Fixes: 28368da35e64 ("bpf: Implement task local storage")
Fixes: 7ac4e9cab472 ("bpf: Implement bpf_local_storage for inodes")
Reported-by: Gilad Reti <gilad.reti@gmail.com>
Signed-off-by: KP Singh <kpsingh@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Acked-by: Yonghong Song <yhs@fb.com>
Link: https://lore.kernel.org/bpf/20210112075525.256820-3-kpsingh@kernel.org
kernel/bpf/bpf_inode_storage.c
kernel/bpf/bpf_task_storage.c