]> git.baikalelectronics.ru Git - kernel.git/commit
bpf: Check attach_func_proto more carefully in check_helper_call
authorStanislav Fomichev <sdf@google.com>
Wed, 20 Jul 2022 16:47:29 +0000 (09:47 -0700)
committerDaniel Borkmann <daniel@iogearbox.net>
Thu, 21 Jul 2022 13:02:02 +0000 (15:02 +0200)
commit704bd2f1590beee1531b90127a27b387a3e7439e
tree9d2038c229dbce16d7321b61645b3f477856ed70
parent9ab47953bbe4c59c418bbe0ef9aef941c3fa4ac5
bpf: Check attach_func_proto more carefully in check_helper_call

Syzkaller found a problem similar to 3ba52a597a37 ("bpf: Check
attach_func_proto more carefully in check_return_code") where
attach_func_proto might be NULL:

RIP: 0010:check_helper_call+0x3dcb/0x8d50 kernel/bpf/verifier.c:7330
 do_check kernel/bpf/verifier.c:12302 [inline]
 do_check_common+0x6e1e/0xb980 kernel/bpf/verifier.c:14610
 do_check_main kernel/bpf/verifier.c:14673 [inline]
 bpf_check+0x661e/0xc520 kernel/bpf/verifier.c:15243
 bpf_prog_load+0x11ae/0x1f80 kernel/bpf/syscall.c:2620

With the following reproducer:

  bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0xf, 0x4, &(0x7f0000000040)=@framed={{}, [@call={0x85, 0x0, 0x0, 0xbb}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80)

Let's do the same here, only check attach_func_proto for the prog types
where we are certain that attach_func_proto is defined.

Fixes: 6719214cf03c ("bpf: per-cgroup lsm flavor")
Reported-by: syzbot+0f8d989b1fba1addc5e0@syzkaller.appspotmail.com
Signed-off-by: Stanislav Fomichev <sdf@google.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Link: https://lore.kernel.org/bpf/20220720164729.147544-1-sdf@google.com
kernel/bpf/verifier.c