bpf: Fix wrong reg type conversion in release_reference()

Some helper functions will allocate memory. To avoid memory leaks, the
verifier requires the eBPF program to release these memories by calling
the corresponding helper functions.

When a resource is released, all pointer registers corresponding to the
resource should be invalidated. The verifier use release_references() to
do this job, by apply  __mark_reg_unknown() to each relevant register.

It will give these registers the type of SCALAR_VALUE. A register that
will contain a pointer value at runtime, but of type SCALAR_VALUE, which
may allow the unprivileged user to get a kernel pointer by storing this
register into a map.

Using __mark_reg_not_init() while NOT allow_ptr_leaks can mitigate this
problem.

Fixes: 8825dfd9e473 ("bpf: Add reference tracking to verifier")
Signed-off-by: Youlin Li <liulin063@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20221103093440.3161-1-liulin063@gmail.com

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index dd9019c8b0db0414f7c20d231f87ccc25d1946c4..225666307bba3984e7c4f896f8849f510621698a 100644 (file)
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -6623,8 +6623,12 @@ static int release_reference(struct bpf_verifier_env *env,
                return err;
 
        bpf_for_each_reg_in_vstate(env->cur_state, state, reg, ({
-               if (reg->ref_obj_id == ref_obj_id)
-                       __mark_reg_unknown(env, reg);
+               if (reg->ref_obj_id == ref_obj_id) {
+                       if (!env->allow_ptr_leaks)
+                               __mark_reg_not_init(env, reg);
+                       else
+                               __mark_reg_unknown(env, reg);
+               }
        }));
 
        return 0;