From nobody Sun Feb 8 02:42:57 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 58A28C4332F for ; Wed, 19 Oct 2022 09:21:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233381AbiJSJVH (ORCPT ); Wed, 19 Oct 2022 05:21:07 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42904 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233635AbiJSJTt (ORCPT ); Wed, 19 Oct 2022 05:19:49 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6373D3DF10; Wed, 19 Oct 2022 02:09:09 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id DCFF3617E9; Wed, 19 Oct 2022 08:50:13 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E940FC433C1; Wed, 19 Oct 2022 08:50:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1666169413; bh=fCYDvPwsLwgEnvhcuZ0ycwDqjRtCNzRwDsH/BtX8qkk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jbPmEbmI6lasvaZgHCLMB8Qp+xwRaZoBQ8KIeADADdG+vnIiGiSwqXDFX+p41kGVe bWMWLGWaqmoVPde3wk3LB5BnQjeUtYIiJdCrD3KbjvH3o+My30DD3tu+Nxe/tjx7Wv fLiH+E63nj7fS2EV3Dlltcr316HRrYpVRc8DxaSM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Joanne Koong , David Vernet , Alexei Starovoitov , Sasha Levin Subject: [PATCH 6.0 233/862] bpf: Fix ref_obj_id for dynptr data slices in verifier Date: Wed, 19 Oct 2022 10:25:20 +0200 Message-Id: <20221019083300.331989794@linuxfoundation.org> X-Mailer: git-send-email 2.38.0 In-Reply-To: <20221019083249.951566199@linuxfoundation.org> References: <20221019083249.951566199@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Joanne Koong [ Upstream commit 883743422ced8c961ab05dc63ec81b75a4e56052 ] When a data slice is obtained from a dynptr (through the bpf_dynptr_data AP= I), the ref obj id of the dynptr must be found and then associated with the data slice. The ref obj id of the dynptr must be found *before* the caller saved regs a= re reset. Without this fix, the ref obj id tracking is not correct for dynptrs that are at an offset from the frame pointer. Please also note that the data slice's ref obj id must be assigned after the ret types are parsed, since RET_PTR_TO_ALLOC_MEM-type return regs get zero-marked. Fixes: 34d4ef5775f7 ("bpf: Add dynptr data slices") Signed-off-by: Joanne Koong Acked-by: David Vernet Link: https://lore.kernel.org/r/20220809214055.4050604-1-joannelkoong@gmail= .com Signed-off-by: Alexei Starovoitov Signed-off-by: Sasha Levin --- kernel/bpf/verifier.c | 38 ++++++++++++++++++++------------------ 1 file changed, 20 insertions(+), 18 deletions(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 1141a35216a7..c127585ad429 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -504,7 +504,7 @@ static bool is_ptr_cast_function(enum bpf_func_id func_= id) func_id =3D=3D BPF_FUNC_skc_to_tcp_request_sock; } =20 -static bool is_dynptr_acquire_function(enum bpf_func_id func_id) +static bool is_dynptr_ref_function(enum bpf_func_id func_id) { return func_id =3D=3D BPF_FUNC_dynptr_data; } @@ -518,7 +518,7 @@ static bool helper_multiple_ref_obj_use(enum bpf_func_i= d func_id, ref_obj_uses++; if (is_acquire_function(func_id, map)) ref_obj_uses++; - if (is_dynptr_acquire_function(func_id)) + if (is_dynptr_ref_function(func_id)) ref_obj_uses++; =20 return ref_obj_uses > 1; @@ -7322,6 +7322,23 @@ static int check_helper_call(struct bpf_verifier_env= *env, struct bpf_insn *insn } } break; + case BPF_FUNC_dynptr_data: + for (i =3D 0; i < MAX_BPF_FUNC_REG_ARGS; i++) { + if (arg_type_is_dynptr(fn->arg_type[i])) { + if (meta.ref_obj_id) { + verbose(env, "verifier internal error: meta.ref_obj_id already set\n"= ); + return -EFAULT; + } + /* Find the id of the dynptr we're tracking the reference of */ + meta.ref_obj_id =3D stack_slot_get_id(env, ®s[BPF_REG_1 + i]); + break; + } + } + if (i =3D=3D MAX_BPF_FUNC_REG_ARGS) { + verbose(env, "verifier internal error: no dynptr in bpf_dynptr_data()\n= "); + return -EFAULT; + } + break; } =20 if (err) @@ -7444,7 +7461,7 @@ static int check_helper_call(struct bpf_verifier_env = *env, struct bpf_insn *insn return -EFAULT; } =20 - if (is_ptr_cast_function(func_id)) { + if (is_ptr_cast_function(func_id) || is_dynptr_ref_function(func_id)) { /* For release_reference() */ regs[BPF_REG_0].ref_obj_id =3D meta.ref_obj_id; } else if (is_acquire_function(func_id, meta.map_ptr)) { @@ -7456,21 +7473,6 @@ static int check_helper_call(struct bpf_verifier_env= *env, struct bpf_insn *insn regs[BPF_REG_0].id =3D id; /* For release_reference() */ regs[BPF_REG_0].ref_obj_id =3D id; - } else if (is_dynptr_acquire_function(func_id)) { - int dynptr_id =3D 0, i; - - /* Find the id of the dynptr we're tracking the reference of */ - for (i =3D 0; i < MAX_BPF_FUNC_REG_ARGS; i++) { - if (arg_type_is_dynptr(fn->arg_type[i])) { - if (dynptr_id) { - verbose(env, "verifier internal error: multiple dynptr args in func\n= "); - return -EFAULT; - } - dynptr_id =3D stack_slot_get_id(env, ®s[BPF_REG_1 + i]); - } - } - /* For release_reference() */ - regs[BPF_REG_0].ref_obj_id =3D dynptr_id; } =20 do_refine_retval_range(regs, fn->ret_type, func_id, &meta); --=20 2.35.1