[v4] bpf: Fix verifier crash on BPF_NEG with pointer register

[PATCH v4 0/2] bpf: Fix verifier crash on BPF_NEG with pointer register

Brahmajit Das posted 2 patches 2 months, 2 weeks ago

Diff against v3 v4
Download series mbox

kernel/bpf/verifier.c                          |  3 ++-
.../bpf/progs/verifier_value_illegal_alu.c     | 18 ++++++++++++++++++
2 files changed, 20 insertions(+), 1 deletion(-)

Expand all Fold all

[PATCH v4 0/2] bpf: Fix verifier crash on BPF_NEG with pointer register

Posted by Brahmajit Das 2 months, 2 weeks ago

This patch fixes a crash in the BPF verifier triggered when the BPF_NEG
operation is applied to a pointer-typed register. The verifier now
checks that the destination register is not a pointer before performing
the operation.

Tested with syzkaller reproducer and new BPF sefltest.
Closes: https://syzkaller.appspot.com/bug?extid=d36d5ae81e1b0a53ef58

Brahmajit Das (1):
  bpf: Skip scalar adjustment for BPF_NEG if dst is a pointer

KaFai Wan (1):
  selftests/bpf: Add test for BPF_NEG alu on CONST_PTR_TO_MAP

 kernel/bpf/verifier.c                          |  3 ++-
 .../bpf/progs/verifier_value_illegal_alu.c     | 18 ++++++++++++++++++
 2 files changed, 20 insertions(+), 1 deletion(-)

-- 
2.51.0