A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-07 04:12:04 -04:00
Code Issues Projects Releases Packages Wiki Activity

UPSTREAM: bpf: Fix slot type check in check_stack_write_var_off

Browse source 
[ Upstream commit f5e477a861e4a20d8a1c5f7a245f3a3c3c376b03 ]

For the case where allow_ptr_leaks is false, code is checking whether
slot type is STACK_INVALID and STACK_SPILL and rejecting other cases.
This is a consequence of incorrectly checking for register type instead
of the slot type (NOT_INIT and SCALAR_VALUE respectively). Fix the
check.

Fixes: 01f810ace9ed ("bpf: Allow variable-offset stack access")
Change-Id: Iec16dc4a0e7c1d6a7da77b1321e52f545c9c66a2
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/r/20221103191013.1236066-5-memxor@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Kumar Kartikeya Dwivedi 2022-11-04 00:39:53 +05:30 • committed by basamaryan
commit 5280b1f09b
No known key found for this signature in database
GPG key ID: 210D5384FB2A5885
1 changed files with 11 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

19
kernel/bpf/verifier.c
View file

@ -2461,14 +2461,17 @@ static int check_stack_write_var_off(struct bpf_verifier_env *env,
spi = slot / BPF_REG_SIZE;
stype = &state->stack[spi].slot_type[slot % BPF_REG_SIZE];
if (!env->allow_ptr_leaks
&& *stype != NOT_INIT
&& *stype != SCALAR_VALUE) {
/* Reject the write if there's are spilled pointers in
* range. If we didn't reject here, the ptr status
* would be erased below (even though not all slots are
* actually overwritten), possibly opening the door to
* leaks.
if (!env->allow_ptr_leaks && *stype != STACK_MISC && *stype != STACK_ZERO) {
/* Reject the write if range we may write to has not
* been initialized beforehand. If we didn't reject
* here, the ptr status would be erased below (even
* though not all slots are actually overwritten),
* possibly opening the door to leaks.
*
* We do however catch STACK_INVALID case below, and
* only allow reading possibly uninitialized memory
* later for CAP_PERFMON, as the write may not happen to
* that slot.
*/
verbose(env, "spilled ptr in range of var-offset stack write; insn %d, ptr off: %d",
insn_idx, i);