1 From 0803278b0b4d8eeb2b461fb698785df65a725d9e Mon Sep 17 00:00:00 2001
2 From: Xu Yu <xuyu@linux.alibaba.com>
3 Date: Thu, 21 Mar 2019 18:00:35 +0800
4 Subject: bpf: do not restore dst_reg when cur_state is freed
6 Content-Type: text/plain; charset=UTF-8
7 Content-Transfer-Encoding: 8bit
9 From: Xu Yu <xuyu@linux.alibaba.com>
11 commit 0803278b0b4d8eeb2b461fb698785df65a725d9e upstream.
13 Syzkaller hit 'KASAN: use-after-free Write in sanitize_ptr_alu' bug.
18 print_address_description+0x6a/0x280
19 kasan_report+0x237/0x360
20 sanitize_ptr_alu+0x85a/0x8d0
21 adjust_ptr_min_max_vals+0x8f2/0x1ca0
22 adjust_reg_min_max_vals+0x8ed/0x22e0
23 do_check+0x1ca6/0x5d00
24 bpf_check+0x9ca/0x2570
25 bpf_prog_load+0xc91/0x1030
26 __se_sys_bpf+0x61e/0x1f00
27 do_syscall_64+0xc8/0x550
28 entry_SYSCALL_64_after_hwframe+0x49/0xbe
30 Fault injection trace:
33 free_func_state+0x4a/0x60
34 free_verifier_state+0x61/0xe0
35 push_stack+0x216/0x2f0 <- inject failslab
36 sanitize_ptr_alu+0x2b1/0x8d0
37 adjust_ptr_min_max_vals+0x8f2/0x1ca0
38 adjust_reg_min_max_vals+0x8ed/0x22e0
39 do_check+0x1ca6/0x5d00
40 bpf_check+0x9ca/0x2570
41 bpf_prog_load+0xc91/0x1030
42 __se_sys_bpf+0x61e/0x1f00
43 do_syscall_64+0xc8/0x550
44 entry_SYSCALL_64_after_hwframe+0x49/0xbe
46 When kzalloc() fails in push_stack(), free_verifier_state() will free
47 current verifier state. As push_stack() returns, dst_reg was restored
48 if ptr_is_dst_reg is false. However, as member of the cur_state,
49 dst_reg is also freed, and error occurs when dereferencing dst_reg.
50 Simply fix it by testing ret of push_stack() before restoring dst_reg.
52 Fixes: 979d63d50c0c ("bpf: prevent out of bounds speculation on pointer arithmetic")
53 Signed-off-by: Xu Yu <xuyu@linux.alibaba.com>
54 Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
55 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
58 kernel/bpf/verifier.c | 2 +-
59 1 file changed, 1 insertion(+), 1 deletion(-)
61 --- a/kernel/bpf/verifier.c
62 +++ b/kernel/bpf/verifier.c
63 @@ -3187,7 +3187,7 @@ do_sim:
66 ret = push_stack(env, env->insn_idx + 1, env->insn_idx, true);
67 - if (!ptr_is_dst_reg)
68 + if (!ptr_is_dst_reg && ret)
70 return !ret ? -EFAULT : 0;