5.10-stable patches

added patches:
	bpf-fix-ringbuf-helper-function-compatibility.patch

diff --git a/queue-5.10/bpf-fix-ringbuf-helper-function-compatibility.patch b/queue-5.10/bpf-fix-ringbuf-helper-function-compatibility.patch
new file mode 100644 (file)
index 0000000..7bd5877
--- /dev/null
+++ b/queue-5.10/bpf-fix-ringbuf-helper-function-compatibility.patch
@@ -0,0 +1,54 @@
+From 5b029a32cfe4600f5e10e36b41778506b90fd4de Mon Sep 17 00:00:00 2001
+From: Daniel Borkmann <daniel@iogearbox.net>
+Date: Mon, 23 Aug 2021 21:02:09 +0200
+Subject: bpf: Fix ringbuf helper function compatibility
+
+From: Daniel Borkmann <daniel@iogearbox.net>
+
+commit 5b029a32cfe4600f5e10e36b41778506b90fd4de upstream.
+
+Commit 457f44363a88 ("bpf: Implement BPF ring buffer and verifier support
+for it") extended check_map_func_compatibility() by enforcing map -> helper
+function match, but not helper -> map type match.
+
+Due to this all of the bpf_ringbuf_*() helper functions could be used with
+a wrong map type such as array or hash map, leading to invalid access due
+to type confusion.
+
+Also, both BPF_FUNC_ringbuf_{submit,discard} have ARG_PTR_TO_ALLOC_MEM as
+argument and not a BPF map. Therefore, their check_map_func_compatibility()
+presence is incorrect since it's only for map type checking.
+
+Fixes: 457f44363a88 ("bpf: Implement BPF ring buffer and verifier support for it")
+Reported-by: Ryota Shiga (Flatt Security)
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/bpf/verifier.c |    8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -4693,8 +4693,6 @@ static int check_map_func_compatibility(
+       case BPF_MAP_TYPE_RINGBUF:
+               if (func_id != BPF_FUNC_ringbuf_output &&
+                   func_id != BPF_FUNC_ringbuf_reserve &&
+-                  func_id != BPF_FUNC_ringbuf_submit &&
+-                  func_id != BPF_FUNC_ringbuf_discard &&
+                   func_id != BPF_FUNC_ringbuf_query)
+                       goto error;
+               break;
+@@ -4798,6 +4796,12 @@ static int check_map_func_compatibility(
+               if (map->map_type != BPF_MAP_TYPE_PERF_EVENT_ARRAY)
+                       goto error;
+               break;
++      case BPF_FUNC_ringbuf_output:
++      case BPF_FUNC_ringbuf_reserve:
++      case BPF_FUNC_ringbuf_query:
++              if (map->map_type != BPF_MAP_TYPE_RINGBUF)
++                      goto error;
++              break;
+       case BPF_FUNC_get_stackid:
+               if (map->map_type != BPF_MAP_TYPE_STACK_TRACE)
+                       goto error;

diff --git a/queue-5.10/series b/queue-5.10/series
index df41c56899537e6d9415712667a27d60ea23a2a0..737806f2afb2e8fff5d3719aae83494135df8232 100644 (file)
--- a/queue-5.10/series
+++ b/queue-5.10/series
@@ -1 +1,2 @@
 net-qrtr-fix-another-oob-read-in-qrtr_endpoint_post.patch
+bpf-fix-ringbuf-helper-function-compatibility.patch