]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
bpf: Don't mark STACK_INVALID as STACK_MISC in mark_stack_slot_misc
authorKumar Kartikeya Dwivedi <memxor@gmail.com>
Wed, 4 Dec 2024 04:47:53 +0000 (20:47 -0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 14 Dec 2024 19:03:17 +0000 (20:03 +0100)
commit0da7d4b7caf0a2d1ef41f42a21e0fe7a4eba2960
tree073573f487412d7f346dca08cfd3a0d809475e51
parent2459a0b149673702dbbd24b03c690b644f99de46
bpf: Don't mark STACK_INVALID as STACK_MISC in mark_stack_slot_misc

[ Upstream commit 69772f509e084ec6bca12dbcdeeeff41b0103774 ]

Inside mark_stack_slot_misc, we should not upgrade STACK_INVALID to
STACK_MISC when allow_ptr_leaks is false, since invalid contents
shouldn't be read unless the program has the relevant capabilities.
The relaxation only makes sense when env->allow_ptr_leaks is true.

However, such conversion in privileged mode becomes unnecessary, as
invalid slots can be read without being upgraded to STACK_MISC.

Currently, the condition is inverted (i.e. checking for true instead of
false), simply remove it to restore correct behavior.

Fixes: eaf18febd6eb ("bpf: preserve STACK_ZERO slots on partial reg spills")
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Reported-by: Tao Lyu <tao.lyu@epfl.ch>
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/r/20241204044757.1483141-2-memxor@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
kernel/bpf/verifier.c