git.ipfire.org Git - thirdparty/kernel/stable-queue.git/blob

   1 From fllinden@amazon.com  Sun May  2 13:07:04 2021
   2 From: Frank van der Linden <fllinden@amazon.com>
   3 Date: Sat, 1 May 2021 18:05:05 +0000
   4 Subject: bpf: Fix backport of "bpf: restrict unknown scalars of mixed signed bounds for unprivileged"
   5 To: <stable@vger.kernel.org>
   6 Cc: <bpf@vger.kernel.org>, <samjonas@amazon.com>
   7 Message-ID: <20210501180506.19154-2-fllinden@amazon.com>
   8
   9 From: Samuel Mendoza-Jonas <samjonas@amazon.com>
  10
  11 The 4.14 backport of 9d7eceede ("bpf: restrict unknown scalars of mixed
  12 signed bounds for unprivileged") adds the PTR_TO_MAP_VALUE check to the
  13 wrong location in adjust_ptr_min_max_vals(), most likely because 4.14
  14 doesn't include the commit that updates the if-statement to a
  15 switch-statement (aad2eeaf4 "bpf: Simplify ptr_min_max_vals adjustment").
  16
  17 Move the check to the proper location in adjust_ptr_min_max_vals().
  18
  19 Fixes: 17efa65350c5a ("bpf: restrict unknown scalars of mixed signed bounds for unprivileged")
  20 Signed-off-by: Samuel Mendoza-Jonas <samjonas@amazon.com>
  21 Reviewed-by: Frank van der Linden <fllinden@amazon.com>
  22 Reviewed-by: Ethan Chen <yishache@amazon.com>
  23 Acked-by: Yonghong Song <yhs@fb.com>
  24 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  25 ---
  26  kernel/bpf/verifier.c |   14 +++++++-------
  27  1 file changed, 7 insertions(+), 7 deletions(-)
  28
  29 --- a/kernel/bpf/verifier.c
  30 +++ b/kernel/bpf/verifier.c
  31 @@ -2204,6 +2204,13 @@ static int adjust_ptr_min_max_vals(struc
  32                                 dst);
  33                 return -EACCES;
  34         }
  35 +       if (ptr_reg->type == PTR_TO_MAP_VALUE) {
  36 +               if (!env->allow_ptr_leaks && !known && (smin_val < 0) != (smax_val < 0)) {
  37 +                       verbose("R%d has unknown scalar with mixed signed bounds, pointer arithmetic with it prohibited for !root\n",
  38 +                               off_reg == dst_reg ? dst : src);
  39 +                       return -EACCES;
  40 +               }
  41 +       }
  42
  43         /* In case of 'scalar += pointer', dst_reg inherits pointer type and id.
  44          * The id may be overwritten later if we create a new variable offset.
  45 @@ -2349,13 +2356,6 @@ static int adjust_ptr_min_max_vals(struc
  46                         verbose("R%d bitwise operator %s on pointer prohibited\n",
  47                                 dst, bpf_alu_string[opcode >> 4]);
  48                 return -EACCES;
  49 -       case PTR_TO_MAP_VALUE:
  50 -               if (!env->allow_ptr_leaks && !known && (smin_val < 0) != (smax_val < 0)) {
  51 -                       verbose("R%d has unknown scalar with mixed signed bounds, pointer arithmetic with it prohibited for !root\n",
  52 -                               off_reg == dst_reg ? dst : src);
  53 -                       return -EACCES;
  54 -               }
  55 -               /* fall-through */
  56         default:
  57                 /* other operators (e.g. MUL,LSH) produce non-pointer results */
  58                 if (!env->allow_ptr_leaks)