fsverity: Fix bpf_get_fsverity_digest() dynptr assumptions

The BPF verifier and the dynptr abstraction ensure that the memory space
referenced by a dynptr remains valid.  They do not, however, provide any
guarantee that the contents of the memory are stable.  kfuncs are
expected to remain memory-safe even if concurrent modifications occur.

bpf_get_fsverity_digest() didn't follow that: it could crash if
arg->digest_size was concurrently modified.

Fix that by using the known-good value hash_alg->digest_size instead.

Also widen 'dynptr_sz' and 'out_digest_sz' to u64 to match the return
type of __bpf_dynptr_size().  It doesn't appear that it can actually be
more than INT_MAX currently (since __bpf_dynptr_data_rw() excludes
file-based pointers), but the correct type might as well be used.

Fixes: 67814c00de31 ("bpf, fsverity: Add kfunc bpf_get_fsverity_digest")
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Acked-by: Song Liu <song@kernel.org>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/bpf/20260803181232.14743-2-ebiggers@kernel.org
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>

diff --git a/fs/verity/measure.c b/fs/verity/measure.c
index cfe2d5e535f96ab9b728bad98607774c086e98a0..f8b3526af00469b7bc20236198fdb44c1915bbbd 100644 (file)
--- a/fs/verity/measure.c
+++ b/fs/verity/measure.c
@@ -122,11 +122,11 @@ __bpf_kfunc int bpf_get_fsverity_digest(struct file *file, const struct bpf_dynp
 {
        const struct bpf_dynptr_kern *digest_ptr = (struct bpf_dynptr_kern *)digest_p;
        const struct inode *inode = file_inode(file);
-       u32 dynptr_sz = __bpf_dynptr_size(digest_ptr);
+       u64 dynptr_sz = __bpf_dynptr_size(digest_ptr);
        struct fsverity_digest *arg;
        const struct fsverity_info *vi;
        const struct fsverity_hash_alg *hash_alg;
-       int out_digest_sz;
+       u64 out_digest_sz;
 
        if (dynptr_sz < sizeof(struct fsverity_digest))
                return -EINVAL;
@@ -150,11 +150,13 @@ __bpf_kfunc int bpf_get_fsverity_digest(struct file *file, const struct bpf_dynp
        out_digest_sz = dynptr_sz - sizeof(struct fsverity_digest);
 
        /* copy digest */
-       memcpy(arg->digest, vi->file_digest,  min_t(int, hash_alg->digest_size, out_digest_sz));
+       memcpy(arg->digest, vi->file_digest,
+              min(hash_alg->digest_size, out_digest_sz));
 
        /* fill the extra buffer with zeros */
        if (out_digest_sz > hash_alg->digest_size)
-               memset(arg->digest + arg->digest_size, 0, out_digest_sz - hash_alg->digest_size);
+               memset(arg->digest + hash_alg->digest_size, 0,
+                      out_digest_sz - hash_alg->digest_size);
 
        return 0;
 }