From 43aaa226a5a1f14b9d1a687e4adebd6e978b4a84 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Fri, 27 Aug 2021 12:15:19 +0200 Subject: [PATCH] 5.10-stable patches added patches: bpf-fix-ringbuf-helper-function-compatibility.patch --- ...ingbuf-helper-function-compatibility.patch | 54 +++++++++++++++++++ queue-5.10/series | 1 + 2 files changed, 55 insertions(+) create mode 100644 queue-5.10/bpf-fix-ringbuf-helper-function-compatibility.patch diff --git a/queue-5.10/bpf-fix-ringbuf-helper-function-compatibility.patch b/queue-5.10/bpf-fix-ringbuf-helper-function-compatibility.patch new file mode 100644 index 00000000000..7bd5877cdff --- /dev/null +++ b/queue-5.10/bpf-fix-ringbuf-helper-function-compatibility.patch @@ -0,0 +1,54 @@ +From 5b029a32cfe4600f5e10e36b41778506b90fd4de Mon Sep 17 00:00:00 2001 +From: Daniel Borkmann +Date: Mon, 23 Aug 2021 21:02:09 +0200 +Subject: bpf: Fix ringbuf helper function compatibility + +From: Daniel Borkmann + +commit 5b029a32cfe4600f5e10e36b41778506b90fd4de upstream. + +Commit 457f44363a88 ("bpf: Implement BPF ring buffer and verifier support +for it") extended check_map_func_compatibility() by enforcing map -> helper +function match, but not helper -> map type match. + +Due to this all of the bpf_ringbuf_*() helper functions could be used with +a wrong map type such as array or hash map, leading to invalid access due +to type confusion. + +Also, both BPF_FUNC_ringbuf_{submit,discard} have ARG_PTR_TO_ALLOC_MEM as +argument and not a BPF map. Therefore, their check_map_func_compatibility() +presence is incorrect since it's only for map type checking. + +Fixes: 457f44363a88 ("bpf: Implement BPF ring buffer and verifier support for it") +Reported-by: Ryota Shiga (Flatt Security) +Signed-off-by: Daniel Borkmann +Acked-by: Alexei Starovoitov +Signed-off-by: Greg Kroah-Hartman +--- + kernel/bpf/verifier.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -4693,8 +4693,6 @@ static int check_map_func_compatibility( + case BPF_MAP_TYPE_RINGBUF: + if (func_id != BPF_FUNC_ringbuf_output && + func_id != BPF_FUNC_ringbuf_reserve && +- func_id != BPF_FUNC_ringbuf_submit && +- func_id != BPF_FUNC_ringbuf_discard && + func_id != BPF_FUNC_ringbuf_query) + goto error; + break; +@@ -4798,6 +4796,12 @@ static int check_map_func_compatibility( + if (map->map_type != BPF_MAP_TYPE_PERF_EVENT_ARRAY) + goto error; + break; ++ case BPF_FUNC_ringbuf_output: ++ case BPF_FUNC_ringbuf_reserve: ++ case BPF_FUNC_ringbuf_query: ++ if (map->map_type != BPF_MAP_TYPE_RINGBUF) ++ goto error; ++ break; + case BPF_FUNC_get_stackid: + if (map->map_type != BPF_MAP_TYPE_STACK_TRACE) + goto error; diff --git a/queue-5.10/series b/queue-5.10/series index df41c568995..737806f2afb 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -1 +1,2 @@ net-qrtr-fix-another-oob-read-in-qrtr_endpoint_post.patch +bpf-fix-ringbuf-helper-function-compatibility.patch -- 2.47.3