* [PATCH bpf-next] bpf: Check attach_func_proto more carefully in check_helper_call
@ 2022-07-20 16:47 Stanislav Fomichev
2022-07-20 18:16 ` Martin KaFai Lau
2022-07-21 13:30 ` patchwork-bot+netdevbpf
0 siblings, 2 replies; 3+ messages in thread
From: Stanislav Fomichev @ 2022-07-20 16:47 UTC (permalink / raw)
To: bpf
Cc: ast, daniel, andrii, martin.lau, song, yhs, john.fastabend,
kpsingh, sdf, haoluo, jolsa, syzbot+0f8d989b1fba1addc5e0
Syzkaller found a problem similar to d1a6edecc1fd ("bpf: Check
attach_func_proto more carefully in check_return_code") where
attach_func_proto might be NULL:
RIP: 0010:check_helper_call+0x3dcb/0x8d50 kernel/bpf/verifier.c:7330
do_check kernel/bpf/verifier.c:12302 [inline]
do_check_common+0x6e1e/0xb980 kernel/bpf/verifier.c:14610
do_check_main kernel/bpf/verifier.c:14673 [inline]
bpf_check+0x661e/0xc520 kernel/bpf/verifier.c:15243
bpf_prog_load+0x11ae/0x1f80 kernel/bpf/syscall.c:2620
With the following reproducer:
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0xf, 0x4, &(0x7f0000000040)=@framed={{}, [@call={0x85, 0x0, 0x0, 0xbb}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80)
Let's do the same here, only check attach_func_proto for the prog types
where we are certain that attach_func_proto is defined.
Fixes: 69fd337a975c ("bpf: per-cgroup lsm flavor")
Reported-by: syzbot+0f8d989b1fba1addc5e0@syzkaller.appspotmail.com
Signed-off-by: Stanislav Fomichev <sdf@google.com>
---
kernel/bpf/verifier.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index c59c3df0fea6..7c1e056624f9 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -7170,6 +7170,7 @@ static void update_loop_inline_state(struct bpf_verifier_env *env, u32 subprogno
static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
int *insn_idx_p)
{
+ enum bpf_prog_type prog_type = resolve_prog_type(env->prog);
const struct bpf_func_proto *fn = NULL;
enum bpf_return_type ret_type;
enum bpf_type_flag ret_flag;
@@ -7331,7 +7332,8 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn
}
break;
case BPF_FUNC_set_retval:
- if (env->prog->expected_attach_type == BPF_LSM_CGROUP) {
+ if (prog_type == BPF_PROG_TYPE_LSM &&
+ env->prog->expected_attach_type == BPF_LSM_CGROUP) {
if (!env->prog->aux->attach_func_proto->type) {
/* Make sure programs that attach to void
* hooks don't try to modify return value.
--
2.37.0.170.g444d1eabd0-goog
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH bpf-next] bpf: Check attach_func_proto more carefully in check_helper_call
2022-07-20 16:47 [PATCH bpf-next] bpf: Check attach_func_proto more carefully in check_helper_call Stanislav Fomichev
@ 2022-07-20 18:16 ` Martin KaFai Lau
2022-07-21 13:30 ` patchwork-bot+netdevbpf
1 sibling, 0 replies; 3+ messages in thread
From: Martin KaFai Lau @ 2022-07-20 18:16 UTC (permalink / raw)
To: Stanislav Fomichev
Cc: bpf, ast, daniel, andrii, martin.lau, song, yhs, john.fastabend,
kpsingh, haoluo, jolsa, syzbot+0f8d989b1fba1addc5e0
On Wed, Jul 20, 2022 at 09:47:29AM -0700, Stanislav Fomichev wrote:
> Syzkaller found a problem similar to d1a6edecc1fd ("bpf: Check
> attach_func_proto more carefully in check_return_code") where
> attach_func_proto might be NULL:
>
> RIP: 0010:check_helper_call+0x3dcb/0x8d50 kernel/bpf/verifier.c:7330
> do_check kernel/bpf/verifier.c:12302 [inline]
> do_check_common+0x6e1e/0xb980 kernel/bpf/verifier.c:14610
> do_check_main kernel/bpf/verifier.c:14673 [inline]
> bpf_check+0x661e/0xc520 kernel/bpf/verifier.c:15243
> bpf_prog_load+0x11ae/0x1f80 kernel/bpf/syscall.c:2620
>
> With the following reproducer:
>
> bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0xf, 0x4, &(0x7f0000000040)=@framed={{}, [@call={0x85, 0x0, 0x0, 0xbb}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80)
Only BPF_PROG_TYPE_CGROUP_* (and the new lsm_cgroup) can get to
the set_retval func proto. I thought all BPF_PROG_TYPE_CGROUP_* has enforced
expected_attach_type. It turns out not true for BPF_PROG_TYPE_CGROUP_DEVICE and
BPF_PROG_TYPE_CGROUP_SYSCTL.
Acked-by: Martin KaFai Lau <kafai@fb.com>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH bpf-next] bpf: Check attach_func_proto more carefully in check_helper_call
2022-07-20 16:47 [PATCH bpf-next] bpf: Check attach_func_proto more carefully in check_helper_call Stanislav Fomichev
2022-07-20 18:16 ` Martin KaFai Lau
@ 2022-07-21 13:30 ` patchwork-bot+netdevbpf
1 sibling, 0 replies; 3+ messages in thread
From: patchwork-bot+netdevbpf @ 2022-07-21 13:30 UTC (permalink / raw)
To: Stanislav Fomichev
Cc: bpf, ast, daniel, andrii, martin.lau, song, yhs, john.fastabend,
kpsingh, haoluo, jolsa, syzbot+0f8d989b1fba1addc5e0
Hello:
This patch was applied to bpf/bpf-next.git (master)
by Daniel Borkmann <daniel@iogearbox.net>:
On Wed, 20 Jul 2022 09:47:29 -0700 you wrote:
> Syzkaller found a problem similar to d1a6edecc1fd ("bpf: Check
> attach_func_proto more carefully in check_return_code") where
> attach_func_proto might be NULL:
>
> RIP: 0010:check_helper_call+0x3dcb/0x8d50 kernel/bpf/verifier.c:7330
> do_check kernel/bpf/verifier.c:12302 [inline]
> do_check_common+0x6e1e/0xb980 kernel/bpf/verifier.c:14610
> do_check_main kernel/bpf/verifier.c:14673 [inline]
> bpf_check+0x661e/0xc520 kernel/bpf/verifier.c:15243
> bpf_prog_load+0x11ae/0x1f80 kernel/bpf/syscall.c:2620
>
> [...]
Here is the summary with links:
- [bpf-next] bpf: Check attach_func_proto more carefully in check_helper_call
https://git.kernel.org/bpf/bpf-next/c/aef9d4a34a51
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2022-07-21 13:30 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-07-20 16:47 [PATCH bpf-next] bpf: Check attach_func_proto more carefully in check_helper_call Stanislav Fomichev
2022-07-20 18:16 ` Martin KaFai Lau
2022-07-21 13:30 ` patchwork-bot+netdevbpf
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).