mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-27 11:19:37 +00:00
bpf: Fix kfunc callback register type handling
[ Upstream commit06d686f771
] The kfunc code to handle KF_ARG_PTR_TO_CALLBACK does not check the reg type before using reg->subprogno. This can accidently permit invalid pointers from being passed into callback helpers (e.g. silently from different paths). Likewise, reg->subprogno from the per-register type union may not be meaningful either. We need to reject any other type except PTR_TO_FUNC. Acked-by: Dave Marchevsky <davemarchevsky@fb.com> Fixes:5d92ddc3de
("bpf: Add callback validation to kfunc verifier logic") Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Link: https://lore.kernel.org/r/20230912233214.1518551-14-memxor@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
7cfb0246b6
commit
99251305c2
1 changed files with 4 additions and 0 deletions
|
@ -11202,6 +11202,10 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
case KF_ARG_PTR_TO_CALLBACK:
|
case KF_ARG_PTR_TO_CALLBACK:
|
||||||
|
if (reg->type != PTR_TO_FUNC) {
|
||||||
|
verbose(env, "arg%d expected pointer to func\n", i);
|
||||||
|
return -EINVAL;
|
||||||
|
}
|
||||||
meta->subprogno = reg->subprogno;
|
meta->subprogno = reg->subprogno;
|
||||||
break;
|
break;
|
||||||
case KF_ARG_PTR_TO_REFCOUNTED_KPTR:
|
case KF_ARG_PTR_TO_REFCOUNTED_KPTR:
|
||||||
|
|
Loading…
Reference in a new issue