Kumar Kartikeya Dwivedi bfe25df630 bpf: Check PTR_TO_MEM | MEM_RDONLY in check_helper_mem_access ... commit 97e6d7dab1 upstream. The commit being fixed was aiming to disallow users from incorrectly obtaining writable pointer to memory that is only meant to be read. This is enforced now using a MEM_RDONLY flag. For instance, in case of global percpu variables, when the BTF type is not struct (e.g. bpf_prog_active), the verifier marks register type as PTR_TO_MEM | MEM_RDONLY from bpf_this_cpu_ptr or bpf_per_cpu_ptr helpers. However, when passing such pointer to kfunc, global funcs, or BPF helpers, in check_helper_mem_access, there is no expectation MEM_RDONLY flag will be set, hence it is checked as pointer to writable memory. Later, verifier sets up argument type of global func as PTR_TO_MEM | PTR_MAYBE_NULL, so user can use a global func to get around the limitations imposed by this flag. This check will also cover global non-percpu variables that may be introduced in kernel BTF in future. Also, we update the log message for PTR_TO_BUF case to be similar to PTR_TO_MEM case, so that the reason for error is clear to user. Fixes: 34d3a78c68 ("bpf: Make per_cpu_ptr return rdonly PTR_TO_MEM.") Reviewed-by: Hao Luo <haoluo@google.com> Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Link: https://lore.kernel.org/r/20220319080827.73251-3-memxor@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-06-06 08:47:57 +02:00
..
bpf	bpf: Check PTR_TO_MEM | MEM_RDONLY in check_helper_mem_access	2022-06-06 08:47:57 +02:00
cgroup	cgroup/cpuset: Remove cpus_allowed/mems_allowed setup in cpuset_init_smp()	2022-05-18 10:28:22 +02:00
configs	configs/debug: restore DEBUG_INFO=y for overriding	2022-03-17 11:02:13 -07:00
debug	lockdown: also lock down previous kgdb use	2022-05-25 09:59:10 +02:00
dma	dma-direct: avoid redundant memory sync for swiotlb	2022-04-20 09:36:27 +02:00
entry	entry: Snapshot thread flags	2021-12-01 00:06:43 +01:00
events	perf: Fix sys_perf_event_open() race against self	2022-05-25 09:59:02 +02:00
futex	Merge branch 'signal-for-v5.17' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace	2022-01-17 05:49:30 +02:00
gcov	gcov: Remove compiler version check	2021-12-02 17:25:21 +09:00
irq	genirq: Remove WARN_ON_ONCE() in generic_handle_domain_irq()	2022-05-18 10:28:20 +02:00
kcsan	KCSAN updates for v5.17	2022-01-11 09:51:26 -08:00
livepatch	livepatch: Fix build failure on 32 bits processors	2022-04-08 13:58:03 +02:00
locking	locking/lockdep: Iterate lock_classes directly when reading lockdep files	2022-04-08 13:58:39 +02:00
power	PM: suspend: fix return value of __setup handler	2022-04-08 13:57:36 +02:00
printk	printk: fix return value of printk.devkmsg __setup handler	2022-04-08 13:57:50 +02:00
rcu	rcu: Mark writes to the rcu_segcblist structure's ->flags field	2022-04-08 13:58:36 +02:00
sched	sched/pelt: Fix attach_entity_load_avg() corner case	2022-04-27 14:41:12 +02:00
time	timekeeping: Add raw clock fallback for random_get_entropy()	2022-05-30 09:27:13 +02:00
trace	tracing: Have type enum modifications copy the strings	2022-04-08 13:58:59 +02:00
.gitignore
acct.c	kernel: remove spurious blkdev.h includes	2021-10-18 06:17:01 -06:00
async.c	Revert "module, async: async_synchronize_full() on module init iff async is used"	2022-02-03 11:20:34 -08:00
audit.c	audit: improve audit queue handling when "audit=1" on cmdline	2022-01-25 13:22:51 -05:00
audit.h	audit: log AUDIT_TIME_* records only from rules	2022-04-08 13:57:35 +02:00
audit_fsnotify.c	fsnotify: clarify contract for create event hooks	2021-10-27 12:32:34 +02:00
audit_tree.c	audit: use struct_size() helper in kmalloc()	2021-12-14 17:39:42 -05:00
audit_watch.c	\n	2021-11-06 16:43:20 -07:00
auditfilter.c	audit/stable-5.17 PR 20220110	2022-01-11 13:08:21 -08:00
auditsc.c	audit,io_uring,io-wq: call __audit_uring_exit for dummy contexts	2022-05-25 09:59:02 +02:00
backtracetest.c
bounds.c
capability.c
cfi.c	cfi: Use rcu_read_{un}lock_sched_notrace	2021-08-11 13:11:12 -07:00
compat.c	arch: remove compat_alloc_user_space	2021-09-08 15:32:35 -07:00
configs.c
context_tracking.c
cpu.c	random: clear fast pool, crng, and batches in cpuhp bring up	2022-05-30 09:27:08 +02:00
cpu_pm.c	PM: cpu: Make notifier chain use a raw_spinlock_t	2021-08-16 18:55:32 +02:00
crash_core.c	kernel/crash_core: suppress unknown crashkernel parameter warning	2021-12-25 12:20:55 -08:00
crash_dump.c
cred.c	ucounts: Base set_cred_ucounts changes on the real user	2022-02-17 09:11:02 -06:00
delayacct.c	delayacct: track delays from memory compact	2022-01-20 08:52:55 +02:00
dma.c
exec_domain.c
exit.c	exit: Fix the exit_code for wait_task_zombie	2022-01-08 12:43:57 -06:00
extable.c	extable: use is_kernel_text() helper	2021-11-09 10:02:51 -08:00
fail_function.c
fork.c	mm: refactor vm_area_struct::anon_vma_name usage code	2022-03-05 11:08:32 -08:00
freezer.c
gen_kheaders.sh
groups.c
hung_task.c	hung_task: move hung_task sysctl interface to hung_task.c	2022-01-22 08:33:34 +02:00
iomem.c
irq_work.c	irq_work: use kasan_record_aux_stack_noalloc() record callstack	2022-04-27 14:41:10 +02:00
jump_label.c	jump_label: Fix jump_label_text_reserved() vs __init	2021-07-05 10:46:20 +02:00
kallsyms.c	Livepatching changes for 5.17	2022-01-16 10:08:13 +02:00
kcmp.c
Kconfig.freezer
Kconfig.hz
Kconfig.locks	locking/rwlock: Provide RT variant	2021-08-17 17:50:51 +02:00
Kconfig.preempt	preempt: Restore preemption model selection configs	2021-11-11 13:09:33 +01:00
kcov.c	kcov: replace local_irq_save() with a local_lock_t	2021-11-09 10:02:52 -08:00
kexec.c	kexec: avoid compat_alloc_user_space	2021-09-08 15:32:34 -07:00
kexec_core.c	exit: Move oops specific logic from do_exit into make_task_dead	2021-12-13 12:04:45 -06:00
kexec_elf.c
kexec_file.c	memblock: add MEMBLOCK_DRIVER_MANAGED to mimic IORESOURCE_SYSRAM_DRIVER_MANAGED	2021-11-06 13:30:42 -07:00
kexec_internal.h
kheaders.c
kmod.c
kprobes.c	kprobe: move sysctl_kprobes_optimization to kprobes.c	2022-01-22 08:33:36 +02:00
ksysfs.c
kthread.c	Merge branch 'akpm' (patches from Andrew)	2022-01-20 10:41:01 +02:00
latencytop.c
Makefile	static_call: Don't make __static_call_return0 static	2022-04-13 19:27:43 +02:00
module-internal.h	module: add in-kernel support for decompressing	2022-01-11 18:45:02 -08:00
module.c	Revert "module, async: async_synchronize_full() on module init iff async is used"	2022-02-03 11:20:34 -08:00
module_decompress.c	module: fix building with sysfs disabled	2022-02-16 12:51:32 -08:00
module_signature.c
module_signing.c
notifier.c	notifier: Return an error when a callback has already been registered	2021-12-29 10:37:33 +01:00
nsproxy.c	memcg: enable accounting for new namesapces and struct nsproxy	2021-09-03 09:58:12 -07:00
padata.c	padata: Remove repeated verbose license text	2021-08-27 16:30:18 +08:00
panic.c	panic: remove oops_id	2022-01-20 08:52:55 +02:00
params.c	kobject: remove kset from struct kset_uevent_ops callbacks	2021-12-28 11:26:18 +01:00
pid.c	pid: add pidfd_get_task() helper	2021-10-14 13:29:18 +02:00
pid_namespace.c	memcg: enable accounting for new namesapces and struct nsproxy	2021-09-03 09:58:12 -07:00
profile.c	exit: Remove profile_handoff_task	2022-01-08 12:43:57 -06:00
ptrace.c	ptrace: Check PTRACE_O_SUSPEND_SECCOMP permission on PTRACE_SEIZE	2022-04-08 13:57:16 +02:00
range.c
reboot.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input	2021-11-12 11:53:16 -08:00
regset.c
relay.c
resource.c	kernel/resource: fix kfree() of bootmem memory again	2022-04-08 13:58:23 +02:00
resource_kunit.c
rseq.c	rseq: Remove broken uapi field layout on 32-bit little endian	2022-04-08 13:57:39 +02:00
scftorture.c	scftorture: Always log error message	2021-12-07 16:36:17 -08:00
scs.c	scs: Release kasan vmalloc poison in scs_free process	2021-09-30 09:37:27 +01:00
seccomp.c	seccomp: Invalidate seccomp mode to catch death failures	2022-02-10 19:09:12 -08:00
signal.c	signal: HANDLER_EXIT should clear SIGNAL_UNKILLABLE	2022-02-10 19:08:54 -08:00
smp.c	smp: Fix offline cpu check in flush_smp_call_function_queue()	2022-04-20 09:36:27 +02:00
smpboot.c	smpboot: Replace deprecated CPU-hotplug functions.	2021-08-10 14:57:42 +02:00
smpboot.h
softirq.c	timers/nohz: Last resort update jiffies on nohz_full IRQ entry	2021-12-02 15:07:22 +01:00
stackleak.c	gcc-plugins/stackleak: Use noinstr in favor of notrace	2022-02-03 17:02:21 -08:00
stacktrace.c	stacktrace: move filter_irq_stacks() to kernel/stacktrace.c	2021-11-06 13:30:43 -07:00
static_call.c	static_call: Don't make __static_call_return0 static	2022-04-13 19:27:43 +02:00
static_call_inline.c	static_call: Don't make __static_call_return0 static	2022-04-13 19:27:43 +02:00
stop_machine.c
sys.c	mm: refactor vm_area_struct::anon_vma_name usage code	2022-03-05 11:08:32 -08:00
sys_ni.c	mm/mempolicy: wire up syscall set_mempolicy_home_node	2022-01-15 16:30:30 +02:00
sysctl-test.c
sysctl.c	x86/speculation: Include unprivileged eBPF status in Spectre v2 mitigation reporting	2022-02-21 10:21:47 +01:00
task_work.c
taskstats.c
torture.c	locktorture,rcutorture,torture: Always log error message	2021-12-07 16:36:17 -08:00
tracepoint.c	tracepoint: Fix kerneldoc comments	2021-08-16 11:39:51 -04:00
tsacct.c	taskstats: Cleanup the use of task->exit_code	2022-01-08 12:43:57 -06:00
ucount.c	ucounts: Handle wrapping in is_ucounts_overlimit	2022-02-17 09:11:57 -06:00
uid16.c
uid16.h
umh.c
up.c
user-return-notifier.c
user.c	fs/epoll: use a per-cpu counter for user's watches count	2021-09-08 11:50:27 -07:00
user_namespace.c	ucounts: Fix systemd LimitNPROC with private users regression	2022-02-25 10:40:14 -06:00
usermode_driver.c	Merge branch 'work.namei' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2021-07-03 11:41:14 -07:00
utsname.c
utsname_sysctl.c
watch_queue.c	watch_queue: Free the page array when watch_queue is dismantled	2022-04-08 13:58:56 +02:00
watchdog.c	watchdog: move watchdog sysctl interface to watchdog.c	2022-01-22 08:33:34 +02:00
watchdog_hld.c
workqueue.c	Merge branch 'workqueue/for-5.16-fixes' into workqueue/for-5.17	2022-01-10 07:54:04 -10:00
workqueue_internal.h	workqueue: Assign a color to barrier work items	2021-08-17 07:49:10 -10:00