Andrei Matei 37dc1718dc bpf: Protect against int overflow for stack access size ... [ Upstream commit ecc6a21018 ] This patch re-introduces protection against the size of access to stack memory being negative; the access size can appear negative as a result of overflowing its signed int representation. This should not actually happen, as there are other protections along the way, but we should protect against it anyway. One code path was missing such protections (fixed in the previous patch in the series), causing out-of-bounds array accesses in check_stack_range_initialized(). This patch causes the verification of a program with such a non-sensical access size to fail. This check used to exist in a more indirect way, but was inadvertendly removed in a833a17aea. Fixes: a833a17aea ("bpf: Fix verification of indirect var-off stack access") Reported-by: syzbot+33f4297b5f927648741a@syzkaller.appspotmail.com Reported-by: syzbot+aafd0513053a1cbf52ef@syzkaller.appspotmail.com Closes: https://lore.kernel.org/bpf/CAADnVQLORV5PT0iTAhRER+iLBTkByCYNBYyvBSgjN1T31K+gOw@mail.gmail.com/ Acked-by: Andrii Nakryiko <andrii@kernel.org> Signed-off-by: Andrei Matei <andreimatei1@gmail.com> Link: https://lore.kernel.org/r/20240327024245.318299-3-andreimatei1@gmail.com Signed-off-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2024-04-10 16:19:36 +02:00
..
bpf	bpf: Protect against int overflow for stack access size	2024-04-10 16:19:36 +02:00
cgroup	cgroup: Remove duplicates in cgroup v1 tasks file	2023-10-19 23:05:37 +02:00
configs
debug	kdb: Fix a potential buffer overflow in kdb_local()	2024-01-25 14:52:54 -08:00
dma	dma-mapping: add dma_opt_mapping_size()	2024-04-10 16:18:47 +02:00
entry	entry: Respect changes to system call number by trace_sys_enter()	2024-04-10 16:18:46 +02:00
events	perf/core: Fix reentry problem in perf_output_read_group()	2024-04-10 16:19:29 +02:00
futex	futex: Don't include process MM in futex key on no-MMU	2023-11-20 11:08:13 +01:00
gcov	gcov: add support for checksum field	2022-12-31 13:14:47 +01:00
irq	genirq/generic_chip: Make irq_remove_generic_chip() irqdomain aware	2023-11-28 16:56:30 +00:00
kcsan	kcsan: Don't expect 64 bits atomic builtins from 32 bits architectures	2023-07-23 13:47:12 +02:00
livepatch	livepatch: Fix missing newline character in klp_resolve_symbols()	2023-11-20 11:08:25 +01:00
locking	lockdep: Fix block chain corruption	2023-12-03 07:31:23 +01:00
power	PM: suspend: Set mem_sleep_current during kernel command line setup	2024-04-10 16:18:36 +02:00
printk	printk: Update @console_may_schedule in console_trylock_spinning()	2024-04-10 16:18:47 +02:00
rcu	rcu-tasks: Provide rcu_trace_implies_rcu_gp()	2024-03-26 18:21:11 -04:00
sched	sched/fair: Take the scheduling domain into account in select_idle_core()	2024-03-26 18:21:15 -04:00
time	timers: Rename del_timer_sync() to timer_delete_sync()	2024-04-10 16:18:33 +02:00
trace	tracing: Use .flush() call to wake up readers	2024-04-10 16:18:45 +02:00
.gitignore
acct.c	acct: fix potential integer overflow in encode_comp_t()	2022-12-31 13:14:40 +01:00
async.c	async: Introduce async_schedule_dev_nocall()	2024-02-23 08:54:25 +01:00
audit.c	audit: Send netlink ACK before setting connection in auditd_set	2024-02-23 08:54:37 +01:00
audit.h	audit: log AUDIT_TIME_* records only from rules	2022-04-08 14:23:06 +02:00
audit_fsnotify.c	fsnotify: make allow_dups a property of the group	2024-04-10 16:19:02 +02:00
audit_tree.c	fsnotify: pass flags argument to fsnotify_alloc_group()	2024-04-10 16:19:02 +02:00
audit_watch.c	fsnotify: pass flags argument to fsnotify_alloc_group()	2024-04-10 16:19:02 +02:00
auditfilter.c
auditsc.c	audit: fix possible soft lockup in __audit_inode_child()	2023-09-19 12:22:39 +02:00
backtracetest.c
bounds.c	bounds: support non-power-of-two CONFIG_NR_CPUS	2024-04-10 16:18:35 +02:00
capability.c
cfi.c	cfi: Fix __cfi_slowpath_diag RCU usage with cpuidle	2022-06-22 14:22:04 +02:00
compat.c	sched_getaffinity: don't assume 'cpumask_size()' is fully initialized	2023-04-05 11:24:53 +02:00
configs.c
context_tracking.c
cpu.c	hrtimers: Push pending hrtimers away from outgoing CPU earlier	2023-12-13 18:36:31 +01:00
cpu_pm.c
crash_core.c	kernel/crash_core: suppress unknown crashkernel parameter warning	2021-12-29 12:28:49 +01:00
crash_dump.c
cred.c	cred: switch to using atomic_long_t	2023-12-20 15:17:37 +01:00
delayacct.c
dma.c
exec_domain.c
exit.c	exit: Use READ_ONCE() for all oops/warn limit reads	2023-02-01 08:27:22 +01:00
extable.c
fail_function.c	kernel/fail_function: fix memory leak with using debugfs_lookup()	2023-03-11 13:57:38 +01:00
fork.c	kernel/fork: beware of __put_task_struct() calling context	2023-09-23 11:09:55 +02:00
freezer.c
gen_kheaders.sh
groups.c
hung_task.c
iomem.c
irq_work.c
jump_label.c
kallsyms.c	kallsyms: Make kallsyms_on_each_symbol generally available	2023-12-13 18:36:45 +01:00
kcmp.c
Kconfig.freezer
Kconfig.hz
Kconfig.locks
Kconfig.preempt
kcov.c
kexec.c	kernel: kexec: copy user-array safely	2023-11-28 16:56:16 +00:00
kexec_core.c	kexec: fix a memory leak in crash_shrink_memory()	2023-07-23 13:46:52 +02:00
kexec_elf.c
kexec_file.c	kexec: support purgatories with .text.hot sections	2023-06-21 15:59:14 +02:00
kexec_internal.h	panic, kexec: make __crash_kexec() NMI safe	2023-04-20 12:13:57 +02:00
kheaders.c	kheaders: Use array declaration instead of char	2023-05-11 23:00:17 +09:00
kmod.c
kprobes.c	kprobes: Fix to handle forcibly unoptimized kprobes on freeing_list	2024-01-25 14:52:31 -08:00
ksysfs.c	kexec: turn all kexec_mutex acquisitions into trylocks	2023-04-20 12:13:57 +02:00
kthread.c	exit: Implement kthread_exit	2024-04-10 16:18:55 +02:00
latencytop.c
Makefile	futex: Move to kernel/futex/	2022-12-31 13:14:04 +01:00
module-internal.h
module.c	NFSD: Remove svc_serv_ops::svo_module	2024-04-10 16:19:01 +02:00
module_signature.c
module_signing.c
notifier.c
nsproxy.c	memcg: enable accounting for new namesapces and struct nsproxy	2021-09-03 09:58:12 -07:00
padata.c	crypto: pcrypt - Fix hungtask for PADATA_RESET	2023-11-28 16:56:18 +00:00
panic.c	exit: Use READ_ONCE() for all oops/warn limit reads	2023-02-01 08:27:22 +01:00
params.c
pid.c
pid_namespace.c	rcu-tasks: Fix synchronize_rcu_tasks() VS zap_pid_ns_processes()	2023-03-10 09:39:09 +01:00
profile.c	profiling: fix shift too large makes kernel panic	2022-08-17 14:24:04 +02:00
ptrace.c	ptrace: Reimplement PTRACE_KILL by always sending SIGKILL	2022-06-09 10:22:29 +02:00
range.c
reboot.c	kernel/reboot: emergency_restart: Set correct system_state	2023-11-28 16:56:31 +00:00
regset.c
relay.c	relayfs: fix out-of-bounds access in relay_file_read	2023-05-11 23:00:18 +09:00
resource.c	dax/kmem: Fix leak of memory-hotplug resources	2023-03-10 09:40:08 +01:00
resource_kunit.c
rseq.c	rseq: Remove broken uapi field layout on 32-bit little endian	2022-04-08 14:23:10 +02:00
scftorture.c	scftorture: Forgive memory-allocation failure if KASAN	2023-09-23 11:09:55 +02:00
scs.c	scs: Release kasan vmalloc poison in scs_free process	2021-11-18 19:16:29 +01:00
seccomp.c	seccomp: Invalidate seccomp mode to catch death failures	2022-02-16 12:56:38 +01:00
signal.c	signal handling: don't use BUG_ON() for debugging	2022-07-21 21:24:42 +02:00
smp.c	locking/csd_lock: Change csdlock_debug from early_param to __setup	2022-08-17 14:24:24 +02:00
smpboot.c
smpboot.h
softirq.c	timers/nohz: Last resort update jiffies on nohz_full IRQ entry	2023-08-16 18:22:04 +02:00
stackleak.c	gcc-plugins/stackleak: Use noinstr in favor of notrace	2022-02-23 12:03:07 +01:00
stacktrace.c	stacktrace: move filter_irq_stacks() to kernel/stacktrace.c	2022-04-13 20:59:28 +02:00
static_call.c	static_call: Don't make __static_call_return0 static	2022-04-13 20:59:28 +02:00
static_call_inline.c	static_call: Don't make __static_call_return0 static	2022-04-13 20:59:28 +02:00
stop_machine.c
sys.c	getrusage: use sig->stats_lock rather than lock_task_sighand()	2024-03-15 10:48:22 -04:00
sys_ni.c	kernel/sys_ni: add compat entry for fadvise64_64	2022-08-31 17:16:33 +02:00
sysctl-test.c
sysctl.c	sched/rt: Disallow writing invalid values to sched_rt_period_us	2024-03-01 13:21:43 +01:00
task_work.c
taskstats.c
test_kprobes.c
torture.c	torture: Fix hang during kthread shutdown phase	2023-08-30 16:18:19 +02:00
tracepoint.c
tsacct.c	taskstats: Cleanup the use of task->exit_code	2022-01-27 11:05:35 +01:00
ucount.c	ucounts: Handle wrapping in is_ucounts_overlimit	2022-02-23 12:03:20 +01:00
uid16.c
uid16.h
umh.c
up.c
user-return-notifier.c
user.c	fs/epoll: use a per-cpu counter for user's watches count	2021-09-08 11:50:27 -07:00
user_namespace.c	ucounts: Fix systemd LimitNPROC with private users regression	2022-03-08 19:12:42 +01:00
usermode_driver.c
utsname.c
utsname_sysctl.c
watch_queue.c	kernel: watch_queue: copy user-array safely	2023-11-28 16:56:16 +00:00
watchdog.c	watchdog: move softlockup_panic back to early_param	2023-11-28 16:56:28 +00:00
watchdog_hld.c	watchdog/perf: more properly prevent false positives with turbo modes	2023-07-23 13:46:52 +02:00
workqueue.c	Revert "workqueue: remove unused cancel_work()"	2023-12-08 08:48:03 +01:00
workqueue_internal.h	workqueue: Assign a color to barrier work items	2021-08-17 07:49:10 -10:00