Stanislav Fomichev e6d276dcc9 bpf: Prevent decl_tag from being referenced in func_proto arg ... [ Upstream commit f17472d459 ] Syzkaller managed to hit another decl_tag issue: btf_func_proto_check kernel/bpf/btf.c:4506 [inline] btf_check_all_types kernel/bpf/btf.c:4734 [inline] btf_parse_type_sec+0x1175/0x1980 kernel/bpf/btf.c:4763 btf_parse kernel/bpf/btf.c:5042 [inline] btf_new_fd+0x65a/0xb00 kernel/bpf/btf.c:6709 bpf_btf_load+0x6f/0x90 kernel/bpf/syscall.c:4342 __sys_bpf+0x50a/0x6c0 kernel/bpf/syscall.c:5034 __do_sys_bpf kernel/bpf/syscall.c:5093 [inline] __se_sys_bpf kernel/bpf/syscall.c:5091 [inline] __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5091 do_syscall_64+0x54/0x70 arch/x86/entry/common.c:48 This seems similar to commit ea68376c8b ("bpf: prevent decl_tag from being referenced in func_proto") but for the argument. Reported-by: syzbot+8dd0551dda6020944c5d@syzkaller.appspotmail.com Signed-off-by: Stanislav Fomichev <sdf@google.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Yonghong Song <yhs@fb.com> Link: https://lore.kernel.org/bpf/20221123035422.872531-2-sdf@google.com Signed-off-by: Sasha Levin <sashal@kernel.org>		2022-12-31 13:33:03 +01:00
..
preload	bpf: iterators: Build and use lightweight bootstrap version of bpftool	2022-07-15 12:01:30 -07:00
arraymap.c	bpf: Support kptrs in percpu arraymap	2022-09-07 11:46:08 -07:00
bloom_filter.c	treewide: use get_random_u32() when possible	2022-10-11 17:42:58 -06:00
bpf_inode_storage.c	bpf: Compute map_btf_id during build time	2022-04-26 11:35:21 -07:00
bpf_iter.c	bpf: Initialize the bpf_run_ctx in bpf_iter_run_prog()	2022-08-18 17:06:13 -07:00
bpf_local_storage.c	bpf: Do not copy spin lock field from user in bpf_selem_alloc	2022-11-21 11:45:37 -08:00
bpf_lru_list.c	bpf_lru_list: Read double-checked variable once without lock	2021-02-10 15:54:26 -08:00
bpf_lru_list.h	printk: stop including cache.h from printk.h	2022-05-13 07:20:07 -07:00
bpf_lsm.c	Networking changes for 6.1.	2022-10-04 13:38:03 -07:00
bpf_struct_ops.c	bpf: Remove is_valid_bpf_tramp_flags()	2022-07-11 21:04:58 +02:00
bpf_struct_ops_types.h	bpf: Add dummy BPF STRUCT_OPS for test purpose	2021-11-01 14:10:00 -07:00
bpf_task_storage.c	bpf: Use this_cpu_{inc|dec|inc_return} for bpf_task_storage_busy	2022-09-01 12:16:12 -07:00
btf.c	bpf: Prevent decl_tag from being referenced in func_proto arg	2022-12-31 13:33:03 +01:00
cgroup.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-10-03 17:44:18 -07:00
cgroup_iter.c	bpf: Pin the start cgroup in cgroup_iter_seq_init()	2022-12-31 13:32:13 +01:00
core.c	treewide: use get_random_u32() when possible	2022-10-11 17:42:58 -06:00
cpumap.c	bpf: Use bpf_map_area_alloc consistently on bpf map creation	2022-08-10 11:50:43 -07:00
devmap.c	bpf: Use bpf_map_area_alloc consistently on bpf map creation	2022-08-10 11:50:43 -07:00
disasm.c	bpf: Relicense disassembler as GPL-2.0-only OR BSD-2-Clause	2021-09-02 14:49:23 +02:00
disasm.h	bpf: Relicense disassembler as GPL-2.0-only OR BSD-2-Clause	2021-09-02 14:49:23 +02:00
dispatcher.c	bpf: Add explicit cast to 'void *' for __BPF_DISPATCHER_UPDATE()	2022-11-07 16:07:35 -08:00
hashtab.c	treewide: use get_random_u32() when possible	2022-10-11 17:42:58 -06:00
helpers.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-10-03 17:44:18 -07:00
inode.c	bpf: Convert bpf_preload.ko to use light skeleton.	2022-02-10 23:31:51 +01:00
Kconfig	rcu: Make the TASKS_RCU Kconfig option be selected	2022-04-20 16:52:58 -07:00
link_iter.c	bpf: Add bpf_link iterator	2022-05-10 11:20:45 -07:00
local_storage.c	bpf: Use bpf_map_area_alloc consistently on bpf map creation	2022-08-10 11:50:43 -07:00
lpm_trie.c	bpf: Use bpf_map_area_alloc consistently on bpf map creation	2022-08-10 11:50:43 -07:00
Makefile	bpf: Introduce any context BPF specific memory allocator.	2022-09-05 15:33:05 +02:00
map_in_map.c	bpf: Allow storing unreferenced kptr in map	2022-04-25 17:31:35 -07:00
map_in_map.h
map_iter.c	bpf: Introduce MEM_RDONLY flag	2021-12-18 13:27:41 -08:00
memalloc.c	bpf: Use __llist_del_all() whenever possbile during memory draining	2022-10-21 19:17:38 -07:00
mmap_unlock_work.h	bpf: Introduce helper bpf_find_vma	2021-11-07 11:54:51 -08:00
net_namespace.c	net: Add includes masked by netdevice.h including uapi/bpf.h	2021-12-29 20:03:05 -08:00
offload.c	bpf: Use bpf_map_area_alloc consistently on bpf map creation	2022-08-10 11:50:43 -07:00
percpu_freelist.c	bpf: Initialize same number of free nodes for each pcpu_freelist	2022-11-11 12:05:14 -08:00
percpu_freelist.h	bpf: Use raw_spin_trylock() for pcpu_freelist_push/pop in NMI	2020-10-06 00:04:11 +02:00
prog_iter.c
queue_stack_maps.c	bpf: Remove unneeded memset in queue_stack_map creation	2022-08-10 11:48:22 -07:00
reuseport_array.c	net: Fix suspicious RCU usage in bpf_sk_reuseport_detach()	2022-08-17 16:42:59 -07:00
ringbuf.c	bpf: Add bpf_user_ringbuf_drain() helper	2022-09-21 16:24:58 -07:00
stackmap.c	perf/bpf: Always use perf callchains if exist	2022-09-13 15:03:22 +02:00
syscall.c	bpf: prevent leak of lsm program after failed attach	2022-12-31 13:32:54 +01:00
sysfs_btf.c	bpf: Load and verify kernel module BTFs	2020-11-10 15:25:53 -08:00
task_iter.c	- Yu Zhao's Multi-Gen LRU patches are here. They've been under test in	2022-10-10 17:53:04 -07:00
tnum.c	bpf, tnums: Provably sound, faster, and more precise algorithm for tnum_mul	2021-06-01 13:34:15 +02:00
trampoline.c	bpf: Add __bpf_prog_{enter,exit}_struct_ops for struct_ops trampoline	2022-09-29 09:25:47 -07:00
verifier.c	bpf/verifier: Use kmalloc_size_roundup() to match ksize() usage	2022-12-31 13:33:02 +01:00