Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

Pull bpf fixes from Eduard Zingerman: - Fix tcp_bpf_sendmsg() error path mistaking a concurrently-freed sk_psock->cork for the local temporary message and freeing it again (Chengfeng Ye) - Reject passing scalar NULL to nonnull arg of a global subprog. Previously the verifier did not account for the cases directly passing scalars to a global subprog, e.g.: 'global_func(0);' would pass even if 'global_func' argument was marked nonnull (Amery Hung) * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() selftests/bpf: Test passing scalar NULL to nonnull global subprog bpf: Reject passing scalar NULL to nonnull arg of a global subprog

Linus Torvalds committed 3 months ago

Commit ae453ee2 parents e2a9369 2d66a033 files · +13 −2Browse files

Unified · Split

3 files

kernel/bpf/verifier.c +2 −1
net/ipv4/tcp_bpf.c +1 −1
tools/testing/selftests/bpf/progs/verifier_global_subprogs.c +10 −0

kernel/bpf/verifier.c+2−1

@@ -9189,7 +9189,8 @@ static int btf_check_func_arg_match(struct bpf_verifier_env *env, int subprog, · 9188 unmodified lines
9189	9189	return ret;
9190	9190	if (check_mem_reg(env, reg, argno, arg->mem_size))
9191	9191	return -EINVAL;
9192		− if (!(arg->arg_type & PTR_MAYBE_NULL) && (reg->type & PTR_MAYBE_NULL)) {
	9192	+ if (!(arg->arg_type & PTR_MAYBE_NULL) &&
	9193	+ (type_may_be_null(reg->type) \|\| bpf_register_is_null(reg))) {
9193	9194	bpf_log(log, "%s is expected to be non-NULL\n",
9194	9195	reg_arg_name(env, argno));
9195	9196	return -EINVAL;

net/ipv4/tcp_bpf.c+1−1

@@ -604,7 +604,7 @@ wait_for_sndbuf: · 603 unmodified lines
604	604	wait_for_memory:
605	605	err = sk_stream_wait_memory(sk, &timeo);
606	606	if (err) {
607		− if (msg_tx && msg_tx != psock->cork)
	607	+ if (msg_tx == &tmp)
608	608	sk_msg_free(sk, msg_tx);
609	609	goto out_err;
610	610	}

tools/testing/selftests/bpf/progs/verifier_global_subprogs.c+10−0

@@ -185,6 +185,16 @@ int arg_tag_nonnull_ptr_good(void *ctx) · 184 unmodified lines
185	185	return subprog_nonnull_ptr_good(&x, &y);
186	186	}
187	187
	188	+SEC("?raw_tp")
	189	+__failure __log_level(2)
	190	+__msg("R1 is expected to be non-NULL")
	191	+int arg_tag_nonnull_ptr_null_bad(void *ctx)
	192	+{
	193	+ int y = 74;
	194	+
	195	+ return subprog_nonnull_ptr_good(NULL, &y);
	196	+}
	197	+
188	198	/* this global subprog can be now called from many types of entry progs, each
189	199	* with different context type
190	200	*/