Pull bpf fixes from Eduard Zingerman: - Fix tcp_bpf_sendmsg() error path mistaking a concurrently-freed sk_psock->cork for the local temporary message and freeing it again (Chengfeng Ye) - Reject passing scalar NULL to nonnull arg of a global subprog. Previously the verifier did not account for the cases directly passing scalars to a global subprog, e.g.: 'global_func(0);' would pass even if 'global_func' argument was marked nonnull (Amery Hung) * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() selftests/bpf: Test passing scalar NULL to nonnull global subprog bpf: Reject passing scalar NULL to nonnull arg of a global subprog
Unified · Split
| @@ -9189,7 +9189,8 @@ static int btf_check_func_arg_match(struct bpf_verifier_env *env, int subprog, · 9188 unmodified lines | |||
| 9189 | return ret; | 9189 | return ret; |
| 9190 | if (check_mem_reg(env, reg, argno, arg->mem_size)) | 9190 | if (check_mem_reg(env, reg, argno, arg->mem_size)) |
| 9191 | return -EINVAL; | 9191 | return -EINVAL; |
| 9192 | if (!(arg->arg_type & PTR_MAYBE_NULL) && (reg->type & PTR_MAYBE_NULL)) { | 9192 | if (!(arg->arg_type & PTR_MAYBE_NULL) && |
| 9193 | (type_may_be_null(reg->type) || bpf_register_is_null(reg))) { | ||
| 9193 | bpf_log(log, "%s is expected to be non-NULL\n", | 9194 | bpf_log(log, "%s is expected to be non-NULL\n", |
| 9194 | reg_arg_name(env, argno)); | 9195 | reg_arg_name(env, argno)); |
| 9195 | return -EINVAL; | 9196 | return -EINVAL; |
| @@ -604,7 +604,7 @@ wait_for_sndbuf: · 603 unmodified lines | |||
| 604 | wait_for_memory: | 604 | wait_for_memory: |
| 605 | err = sk_stream_wait_memory(sk, &timeo); | 605 | err = sk_stream_wait_memory(sk, &timeo); |
| 606 | if (err) { | 606 | if (err) { |
| 607 | if (msg_tx && msg_tx != psock->cork) | 607 | if (msg_tx == &tmp) |
| 608 | sk_msg_free(sk, msg_tx); | 608 | sk_msg_free(sk, msg_tx); |
| 609 | goto out_err; | 609 | goto out_err; |
| 610 | } | 610 | } |
| @@ -185,6 +185,16 @@ int arg_tag_nonnull_ptr_good(void *ctx) · 184 unmodified lines | |||
| 185 | return subprog_nonnull_ptr_good(&x, &y); | 185 | return subprog_nonnull_ptr_good(&x, &y); |
| 186 | } | 186 | } |
| 187 | 187 | ||
| 188 | SEC("?raw_tp") | ||
| 189 | __failure __log_level(2) | ||
| 190 | __msg("R1 is expected to be non-NULL") | ||
| 191 | int arg_tag_nonnull_ptr_null_bad(void *ctx) | ||
| 192 | { | ||
| 193 | int y = 74; | ||
| 194 | |||
| 195 | return subprog_nonnull_ptr_good(NULL, &y); | ||
| 196 | } | ||
| 197 | |||
| 188 | /* this global subprog can be now called from many types of entry progs, each | 198 | /* this global subprog can be now called from many types of entry progs, each |
| 189 | * with different context type | 199 | * with different context type |
| 190 | */ | 200 | */ |