On Fri, Apr 24, 2020 at 6:34 AM Toke Høiland-Jørgensen <toke@xxxxxxxxxx> wrote:
>
> From: Toke Høiland-Jørgensen <toke@xxxxxxxxxx>
>
> For some program types, the verifier relies on the expected_attach_type of
> the program being verified in the verification process. However, for
> freplace programs, the attach type was not propagated along with the
> verifier ops, so the expected_attach_type would always be zero for freplace
> programs.
>
> This in turn caused the verifier to sometimes make the wrong call for
> freplace programs. For all existing uses of expected_attach_type for this
> purpose, the result of this was only false negatives (i.e., freplace
> functions would be rejected by the verifier even though they were valid
> programs for the target they were replacing). However, should a false
> positive be introduced, this can lead to out-of-bounds accesses and/or
> crashes.
>
> The fix introduced in this patch is to propagate the expected_attach_type
> to the freplace program during verification, and reset it after that is
> done.
>
> Fixes: be8704ff07d2 ("bpf: Introduce dynamic program extensions")
> Signed-off-by: Toke Høiland-Jørgensen <toke@xxxxxxxxxx>
Applied. Thanks!
