This is a note to let you know that I've just added the patch titled
bpf: Mark PTR_TO_FUNC register initially with zero offset
to the 5.16-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
bpf-mark-ptr_to_func-register-initially-with-zero-offset.patch
and it can be found in the queue-5.16 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From d400a6cf1c8a57cdf10f35220ead3284320d85ff Mon Sep 17 00:00:00 2001
From: Daniel Borkmann <daniel@xxxxxxxxxxxxx>
Date: Fri, 14 Jan 2022 13:58:36 +0000
Subject: bpf: Mark PTR_TO_FUNC register initially with zero offset
From: Daniel Borkmann <daniel@xxxxxxxxxxxxx>
commit d400a6cf1c8a57cdf10f35220ead3284320d85ff upstream.
Similar as with other pointer types where we use ldimm64, clear the register
content to zero first, and then populate the PTR_TO_FUNC type and subprogno
number. Currently this is not done, and leads to reuse of stale register
tracking data.
Given for special ldimm64 cases we always clear the register offset, make it
common for all cases, so it won't be forgotten in future.
Fixes: 69c087ba6225 ("bpf: Add bpf_for_each_map_elem() helper")
Signed-off-by: Daniel Borkmann <daniel@xxxxxxxxxxxxx>
Acked-by: John Fastabend <john.fastabend@xxxxxxxxx>
Acked-by: Alexei Starovoitov <ast@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
kernel/bpf/verifier.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -9389,9 +9389,13 @@ static int check_ld_imm(struct bpf_verif
return 0;
}
- if (insn->src_reg == BPF_PSEUDO_BTF_ID) {
- mark_reg_known_zero(env, regs, insn->dst_reg);
+ /* All special src_reg cases are listed below. From this point onwards
+ * we either succeed and assign a corresponding dst_reg->type after
+ * zeroing the offset, or fail and reject the program.
+ */
+ mark_reg_known_zero(env, regs, insn->dst_reg);
+ if (insn->src_reg == BPF_PSEUDO_BTF_ID) {
dst_reg->type = aux->btf_var.reg_type;
switch (dst_reg->type) {
case PTR_TO_MEM:
@@ -9429,7 +9433,6 @@ static int check_ld_imm(struct bpf_verif
}
map = env->used_maps[aux->map_index];
- mark_reg_known_zero(env, regs, insn->dst_reg);
dst_reg->map_ptr = map;
if (insn->src_reg == BPF_PSEUDO_MAP_VALUE ||
Patches currently in stable-queue which might be from daniel@xxxxxxxxxxxxx are
queue-5.16/libbpf-fix-glob_syms-memory-leak-in-bpf_linker.patch
queue-5.16/libbpf-fix-using-invalidated-memory-in-bpf_linker.patch
queue-5.16/bpf-sockmap-fix-double-bpf_prog_put-on-error-case-in.patch
queue-5.16/bpf-arm64-use-emit_addr_mov_i64-for-bpf_pseudo_func.patch
queue-5.16/libbpf-fix-potential-misaligned-memory-access-in-btf.patch
queue-5.16/selftests-bpf-fix-xdpxceiver-failures-for-no-hugepag.patch
queue-5.16/bpf-remove-config-check-to-enable-bpf-support-for-br.patch
queue-5.16/bpf-fix-the-test_task_vma-selftest-to-support-output.patch
queue-5.16/tools-resolve_btf_ids-close-elf-file-on-error.patch
queue-5.16/bpf-selftests-fix-namespace-mount-setup-in-tc_redire.patch
queue-5.16/libbpf-load-global-data-maps-lazily-on-legacy-kernel.patch
queue-5.16/bpf-fix-mount-source-show-for-bpffs.patch
queue-5.16/bpf-mark-ptr_to_func-register-initially-with-zero-offset.patch
queue-5.16/libbpf-accommodate-dwarf-compiler-bug-with-duplicate.patch
queue-5.16/bpf-don-t-promote-bogus-looking-registers-after-null.patch
queue-5.16/bpf-do-not-warn-in-bpf_warn_invalid_xdp_action.patch
queue-5.16/arm64-bpf-remove-128mb-limit-for-bpf-jit-programs.patch
queue-5.16/bpf-sockmap-fix-return-codes-from-tcp_bpf_recvmsg_pa.patch
queue-5.16/bpf-change-value-of-max_tail_call_cnt-from-32-to-33.patch
