Patch "bpf: Fix wrong reg type conversion in release_reference()" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    bpf: Fix wrong reg type conversion in release_reference()

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     bpf-fix-wrong-reg-type-conversion-in-release_referen.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 9ca419bf95bbda5244deff94ea04b845edde4de2
Author: Youlin Li <liulin063@xxxxxxxxx>
Date:   Thu Nov 3 17:34:39 2022 +0800

    bpf: Fix wrong reg type conversion in release_reference()
    
    [ Upstream commit f1db20814af532f85e091231223e5e4818e8464b ]
    
    Some helper functions will allocate memory. To avoid memory leaks, the
    verifier requires the eBPF program to release these memories by calling
    the corresponding helper functions.
    
    When a resource is released, all pointer registers corresponding to the
    resource should be invalidated. The verifier use release_references() to
    do this job, by apply  __mark_reg_unknown() to each relevant register.
    
    It will give these registers the type of SCALAR_VALUE. A register that
    will contain a pointer value at runtime, but of type SCALAR_VALUE, which
    may allow the unprivileged user to get a kernel pointer by storing this
    register into a map.
    
    Using __mark_reg_not_init() while NOT allow_ptr_leaks can mitigate this
    problem.
    
    Fixes: fd978bf7fd31 ("bpf: Add reference tracking to verifier")
    Signed-off-by: Youlin Li <liulin063@xxxxxxxxx>
    Signed-off-by: Daniel Borkmann <daniel@xxxxxxxxxxxxx>
    Link: https://lore.kernel.org/bpf/20221103093440.3161-1-liulin063@xxxxxxxxx
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 96f317c494d9..8a73a165ac76 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -5686,8 +5686,12 @@ static int release_reference(struct bpf_verifier_env *env,
 		return err;
 
 	bpf_for_each_reg_in_vstate(env->cur_state, state, reg, ({
-		if (reg->ref_obj_id == ref_obj_id)
-			__mark_reg_unknown(env, reg);
+		if (reg->ref_obj_id == ref_obj_id) {
+			if (!env->allow_ptr_leaks)
+				__mark_reg_not_init(env, reg);
+			else
+				__mark_reg_unknown(env, reg);
+		}
 	}));
 
 	return 0;