Patch "bpf: Fix an error in verifying a field in a union" has been added to the 6.1-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    bpf: Fix an error in verifying a field in a union

to the 6.1-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     bpf-fix-an-error-in-verifying-a-field-in-a-union.patch
and it can be found in the queue-6.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 838937252ffdd6bc3066e55f6f74d752c42d840e
Author: Yafang Shao <laoar.shao@xxxxxxxxx>
Date:   Thu Jul 13 02:56:41 2023 +0000

    bpf: Fix an error in verifying a field in a union
    
    [ Upstream commit 33937607efa050d9e237e0c4ac4ada02d961c466 ]
    
    We are utilizing BPF LSM to monitor BPF operations within our container
    environment. When we add support for raw_tracepoint, it hits below
    error.
    
    ; (const void *)attr->raw_tracepoint.name);
    27: (79) r3 = *(u64 *)(r2 +0)
    access beyond the end of member map_type (mend:4) in struct (anon) with off 0 size 8
    
    It can be reproduced with below BPF prog.
    
    SEC("lsm/bpf")
    int BPF_PROG(bpf_audit, int cmd, union bpf_attr *attr, unsigned int size)
    {
            switch (cmd) {
            case BPF_RAW_TRACEPOINT_OPEN:
                    bpf_printk("raw_tracepoint is %s", attr->raw_tracepoint.name);
                    break;
            default:
                    break;
            }
            return 0;
    }
    
    The reason is that when accessing a field in a union, such as bpf_attr,
    if the field is located within a nested struct that is not the first
    member of the union, it can result in incorrect field verification.
    
      union bpf_attr {
          struct {
              __u32 map_type; <<<< Actually it will find that field.
              __u32 key_size;
              __u32 value_size;
             ...
          };
          ...
          struct {
              __u64 name;    <<<< We want to verify this field.
              __u32 prog_fd;
          } raw_tracepoint;
      };
    
    Considering the potential deep nesting levels, finding a perfect
    solution to address this issue has proven challenging. Therefore, I
    propose a solution where we simply skip the verification process if the
    field in question is located within a union.
    
    Fixes: 7e3617a72df3 ("bpf: Add array support to btf_struct_access")
    Signed-off-by: Yafang Shao <laoar.shao@xxxxxxxxx>
    Link: https://lore.kernel.org/r/20230713025642.27477-4-laoar.shao@xxxxxxxxx
    Signed-off-by: Alexei Starovoitov <ast@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
index fb78bb26786fc..7582ec4fd4131 100644
--- a/kernel/bpf/btf.c
+++ b/kernel/bpf/btf.c
@@ -5788,7 +5788,7 @@ static int btf_struct_walk(struct bpf_verifier_log *log, const struct btf *btf,
 		 * that also allows using an array of int as a scratch
 		 * space. e.g. skb->cb[].
 		 */
-		if (off + size > mtrue_end) {
+		if (off + size > mtrue_end && !(*flag & PTR_UNTRUSTED)) {
 			bpf_log(log,
 				"access beyond the end of member %s (mend:%u) in struct %s with off %u size %u\n",
 				mname, mtrue_end, tname, off, size);