Patch "bpf: enforce precision of R0 on callback return" has been added to the 6.6-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    bpf: enforce precision of R0 on callback return

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     bpf-enforce-precision-of-r0-on-callback-return.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 76e6b8bf975af1cd84cc8d6d7cc744a0789ba37d
Author: Andrii Nakryiko <andrii@xxxxxxxxxx>
Date:   Sat Dec 2 09:56:57 2023 -0800

    bpf: enforce precision of R0 on callback return
    
    [ Upstream commit 0acd03a5bd188b0c501d285d938439618bd855c4 ]
    
    Given verifier checks actual value, r0 has to be precise, so we need to
    propagate precision properly. r0 also has to be marked as read,
    otherwise subsequent state comparisons will ignore such register as
    unimportant and precision won't really help here.
    
    Fixes: 69c087ba6225 ("bpf: Add bpf_for_each_map_elem() helper")
    Acked-by: Eduard Zingerman <eddyz87@xxxxxxxxx>
    Acked-by: Shung-Hsi Yu <shung-hsi.yu@xxxxxxxx>
    Signed-off-by: Andrii Nakryiko <andrii@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/20231202175705.885270-4-andrii@xxxxxxxxxx
    Signed-off-by: Alexei Starovoitov <ast@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 824531d4c262..2deae0db03e8 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -9284,6 +9284,13 @@ static int prepare_func_exit(struct bpf_verifier_env *env, int *insn_idx)
 			verbose(env, "R0 not a scalar value\n");
 			return -EACCES;
 		}
+
+		/* we are going to rely on register's precise value */
+		err = mark_reg_read(env, r0, r0->parent, REG_LIVE_READ64);
+		err = err ?: mark_chain_precision(env, BPF_REG_0);
+		if (err)
+			return err;
+
 		if (!tnum_in(range, r0->var_off)) {
 			verbose_invalid_scalar(env, r0, &range, "callback return", "R0");
 			return -EINVAL;




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux