Ksawlii/kernel_samsung_a53x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
kernel_samsung_a53x/kernel
History
Andrei Matei 34a011e2b1 bpf: Fix verification of indirect var-off stack access 
[ Upstream commit a833a17aeac73b33f79433d7cee68d5cafd71e4f ]

This patch fixes a bug around the verification of possibly-zero-sized
stack accesses. When the access was done through a var-offset stack
pointer, check_stack_access_within_bounds was incorrectly computing the
maximum-offset of a zero-sized read to be the same as the register's min
offset. Instead, we have to take in account the register's maximum
possible value. The patch also simplifies how the max offset is checked;
the check is now simpler than for min offset.

The bug was allowing accesses to erroneously pass the
check_stack_access_within_bounds() checks, only to later crash in
check_stack_range_initialized() when all the possibly-affected stack
slots are iterated (this time with a correct max offset).
check_stack_range_initialized() is relying on
check_stack_access_within_bounds() for its accesses to the
stack-tracking vector to be within bounds; in the case of zero-sized
accesses, we were essentially only verifying that the lowest possible
slot was within bounds. We would crash when the max-offset of the stack
pointer was >= 0 (which shouldn't pass verification, and hopefully is
not something anyone's code attempts to do in practice).

Thanks Hao for reporting!

Fixes: 01f810ace9ed3 ("bpf: Allow variable-offset stack access")
Reported-by: Hao Sun <sunhao.th@gmail.com>
Signed-off-by: Andrei Matei <andreimatei1@gmail.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20231207041150.229139-2-andreimatei1@gmail.com

Closes: https://lore.kernel.org/bpf/CACkBjsZGEUaRCHsmaX=h-efVogsRfK1FPxmkgb0Os_frnHiNdw@mail.gmail.com/
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-11-18 12:12:36 +01:00
..
bpf bpf: Fix verification of indirect var-off stack access 2024-11-18 12:12:36 +01:00
cgroup cgroup: Remove duplicates in cgroup v1 tasks file 2024-11-08 11:25:51 +01:00
configs Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
debug kgdb: Flush console before entering kgdb on panic 2024-11-18 11:43:15 +01:00
dma Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
entry Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
events perf: Fix perf_event_validate_size() lockdep splat 2024-11-18 12:11:57 +01:00
futex futex: Don't include process MM in futex key on no-MMU 2024-11-18 11:42:47 +01:00
gcov Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
irq genirq/generic_chip: Make irq_remove_generic_chip() irqdomain aware 2024-11-18 11:43:25 +01:00
kcsan Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
livepatch livepatch: Fix missing newline character in klp_resolve_symbols() 2024-11-18 11:43:05 +01:00
locking lockdep: Fix block chain corruption 2024-11-18 12:10:56 +01:00
power PM: hibernate: Clean up sync_read handling in snapshot_write_next() 2024-11-18 11:43:24 +01:00
printk printk: Don't allow userspace to write to /dev/kmsg 2024-11-17 17:43:00 +01:00
rcu rcu: kmemleak: Ignore kmemleak false positives when RCU-freeing objects 2024-11-18 11:43:24 +01:00
sched Revert "kernel: ems/ego: Allow CPU frequency changes to be amended before they're set" 2024-11-18 07:48:15 +01:00
time Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
trace ring-buffer: Do not record in NMI if the arch does not support cmpxchg in NMI 2024-11-18 12:12:16 +01:00
acct.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
async.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
audit.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
audit.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
audit_fsnotify.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
audit_tree.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
audit_watch.c audit: don't WARN_ON_ONCE(!current->mm) in audit_exe_compare() 2024-11-18 11:43:21 +01:00
auditfilter.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
auditsc.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
backtracetest.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
bounds.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
capability.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
cfi.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
compat.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
configs.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
context_tracking.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
cpu.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
cpu_pm.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
crash_core.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
crash_dump.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
cred.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
delayacct.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
dma.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
exec_domain.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
exit.c security: samsung: defex_lsm: nuke 2024-06-15 16:20:49 -03:00
extable.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
fail_function.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
fork.c security: samsung: defex_lsm: nuke 2024-06-15 16:20:49 -03:00
freezer.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
gen_kheaders.sh Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
groups.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
hung_task.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
iomem.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
irq_work.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
jump_label.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
kallsyms.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
kcmp.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
Kconfig.freezer Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
Kconfig.hz Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
Kconfig.locks Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
Kconfig.preempt Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
kcov.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
kexec.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
kexec_core.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
kexec_elf.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
kexec_file.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
kexec_internal.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
kheaders.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
kmod.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
kprobes.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ksysfs.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
kthread.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
latencytop.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
Makefile kernel: Use the stock defconfig for /proc/config.gz 2024-06-15 16:20:14 -03:00
module-internal.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
module.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
module_signature.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
module_signing.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
notifier.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
nsproxy.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
padata.c crypto: pcrypt - Fix hungtask for PADATA_RESET 2024-11-18 11:43:13 +01:00
panic.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
params.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
pid.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
pid_namespace.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
profile.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ptrace.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
range.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
reboot.c kernel/reboot: emergency_restart: Set correct system_state 2024-11-18 11:43:25 +01:00
regset.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
relay.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
resource.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
rseq.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
scftorture.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
scs.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
seccomp.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
signal.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
smp.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
smpboot.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
smpboot.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
softirq.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
stackleak.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
stacktrace.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
static_call.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
stop_machine.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sys.c f2fs: Add support for reporting a fake kernel version to fsck 2024-11-17 17:43:26 +01:00
sys_ni.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sysctl-test.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
sysctl.c drivers: usb: add toggle for disabling newly added USB devices 2024-10-04 20:09:29 -03:00
task_work.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
taskstats.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
test_kprobes.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
torture.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
tracepoint.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
tsacct.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
ucount.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
uid16.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
uid16.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
umh.c security: samsung: defex_lsm: nuke 2024-06-15 16:20:49 -03:00
up.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
user-return-notifier.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
user.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
user_namespace.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
usermode_driver.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
utsname.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
utsname_sysctl.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
watch_queue.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
watchdog.c watchdog: move softlockup_panic back to early_param 2024-11-18 11:43:21 +01:00
watchdog_hld.c Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00
workqueue.c Revert "workqueue: remove unused cancel_work()" 2024-11-18 12:11:11 +01:00
workqueue_internal.h Import A536BXXU9EXDC 2024-06-15 16:02:09 -03:00