xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
5f4566498dee5e38e36a015a968c22ed21568f0b
android_kernel_xiaomi_sm8450/kernel
History
Martin KaFai Lau 5f4566498d bpf: Fix narrow load on a bpf_sock returned from sk_lookup() 
By adding this test to test_verifier:
{
	"reference tracking: access sk->src_ip4 (narrow load)",
	.insns = {
	BPF_SK_LOOKUP,
	BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
	BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
	BPF_LDX_MEM(BPF_H, BPF_REG_2, BPF_REG_0, offsetof(struct bpf_sock, src_ip4) + 2),
	BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
	BPF_EMIT_CALL(BPF_FUNC_sk_release),
	BPF_EXIT_INSN(),
	},
	.prog_type = BPF_PROG_TYPE_SCHED_CLS,
	.result = ACCEPT,
},

The above test loads 2 bytes from sk->src_ip4 where
sk is obtained by bpf_sk_lookup_tcp().

It hits an internal verifier error from convert_ctx_accesses():
[root@arch-fb-vm1 bpf]# ./test_verifier 665 665
Failed to load prog 'Invalid argument'!
0: (b7) r2 = 0
1: (63) *(u32 *)(r10 -8) = r2
2: (7b) *(u64 *)(r10 -16) = r2
3: (7b) *(u64 *)(r10 -24) = r2
4: (7b) *(u64 *)(r10 -32) = r2
5: (7b) *(u64 *)(r10 -40) = r2
6: (7b) *(u64 *)(r10 -48) = r2
7: (bf) r2 = r10
8: (07) r2 += -48
9: (b7) r3 = 36
10: (b7) r4 = 0
11: (b7) r5 = 0
12: (85) call bpf_sk_lookup_tcp#84
13: (bf) r6 = r0
14: (15) if r0 == 0x0 goto pc+3
 R0=sock(id=1,off=0,imm=0) R6=sock(id=1,off=0,imm=0) R10=fp0,call_-1 fp-8=????0000 fp-16=0000mmmm fp-24=mmmmmmmm fp-32=mmmmmmmm fp-40=mmmmmmmm fp-48=mmmmmmmm refs=1
15: (69) r2 = *(u16 *)(r0 +26)
16: (bf) r1 = r6
17: (85) call bpf_sk_release#86
18: (95) exit

from 14 to 18: safe
processed 20 insns (limit 131072), stack depth 48
bpf verifier is misconfigured
Summary: 0 PASSED, 0 SKIPPED, 1 FAILED

The bpf_sock_is_valid_access() is expecting src_ip4 can be narrowly
loaded (meaning load any 1 or 2 bytes of the src_ip4) by
marking info->ctx_field_size.  However, this marked
ctx_field_size is not used.  This patch fixes it.

Due to the recent refactoring in test_verifier,
this new test will be added to the bpf-next branch
(together with the bpf_tcp_sock patchset)
to avoid merge conflict.

Fixes: c64b798328 ("bpf: Add PTR_TO_SOCKET verifier type")
Cc: Joe Stringer <joe@wand.net.nz>
Signed-off-by: Martin KaFai Lau <kafai@fb.com>
Acked-by: Joe Stringer <joe@wand.net.nz>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2019-02-10 19:37:41 -08:00
..
bpf
bpf: Fix narrow load on a bpf_sock returned from sk_lookup()
2019-02-10 19:37:41 -08:00
cgroup
bpf, cgroups: clean up kerneldoc warnings
2019-01-31 10:32:01 +01:00
configs
kvm_config: add CONFIG_VIRTIO_MENU
2018-10-24 20:55:56 -04:00
debug
kdb: use bool for binary state indicators
2018-12-30 08:31:52 +00:00
dma
swiotlb: clear io_tlb_start and io_tlb_end in swiotlb_exit
2019-01-16 09:59:17 -05:00
events
Remove 'type' argument from access_ok() function
2019-01-03 18:57:57 -08:00
gcov
gcov: remove CONFIG_GCOV_FORMAT_AUTODETECT
2018-06-08 18:56:02 +09:00
irq
genirq/irqdesc: Fix double increment in alloc_descs()
2019-01-18 00:43:09 +01:00
livepatch
livepatch: Replace synchronize_sched() with synchronize_rcu()
2018-12-01 12:38:50 -08:00
locking
locking/rwsem: Fix (possible) missed wakeup
2019-01-21 11:15:39 +01:00
power
mm: convert totalram_pages and totalhigh_pages variables to atomic
2018-12-28 12:11:47 -08:00
printk
Remove 'type' argument from access_ok() function
2019-01-03 18:57:57 -08:00
rcu
rcutorture: Don't do busted forward-progress testing
2018-12-01 12:45:42 -08:00
sched
sched/wake_q: Fix wakeup ordering for wake_q
2019-01-21 11:15:37 +01:00
time
posix-cpu-timers: Unbreak timer rearming
2019-01-15 16:34:37 +01:00
trace
tracing/kprobes: Fix NULL pointer dereference in trace_kprobe_create()
2019-01-15 11:33:45 -05:00
.gitignore
…
acct.c
…
async.c
kernel/async.c: revert "async: simplify lowest_in_progress()"
2018-02-06 18:32:44 -08:00
audit_fsnotify.c
audit: minimize our use of audit_log_format()
2018-11-26 18:40:00 -05:00
audit_tree.c
audit: minimize our use of audit_log_format()
2018-11-26 18:40:00 -05:00
audit_watch.c
audit: minimize our use of audit_log_format()
2018-11-26 18:40:00 -05:00
audit.c
audit: remove duplicated include from audit.c
2018-12-14 12:09:30 -05:00
audit.h
audit: use current whenever possible
2018-11-26 18:41:21 -05:00
auditfilter.c
audit: rename FILTER_TYPE to FILTER_EXCLUDE
2018-06-19 10:39:54 -04:00
auditsc.c
audit: use current whenever possible
2018-11-26 18:41:21 -05:00
backtracetest.c
…
bounds.c
kbuild: fix kernel/bounds.c 'W=1' warning
2018-10-31 08:54:14 -07:00
capability.c
…
compat.c
make 'user_access_begin()' do 'access_ok()'
2019-01-04 12:56:09 -08:00
configs.c
…
context_tracking.c
…
cpu_pm.c
…
cpu.c
x86/speculation: Rework SMT state change
2018-11-28 11:57:07 +01:00
crash_core.c
kernel/crash_core.c: print timestamp using time64_t
2018-08-22 10:52:47 -07:00
crash_dump.c
…
cred.c
cred: export get_task_cred().
2018-12-19 13:52:44 -05:00
delayacct.c
delayacct: track delays from thrashing cache pages
2018-10-26 16:26:32 -07:00
dma.c
proc: introduce proc_create_single{,_data}
2018-05-16 07:23:35 +02:00
elfcore.c
…
exec_domain.c
proc: introduce proc_create_single{,_data}
2018-05-16 07:23:35 +02:00
exit.c
sched/wait: Fix rcuwait_wake_up() ordering
2019-01-21 11:15:36 +01:00
extable.c
extable: Make init_kernel_text() global
2018-02-21 16:54:06 +01:00
fail_function.c
kernel/fail_function.c: remove meaningless null pointer check before debugfs_remove_recursive
2018-10-31 08:54:12 -07:00
fork.c
Merge branch 'akpm' (patches from Andrew)
2019-01-08 18:58:29 -08:00
freezer.c
PM / reboot: Eliminate race between reboot and suspend
2018-08-06 12:35:20 +02:00
futex.c
futex: Fix (possible) missed wakeup
2019-01-21 11:15:38 +01:00
groups.c
…
hung_task.c
kernel/hung_task.c: break RCU locks based on jiffies
2019-01-04 13:13:45 -08:00
iomem.c
memremap: split devm_memremap_pages() and memremap() infrastructure
2018-05-15 23:08:33 -07:00
irq_work.c
…
jump_label.c
jump_label: move 'asm goto' support test to Kconfig
2019-01-06 09:46:51 +09:00
kallsyms.c
kallsyms: reduce size a little on 64-bit
2018-09-10 22:54:33 +09:00
kcmp.c
…
Kconfig.freezer
…
Kconfig.hz
…
Kconfig.locks
bpf: introduce bpf_spin_lock
2019-02-01 20:55:38 +01:00
Kconfig.preempt
kconfig: warn no new line at end of file
2018-12-15 17:44:35 +09:00
kcov.c
kernel/kcov.c: mark write_comp_data() as notrace
2019-01-04 13:13:47 -08:00
kexec_core.c
mm: convert totalram_pages and totalhigh_pages variables to atomic
2018-12-28 12:11:47 -08:00
kexec_file.c
kexec_file: kexec_walk_memblock() only walks a dedicated region at kdump
2018-12-06 14:38:50 +00:00
kexec_internal.h
…
kexec.c
kexec: add call to LSM hook in original kexec_load syscall
2018-07-16 12:31:57 -07:00
kmod.c
…
kprobes.c
Merge branch 'perf-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2018-12-26 14:45:18 -08:00
ksysfs.c
…
kthread.c
Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2018-08-13 11:25:07 -07:00
latencytop.c
…
Makefile
kbuild: change filechk to surround the given command with { }
2019-01-06 09:46:51 +09:00
memremap.c
mm/hmm: fix memremap.h, move dev_page_fault_t callback to hmm
2018-12-28 12:11:52 -08:00
module_signing.c
modsign: use all trusted keys to verify module signature
2018-11-07 14:41:41 +01:00
module-internal.h
modsign: log module name in the event of an error
2018-07-02 11:36:17 +02:00
module.c
jump_label: move 'asm goto' support test to Kconfig
2019-01-06 09:46:51 +09:00
notifier.c
…
nsproxy.c
…
padata.c
padata: clean an indentation issue, remove extraneous space
2018-11-16 14:11:04 +08:00
panic.c
kernel/sysctl: add panic_print into sysctl
2019-01-04 13:13:47 -08:00
params.c
kernel/params.c: downgrade warning for unsafe parameters
2018-04-11 10:28:37 -07:00
pid_namespace.c
signal: Use group_send_sig_info to kill all processes in a pid namespace
2018-09-16 16:08:25 +02:00
pid.c
Fix failure path in alloc_pid()
2018-12-28 12:42:30 -08:00
profile.c
mm: remove include/linux/bootmem.h
2018-10-31 08:54:16 -07:00
ptrace.c
Remove 'type' argument from access_ok() function
2019-01-03 18:57:57 -08:00
range.c
…
reboot.c
kernel/reboot.c: export pm_power_off_prepare
2018-09-11 16:13:24 +01:00
relay.c
kernel/relay.c: change return type to vm_fault_t
2018-06-15 07:55:24 +09:00
resource.c
kernel, resource: check for IORESOURCE_SYSRAM in release_mem_region_adjustable
2018-12-28 12:11:49 -08:00
rseq.c
Remove 'type' argument from access_ok() function
2019-01-03 18:57:57 -08:00
seccomp.c
seccomp: fix UAF in user-trap code
2019-01-15 09:43:12 -08:00
signal.c
Remove 'type' argument from access_ok() function
2019-01-03 18:57:57 -08:00
smp.c
smp,cpumask: introduce on_each_cpu_cond_mask
2018-10-09 16:51:11 +02:00
smpboot.c
smpboot: Remove cpumask from the API
2018-07-03 09:20:44 +02:00
smpboot.h
…
softirq.c
Merge branch 'irq-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2018-10-25 11:43:47 -07:00
stackleak.c
stackleak: Mark stackleak_track_stack() as notrace
2018-12-05 19:31:44 -08:00
stacktrace.c
…
stop_machine.c
Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2018-08-13 11:25:07 -07:00
sys_ni.c
y2038: socket: Add compat_sys_recvmmsg_time64
2018-12-18 16:13:04 +01:00
sys.c
kernel/sys.c: Clarify that UNAME26 does not generate unique versions anymore
2019-01-14 10:38:03 +12:00
sysctl_binary.c
kernel/sysctl: add panic_print into sysctl
2019-01-04 13:13:47 -08:00
sysctl.c
kernel/sysctl: add panic_print into sysctl
2019-01-04 13:13:47 -08:00
task_work.c
…
taskstats.c
pids: introduce find_get_task_by_vpid() helper
2018-02-06 18:32:46 -08:00
test_kprobes.c
kprobes: Remove jprobe API implementation
2018-06-21 12:33:05 +02:00
torture.c
torture: Remove unnecessary "ret" variables
2018-12-01 12:45:35 -08:00
tracepoint.c
tracing: Replace synchronize_sched() and call_rcu_sched()
2018-11-27 09:21:41 -08:00
tsacct.c
…
ucount.c
headers: untangle kmemleak.h from mm.h
2018-04-05 21:36:27 -07:00
uid16.c
fs: add do_fchownat(), ksys_fchown() helpers and ksys_{,l}chown() wrappers
2018-04-02 20:15:59 +02:00
uid16.h
kernel: provide ksys_*() wrappers for syscalls called by kernel/uid16.c
2018-04-02 20:15:30 +02:00
umh.c
umh: add exit routine for UMH process
2019-01-11 18:05:40 -08:00
up.c
smp,cpumask: introduce on_each_cpu_cond_mask
2018-10-09 16:51:11 +02:00
user_namespace.c
userns: also map extents in the reverse map to kernel IDs
2018-11-07 23:51:16 -06:00
user-return-notifier.c
…
user.c
userns: use irqsave variant of refcount_dec_and_lock()
2018-08-22 10:52:47 -07:00
utsname_sysctl.c
sys: don't hold uts_sem while accessing userspace memory
2018-08-11 02:05:53 -05:00
utsname.c
uts: create "struct uts_namespace" from kmem_cache
2018-04-11 10:28:35 -07:00
watchdog_hld.c
watchdog: Mark watchdog touch functions as notrace
2018-08-30 12:56:40 +02:00
watchdog.c
watchdog: Mark watchdog touch functions as notrace
2018-08-30 12:56:40 +02:00
workqueue_internal.h
workqueue: Set worker->desc to workqueue name by default
2018-05-18 08:47:13 -07:00
workqueue.c
workqueue: Replace call_rcu_sched() with call_rcu()
2018-11-27 09:21:44 -08:00