Files
linux/include/linux
Daniel Borkmann a2c8dc7e21 bpf: Fix helper writes to read-only maps
[ Upstream commit 32556ce93bc45c730829083cb60f95a2728ea48b ]

Lonial found an issue that despite user- and BPF-side frozen BPF map
(like in case of .rodata), it was still possible to write into it from
a BPF program side through specific helpers having ARG_PTR_TO_{LONG,INT}
as arguments.

In check_func_arg() when the argument is as mentioned, the meta->raw_mode
is never set. Later, check_helper_mem_access(), under the case of
PTR_TO_MAP_VALUE as register base type, it assumes BPF_READ for the
subsequent call to check_map_access_type() and given the BPF map is
read-only it succeeds.

The helpers really need to be annotated as ARG_PTR_TO_{LONG,INT} | MEM_UNINIT
when results are written into them as opposed to read out of them. The
latter indicates that it's okay to pass a pointer to uninitialized memory
as the memory is written to anyway.

However, ARG_PTR_TO_{LONG,INT} is a special case of ARG_PTR_TO_FIXED_SIZE_MEM
just with additional alignment requirement. So it is better to just get
rid of the ARG_PTR_TO_{LONG,INT} special cases altogether and reuse the
fixed size memory types. For this, add MEM_ALIGNED to additionally ensure
alignment given these helpers write directly into the args via *<ptr> = val.
The .arg*_size has been initialized reflecting the actual sizeof(*<ptr>).

MEM_ALIGNED can only be used in combination with MEM_FIXED_SIZE annotated
argument types, since in !MEM_FIXED_SIZE cases the verifier does not know
the buffer size a priori and therefore cannot blindly write *<ptr> = val.

Fixes: 57c3bb725a ("bpf: Introduce ARG_PTR_TO_{INT,LONG} arg types")
Reported-by: Lonial Con <kongln9170@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: Shung-Hsi Yu <shung-hsi.yu@suse.com>
Link: https://lore.kernel.org/r/20240913191754.13290-3-daniel@iogearbox.net
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-10-04 16:29:23 +02:00
..
2022-11-04 12:59:25 +02:00
2023-06-16 12:27:04 -06:00
2023-05-20 19:20:30 +02:00
2024-06-12 11:12:49 +02:00
2023-08-23 08:21:37 +01:00
2024-07-25 09:50:47 +02:00
2022-07-05 20:25:39 +02:00
2023-09-11 15:24:16 -07:00
2023-01-19 14:46:25 +01:00
2024-06-12 11:11:38 +02:00
2024-05-25 16:22:55 +02:00
2024-10-04 16:29:23 +02:00
2023-05-31 13:06:57 +02:00
2022-09-26 10:13:13 -07:00
2023-01-13 11:48:15 +01:00
2024-07-05 09:34:04 +02:00
2023-05-25 09:26:19 +02:00
2023-04-17 18:01:23 +02:00
2023-01-19 16:07:40 +01:00
2023-03-06 15:49:07 -06:00
2024-03-26 18:20:13 -04:00
2023-01-29 15:18:33 -07:00
2023-01-29 15:18:33 -07:00
2024-08-29 17:33:31 +02:00
2023-03-19 10:02:04 -07:00
2023-06-13 16:49:23 +02:00
2023-05-01 17:50:18 -07:00
2023-08-04 11:02:46 +01:00
2022-06-27 06:29:12 -06:00
2022-09-08 12:59:00 -06:00
2022-09-26 13:31:20 +02:00
2023-07-14 13:47:07 -06:00
2022-07-17 17:31:38 -07:00
2022-10-03 14:03:19 -07:00
2024-06-16 13:47:41 +02:00
2024-06-12 11:12:52 +02:00
2023-08-15 14:57:25 -07:00
2023-08-18 10:18:59 -07:00
2022-06-19 10:38:26 +01:00
2022-07-27 14:04:52 +02:00
2023-01-19 09:24:30 +01:00
2022-08-02 12:34:04 -04:00
2023-06-20 20:17:10 -07:00
2024-04-03 15:28:29 +02:00
2022-10-03 17:34:32 -07:00
2022-09-26 19:46:27 -07:00
2023-08-18 10:12:25 -07:00
2023-06-23 16:59:30 -07:00
2024-08-11 12:47:15 +02:00
2023-06-05 09:36:39 +02:00
2023-07-18 10:07:47 +02:00
2023-03-06 09:57:07 +01:00
2022-12-20 03:13:45 +01:00
2023-08-12 09:18:47 -07:00
2024-06-12 11:11:56 +02:00
2023-10-06 11:01:23 +02:00
2023-10-06 11:01:23 +02:00
2023-05-23 12:55:12 -07:00
2024-05-17 12:01:59 +02:00
2023-07-15 11:34:49 -07:00
2023-06-23 16:59:28 -07:00
2023-01-19 15:01:19 +01:00
2023-05-18 19:52:31 -07:00
2023-06-11 18:22:47 +02:00
2024-08-29 17:33:23 +02:00
2023-06-05 09:36:39 +02:00
2023-11-28 17:19:38 +00:00
2024-01-31 16:18:47 -08:00
2022-09-07 12:42:25 +01:00
2023-08-21 13:37:26 -07:00
2022-09-29 15:20:29 +02:00
2023-08-06 08:24:55 +01:00
2023-08-07 17:55:54 +00:00
2023-08-11 21:12:47 +02:00
2023-03-16 13:08:39 -07:00
2022-08-28 16:52:28 +01:00
2023-03-23 17:25:46 +01:00
2023-08-24 13:27:47 -05:00
2023-04-05 20:03:01 -07:00
2023-04-21 03:02:34 -04:00
2023-08-21 14:52:16 +02:00
2022-10-24 12:12:32 -07:00
2023-08-21 13:37:27 -07:00