summaryrefslogtreecommitdiff
path: root/kernel
diff options
context:
space:
mode:
authorKP Singh <kpsingh@google.com>2020-03-30 16:42:46 +0200
committerAlexei Starovoitov <ast@kernel.org>2020-03-30 13:28:02 -0700
commitf50b49a0bfcaf53e6394a873b588bc4cca2aab78 (patch)
tree20d9df623fc83ec508db1cfe8586cf961061a262 /kernel
parent0fc31b10cfb7e5158bafb9d30839fbc9241c40c4 (diff)
bpf: btf: Fix arg verification in btf_ctx_access()
The bounds checking for the arguments accessed in the BPF program breaks when the expected_attach_type is not BPF_TRACE_FEXIT, BPF_LSM_MAC or BPF_MODIFY_RETURN resulting in no check being done for the default case (the programs which do not receive the return value of the attached function in its arguments) when the index of the argument being accessed is equal to the number of arguments (nr_args). This was a result of a misplaced "else if" block introduced by the Commit 6ba43b761c41 ("bpf: Attachment verification for BPF_MODIFY_RETURN") Fixes: 6ba43b761c41 ("bpf: Attachment verification for BPF_MODIFY_RETURN") Reported-by: Jann Horn <jannh@google.com> Signed-off-by: KP Singh <kpsingh@google.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://lore.kernel.org/bpf/20200330144246.338-1-kpsingh@chromium.org
Diffstat (limited to 'kernel')
-rw-r--r--kernel/bpf/btf.c24
1 files changed, 17 insertions, 7 deletions
diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
index de335cd386f0..3b6dcfb6ea49 100644
--- a/kernel/bpf/btf.c
+++ b/kernel/bpf/btf.c
@@ -3709,9 +3709,16 @@ bool btf_ctx_access(int off, int size, enum bpf_access_type type,
nr_args--;
}
+ if (arg > nr_args) {
+ bpf_log(log, "func '%s' doesn't have %d-th argument\n",
+ tname, arg + 1);
+ return false;
+ }
+
if (arg == nr_args) {
- if (prog->expected_attach_type == BPF_TRACE_FEXIT ||
- prog->expected_attach_type == BPF_LSM_MAC) {
+ switch (prog->expected_attach_type) {
+ case BPF_LSM_MAC:
+ case BPF_TRACE_FEXIT:
/* When LSM programs are attached to void LSM hooks
* they use FEXIT trampolines and when attached to
* int LSM hooks, they use MODIFY_RETURN trampolines.
@@ -3728,7 +3735,8 @@ bool btf_ctx_access(int off, int size, enum bpf_access_type type,
if (!t)
return true;
t = btf_type_by_id(btf, t->type);
- } else if (prog->expected_attach_type == BPF_MODIFY_RETURN) {
+ break;
+ case BPF_MODIFY_RETURN:
/* For now the BPF_MODIFY_RETURN can only be attached to
* functions that return an int.
*/
@@ -3742,17 +3750,19 @@ bool btf_ctx_access(int off, int size, enum bpf_access_type type,
btf_kind_str[BTF_INFO_KIND(t->info)]);
return false;
}
+ break;
+ default:
+ bpf_log(log, "func '%s' doesn't have %d-th argument\n",
+ tname, arg + 1);
+ return false;
}
- } else if (arg >= nr_args) {
- bpf_log(log, "func '%s' doesn't have %d-th argument\n",
- tname, arg + 1);
- return false;
} else {
if (!t)
/* Default prog with 5 args */
return true;
t = btf_type_by_id(btf, args[arg].type);
}
+
/* skip modifiers */
while (btf_type_is_modifier(t))
t = btf_type_by_id(btf, t->type);