Kris Van Hees 2fbd466952 bpf: Fix verifier support for validation of async callbacks ... [ Upstream commit a5bebc4f00 ] Commit bfc6bb74e4 ("bpf: Implement verifier support for validation of async callbacks.") added support for BPF_FUNC_timer_set_callback to the __check_func_call() function. The test in __check_func_call() is flaweed because it can mis-interpret a regular BPF-to-BPF pseudo-call as a BPF_FUNC_timer_set_callback callback call. Consider the conditional in the code: if (insn->code == (BPF_JMP | BPF_CALL) && insn->imm == BPF_FUNC_timer_set_callback) { The BPF_FUNC_timer_set_callback has value 170. This means that if you have a BPF program that contains a pseudo-call with an instruction delta of 170, this conditional will be found to be true by the verifier, and it will interpret the pseudo-call as a callback. This leads to a mess with the verification of the program because it makes the wrong assumptions about the nature of this call. Solution: include an explicit check to ensure that insn->src_reg == 0. This ensures that calls cannot be mis-interpreted as an async callback call. Fixes: bfc6bb74e4 ("bpf: Implement verifier support for validation of async callbacks.") Signed-off-by: Kris Van Hees <kris.van.hees@oracle.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://lore.kernel.org/bpf/20220105210150.GH1559@oracle.com Signed-off-by: Sasha Levin <sashal@kernel.org>		2022-01-27 11:03:51 +01:00
..
preload	…
Kconfig	…
Makefile	…
arraymap.c	bpf: Fix potential race in tail call compatibility check	2021-10-26 12:37:28 -07:00
bpf_inode_storage.c	…
bpf_iter.c	…
bpf_local_storage.c	…
bpf_lru_list.c	…
bpf_lru_list.h	…
bpf_lsm.c	…
bpf_struct_ops.c	…
bpf_struct_ops_types.h	…
bpf_task_storage.c	…
btf.c	bpf: Disallow BPF_LOG_KERNEL log level for bpf(BPF_BTF_LOAD)	2022-01-27 11:03:27 +01:00
cgroup.c	bpf: Forbid bpf_ktime_get_coarse_ns and bpf_timer_* in tracing progs	2021-11-25 09:49:07 +01:00
core.c	bpf: Fix potential race in tail call compatibility check	2021-10-26 12:37:28 -07:00
cpumap.c	…
devmap.c	…
disasm.c	…
disasm.h	…
dispatcher.c	…
hashtab.c	…
helpers.c	bpf: Forbid bpf_ktime_get_coarse_ns and bpf_timer_* in tracing progs	2021-11-25 09:49:07 +01:00
inode.c	…
local_storage.c	…
lpm_trie.c	…
map_in_map.c	…
map_in_map.h	…
map_iter.c	…
net_namespace.c	…
offload.c	…
percpu_freelist.c	…
percpu_freelist.h	…
prog_iter.c	…
queue_stack_maps.c	…
reuseport_array.c	…
ringbuf.c	…
stackmap.c	bpf: Fix integer overflow in prealloc_elems_and_freelist()	2021-09-30 16:17:23 +02:00
syscall.c	bpf: Fix toctou on read-only map's constant scalar tracking	2021-11-25 09:48:36 +01:00
sysfs_btf.c	…
task_iter.c	…
tnum.c	…
trampoline.c	bpf: Fixes possible race in update_prog_stats() for 32bit arches	2021-11-18 19:16:42 +01:00
verifier.c	bpf: Fix verifier support for validation of async callbacks	2022-01-27 11:03:51 +01:00