[bpf-next,0/2] bpf: fix for use after free bug in inline_bpf_loop

Message

Eduard Zingerman June 24, 2022, 2:06 a.m. UTC

These two patches fix the use after free bug in inline_bpf_loop()
reported by Dan Carpenter. The fix for verifier.c and the test case in
test_verifier.c are split into separate commits.

While the first patch is necessary, I'm not sure about the second. The
test case is somewhat fragile because of the following line:

	const int len = getpagesize() - 25;

Here 25 is a magical number that allows env->prog to fit in one page
before bpf_loop inlining and don't fit after the bpf_loop
inlining. I'd prefer to use sizeof(struct bpf_prog) instead of this
constant, but definition of the struct bpf_prog is not available in
test_verifier.c.

Eduard Zingerman (2):
  bpf: fix for use after free bug in inline_bpf_loop
  selftest/bpf: test for use after free bug fix in inline_bpf_loop

 kernel/bpf/verifier.c                         |  2 +-
 tools/testing/selftests/bpf/test_verifier.c   | 39 +++++++++++++++++++
 .../selftests/bpf/verifier/bpf_loop_inline.c  | 11 ++++++
 3 files changed, 51 insertions(+), 1 deletion(-)

Comments

[e-mail] June 24, 2022, 3:10 p.m. UTC | #1

Hello:

This series was applied to bpf/bpf-next.git (master)
by Daniel Borkmann <[e-mail]>:

On Fri, 24 Jun 2022 05:06:11 +0300 you wrote:
> These two patches fix the use after free bug in inline_bpf_loop()
> reported by Dan Carpenter. The fix for verifier.c and the test case in
> test_verifier.c are split into separate commits.
> 
> While the first patch is necessary, I'm not sure about the second. The
> test case is somewhat fragile because of the following line:
> 
> [...]

Here is the summary with links:
  - [bpf-next,1/2] bpf: fix for use after free bug in inline_bpf_loop
    https://git.kernel.org/bpf/bpf-next/c/fb4e3b33e3e7
  - [bpf-next,2/2] selftest/bpf: test for use after free bug fix in inline_bpf_loop
    https://git.kernel.org/bpf/bpf-next/c/41188e9e9def

You are awesome, thank you!