tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

bpf: Explicitly check accesses to bpf_sock_addr

Syzkaller found a kernel warning on the following sock_addr program:

0: r0 = 0
1: r2 = *(u32 *)(r1 +60)
2: exit

which triggers:

verifier bug: error during ctx access conversion (0)

This is happening because offset 60 in bpf_sock_addr corresponds to an
implicit padding of 4 bytes, right after msg_src_ip4. Access to this
padding isn't rejected in sock_addr_is_valid_access and it thus later
fails to convert the access.

This patch fixes it by explicitly checking the various fields of
bpf_sock_addr in sock_addr_is_valid_access.

I checked the other ctx structures and is_valid_access functions and
didn't find any other similar cases. Other cases of (properly handled)
padding are covered in new tests in a subsequent patch.

Fixes: 1cedee13d25a ("bpf: Hooks for sys_sendmsg")
Reported-by: syzbot+136ca59d411f92e821b7@syzkaller.appspotmail.com
Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Closes: https://syzkaller.appspot.com/bug?extid=136ca59d411f92e821b7
Link: https://lore.kernel.org/bpf/b58609d9490649e76e584b0361da0abd3c2c1779.1758094761.git.paul.chaignon@gmail.com

authored by

Paul Chaignon and committed by
Daniel Borkmann 6fabca2f b13448dd

+10 -6
+10 -6
net/core/filter.c
··· 9284 9284 return false; 9285 9285 info->reg_type = PTR_TO_SOCKET; 9286 9286 break; 9287 - default: 9288 - if (type == BPF_READ) { 9289 - if (size != size_default) 9290 - return false; 9291 - } else { 9287 + case bpf_ctx_range(struct bpf_sock_addr, user_family): 9288 + case bpf_ctx_range(struct bpf_sock_addr, family): 9289 + case bpf_ctx_range(struct bpf_sock_addr, type): 9290 + case bpf_ctx_range(struct bpf_sock_addr, protocol): 9291 + if (type != BPF_READ) 9292 9292 return false; 9293 - } 9293 + if (size != size_default) 9294 + return false; 9295 + break; 9296 + default: 9297 + return false; 9294 9298 } 9295 9299 9296 9300 return true;