From bd21ec094a10e3cd4945b11f969c226766c33c02 Mon Sep 17 00:00:00 2001 From: Ben Hutchings Date: Sat, 23 Dec 2017 00:29:56 +0000 Subject: [PATCH] bpf/verifier: Fix states_equal() comparison of pointer and UNKNOWN An UNKNOWN_VALUE is not supposed to be derived from a pointer, unless pointer leaks are allowed. Therefore, states_equal() must not treat a state with a pointer in a register as "equal" to a state with an UNKNOWN_VALUE in that register. This appears to have been fixed upstream as part of commit f1174f77b50c "bpf/verifier: rework value tracking", and can be detected by the bpf/verifier sub-test "pointer/scalar confusion in state equality check (way 1)" in mainline. Signed-off-by: Ben Hutchings Cc: Edward Cree Cc: Jann Horn Cc: Alexei Starovoitov Gbp-Pq: Topic bugfix/all Gbp-Pq: Name bpf-verifier-fix-states_equal-comparison-of-pointer-and-unknown.patch --- kernel/bpf/verifier.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 8b1ebe4c6aba..d7eeebfafe8d 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -2722,11 +2722,12 @@ static bool states_equal(struct bpf_verifier_env *env, /* If we didn't map access then again we don't care about the * mismatched range values and it's ok if our old type was - * UNKNOWN and we didn't go to a NOT_INIT'ed reg. + * UNKNOWN and we didn't go to a NOT_INIT'ed or pointer reg. */ if (rold->type == NOT_INIT || (!varlen_map_access && rold->type == UNKNOWN_VALUE && - rcur->type != NOT_INIT)) + rcur->type != NOT_INIT && + !__is_pointer_value(env->allow_ptr_leaks, rcur))) continue; /* Don't care about the reg->id in this case. */ -- 2.30.2