github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 01:32:21 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

BPF fixes:

Browse Source 
- Fix tcp_bpf_sendmsg() error path mistaking a concurrently-freed
   sk_psock->cork for the local temporary message and freeing it
   again. (Chengfeng Ye)
 
 - Reject passing scalar NULL to nonnull arg of a global subprog.
   Previously the verifier did not account for the cases directly
   passing scalars to a global subprog, e.g.: 'global_func(0);'
   would pass even if 'global_func' argument was marked nonnull.
   (Amery Hung)
 
 Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRINyQBqoQUC24dy5htleuBPyPTXgUCamPsBwAKCRBtleuBPyPT
 Xo/uAP0YR6/9em1W/sZnss6Wkwfwd9NdmmlrJqSlt7aq+A+W7AD/V5HbigM4pJ76
 CZFkKvnzhhU3dSXm/dBT1/GGJbL4pwo=
 =uzKM
 -----END PGP SIGNATURE-----

Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

Pull bpf fixes from Eduard Zingerman:

 - Fix tcp_bpf_sendmsg() error path mistaking a concurrently-freed
   sk_psock->cork for the local temporary message and freeing it again
   (Chengfeng Ye)

 - Reject passing scalar NULL to nonnull arg of a global subprog.

   Previously the verifier did not account for the cases directly
   passing scalars to a global subprog, e.g.: 'global_func(0);' would
   pass even if 'global_func' argument was marked nonnull (Amery Hung)

* tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf:
  bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()
  selftests/bpf: Test passing scalar NULL to nonnull global subprog
  bpf: Reject passing scalar NULL to nonnull arg of a global subprog
This commit is contained in:
Linus Torvalds 2026-07-24 19:31:12 -07:00
commit ae453eef92
3 changed files with 13 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
kernel/bpf/verifier.c
View File

@ -9189,7 +9189,8 @@ static int btf_check_func_arg_match(struct bpf_verifier_env *env, int subprog,
return ret;
if (check_mem_reg(env, reg, argno, arg->mem_size))
return -EINVAL;
if (!(arg->arg_type & PTR_MAYBE_NULL) && (reg->type & PTR_MAYBE_NULL)) {
if (!(arg->arg_type & PTR_MAYBE_NULL) &&
(type_may_be_null(reg->type) || bpf_register_is_null(reg))) {
bpf_log(log, "%s is expected to be non-NULL\n",
reg_arg_name(env, argno));
return -EINVAL;

2
net/ipv4/tcp_bpf.c
View File

@ -604,7 +604,7 @@ static int tcp_bpf_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
wait_for_memory:
err = sk_stream_wait_memory(sk, &timeo);
if (err) {
if (msg_tx && msg_tx != psock->cork)
if (msg_tx == &tmp)
sk_msg_free(sk, msg_tx);
goto out_err;
}

10
tools/testing/selftests/bpf/progs/verifier_global_subprogs.c
View File

@ -185,6 +185,16 @@ int arg_tag_nonnull_ptr_good(void *ctx)
return subprog_nonnull_ptr_good(&x, &y);
}
SEC("?raw_tp")
__failure __log_level(2)
__msg("R1 is expected to be non-NULL")
int arg_tag_nonnull_ptr_null_bad(void *ctx)
{
int y = 74;
return subprog_nonnull_ptr_good(NULL, &y);
}
/* this global subprog can be now called from many types of entry progs, each
* with different context type
*/