27 lines
1023 B
Diff
27 lines
1023 B
Diff
From: Jann Horn <jannh@google.com>
|
|
Date: Mon, 18 Dec 2017 20:11:57 -0800
|
|
Subject: [5/9] bpf: fix missing error return in check_stack_boundary()
|
|
Origin: https://git.kernel.org/linus/ea25f914dc164c8d56b36147ecc86bc65f83c469
|
|
|
|
Prevent indirect stack accesses at non-constant addresses, which would
|
|
permit reading and corrupting spilled pointers.
|
|
|
|
Fixes: f1174f77b50c ("bpf/verifier: rework value tracking")
|
|
Signed-off-by: Jann Horn <jannh@google.com>
|
|
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
|
|
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
|
|
---
|
|
kernel/bpf/verifier.c | 1 +
|
|
1 file changed, 1 insertion(+)
|
|
|
|
--- a/kernel/bpf/verifier.c
|
|
+++ b/kernel/bpf/verifier.c
|
|
@@ -1320,6 +1320,7 @@ static int check_stack_boundary(struct b
|
|
tnum_strn(tn_buf, sizeof(tn_buf), regs[regno].var_off);
|
|
verbose(env, "invalid variable stack read R%d var_off=%s\n",
|
|
regno, tn_buf);
|
|
+ return -EACCES;
|
|
}
|
|
off = regs[regno].off + regs[regno].var_off.value;
|
|
if (off >= 0 || off < -MAX_BPF_STACK || off + access_size > 0 ||
|