diff options
| author | Josef Bacik <josef@toxicpanda.com> | 2026-10-17 16:37:27 +0000 |
|---|---|---|
| committer | Alexei Starovoitov <ast@kernel.org> | 2026-10-17 22:01:14 +0000 |
| commit | 7fa323d77688e8b62b2f0bf6c3208a2c96d4a5e7 (patch) | |
| tree | 1e1f59fd2b265b03799124684830983a41e67914 /kernel | |
| parent | 3e6d7522af2cd1b8bf135ee7df6ca962986f44d6 (diff) | |
bpf: Assume no bounds for buffers behind a tail call
The bpf_map_elem, bpf_sk_storage_map and sockmap iterators hand the key
and the value of an element to the program as buffers. The verifier notes
how far a program reaches into them, and the iterator compares that with
the map when the program is attached. A program that does not touch the
buffers passes. It can tail-call another program of the same target,
which gets the same context, and whose reach nobody compares with the
map:
BUG: KASAN: slab-out-of-bounds in ___bpf_prog_run+0xa46a/0xae80
The program array can be filled at any time, so there is nothing to look
at when the link is made. For the same reason a program with a tail call
is taken to use the whole stack and the whole packet. Take it to reach
as far as can be into the buffers as well, so that these iterators refuse
it with -EACCES.
Fixes: d6c4503cc296 ("bpf: Implement bpf iterator for hash maps")
Fixes: 5ce6e77c7edf ("bpf: Implement bpf iterator for sock local storage map")
Fixes: 0365351524d7 ("net: Allow iterating sockmap and sockhash")
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261017163745.3341787-26-alexei.starovoitov@gmail.com
Diffstat (limited to 'kernel')
| -rw-r--r-- | kernel/bpf/fixups.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/kernel/bpf/fixups.c b/kernel/bpf/fixups.c index 608621d7f225..002c3935a8eb 100644 --- a/kernel/bpf/fixups.c +++ b/kernel/bpf/fixups.c @@ -2151,6 +2151,8 @@ int bpf_do_misc_fixups(struct bpf_verifier_env *env) if (!bpf_allow_tail_call_in_subprogs(env)) prog->aux->stack_depth = MAX_BPF_STACK; prog->aux->max_pkt_offset = MAX_PACKET_OFF; + prog->aux->max_rdonly_access = U32_MAX; + prog->aux->max_rdwr_access = U32_MAX; /* mark bpf_tail_call as different opcode to avoid * conditional branch in the interpreter for every normal |