• Stanislav Fomichev's avatar
    bpf: Check attach_func_proto more carefully in check_helper_call · aef9d4a3
    Stanislav Fomichev authored
    Syzkaller found a problem similar to d1a6edec ("bpf: Check
    attach_func_proto more carefully in check_return_code") where
    attach_func_proto might be NULL:
    
    RIP: 0010:check_helper_call+0x3dcb/0x8d50 kernel/bpf/verifier.c:7330
     do_check kernel/bpf/verifier.c:12302 [inline]
     do_check_common+0x6e1e/0xb980 kernel/bpf/verifier.c:14610
     do_check_main kernel/bpf/verifier.c:14673 [inline]
     bpf_check+0x661e/0xc520 kernel/bpf/verifier.c:15243
     bpf_prog_load+0x11ae/0x1f80 kernel/bpf/syscall.c:2620
    
    With the following reproducer:
    
      bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000780)={0xf, 0x4, &(0x7f0000000040)=@framed={{}, [@call={0x85, 0x0, 0x0, 0xbb}]}, &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0}, 0x80)
    
    Let's do the same here, only check attach_func_proto for the prog types
    where we are certain that attach_func_proto is defined.
    
    Fixes: 69fd337a ("bpf: per-cgroup lsm flavor")
    Reported-by: syzbot+0f8d989b1fba1addc5e0@syzkaller.appspotmail.com
    Signed-off-by: default avatarStanislav Fomichev <sdf@google.com>
    Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
    Acked-by: default avatarMartin KaFai Lau <kafai@fb.com>
    Link: https://lore.kernel.org/bpf/20220720164729.147544-1-sdf@google.com
    aef9d4a3
verifier.c 437 KB