michael/linux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

bpf: Explicitly check accesses to bpf_sock_addr

Browse Source 
[ Upstream commit 6fabca2fc9 ]

Syzkaller found a kernel warning on the following sock_addr program:

    0: r0 = 0
    1: r2 = *(u32 *)(r1 +60)
    2: exit

which triggers:

    verifier bug: error during ctx access conversion (0)

This is happening because offset 60 in bpf_sock_addr corresponds to an
implicit padding of 4 bytes, right after msg_src_ip4. Access to this
padding isn't rejected in sock_addr_is_valid_access and it thus later
fails to convert the access.

This patch fixes it by explicitly checking the various fields of
bpf_sock_addr in sock_addr_is_valid_access.

I checked the other ctx structures and is_valid_access functions and
didn't find any other similar cases. Other cases of (properly handled)
padding are covered in new tests in a subsequent patch.

Fixes: 1cedee13d2 ("bpf: Hooks for sys_sendmsg")
Reported-by: syzbot+136ca59d411f92e821b7@syzkaller.appspotmail.com
Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Closes: https://syzkaller.appspot.com/bug?extid=136ca59d411f92e821b7
Link: https://lore.kernel.org/bpf/b58609d9490649e76e584b0361da0abd3c2c1779.1758094761.git.paul.chaignon@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Paul Chaignon
2025-09-17 10:08:00 +02:00
committed by Greg Kroah-Hartman
parent 93818c7ce4
commit de44cdc50d
1 changed files with 10 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
net/core/filter.c
View File

@@ -7132,13 +7132,17 @@ static bool sock_addr_is_valid_access(int off, int size,
return false;
info->reg_type = PTR_TO_SOCKET;
break;
default:
if (type == BPF_READ) {
if (size != size_default)
return false;
} else {
case bpf_ctx_range(struct bpf_sock_addr, user_family):
case bpf_ctx_range(struct bpf_sock_addr, family):
case bpf_ctx_range(struct bpf_sock_addr, type):
case bpf_ctx_range(struct bpf_sock_addr, protocol):
if (type != BPF_READ)
return false;
}
if (size != size_default)
return false;
break;
default:
return false;
}
return true;