Skip to content

bpf: Compare iterator types during state pruning - #8649

Open
kernel-patches-daemon-bpf-rc[bot] wants to merge 2 commits into
bpf-next_basefrom
series/1141840=>bpf-next
Open

bpf: Compare iterator types during state pruning#8649
kernel-patches-daemon-bpf-rc[bot] wants to merge 2 commits into
bpf-next_basefrom
series/1141840=>bpf-next

Conversation

@kernel-patches-daemon-bpf-rc

Copy link
Copy Markdown

Pull request for series with
subject: bpf: Compare iterator types during state pruning
version: 1
url: https://patchwork.kernel.org/project/netdevbpf/list/?series=1141840

@kernel-patches-daemon-bpf-rc

Copy link
Copy Markdown
Author

Upstream branch: 8c7f55d
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1141840
version: 1

@kernel-patches-daemon-bpf-rc

Copy link
Copy Markdown
Author

Upstream branch: 41c129f
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1141840
version: 1

@kernel-patches-daemon-bpf-rc

Copy link
Copy Markdown
Author

Upstream branch: 2b1f9f6
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1141840
version: 1

@kernel-patches-daemon-bpf-rc

Copy link
Copy Markdown
Author

Upstream branch: e1d9b82
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1141840
version: 1

@kernel-patches-daemon-bpf-rc

Copy link
Copy Markdown
Author

Upstream branch: 51476f6
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1141840
version: 1

@kernel-patches-daemon-bpf-rc

Copy link
Copy Markdown
Author

Upstream branch: 8b365b3
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1141840
version: 1

@kernel-patches-daemon-bpf-rc

Copy link
Copy Markdown
Author

Upstream branch: d114bb9
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=1141840
version: 1

An iterator stack slot can be MEM_RCU or PTR_UNTRUSTED. These states
must not be equal, or the verifier can prune an unsafe path.

Compare the pointer type for STACK_ITER slots.

Fixes: dfab99d ("bpf: teach the verifier to enforce css_iter and task_iter in RCU CS")
Signed-off-by: Ning Ding <dingning04@gmail.com>
Add a path where RCU protection reaches zero and then starts again.
The iterator is untrusted after this gap and must be rejected.

Signed-off-by: Ning Ding <dingning04@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant