[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <000000000000e1f1a9061c2f2d82@google.com>
Date: Mon, 01 Jul 2024 06:00:19 -0700
From: syzbot <syzbot+80cf9d55d6fd2d6a9838@...kaller.appspotmail.com>
To: linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [syzbot] [bpf?] [net?] KMSAN: uninit-value in dev_map_hash_lookup_elem
For archival purposes, forwarding an incoming command email to
linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com.
***
Subject: [syzbot] [bpf?] [net?] KMSAN: uninit-value in dev_map_hash_lookup_elem
Author: wojciech.gladysz@...ogain.com
#syz test: https://linux.googlesource.com/linux/kernel/git/torvalds/linux e478cf26c556e4ab572ab0ab2306c986901dcd61
---
kernel/bpf/verifier.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 36ef8e96787e..13a9c2e2908a 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -7146,8 +7146,8 @@ static int check_stack_range_initialized(
* reads. However, if raw_mode is not set, we'll do extra
* checks below.
*/
- bounds_check_type = BPF_WRITE;
- clobber = true;
+ clobber = !meta || meta->raw_mode;
+ bounds_check_type = clobber ? BPF_WRITE : BPF_READ;
} else {
bounds_check_type = BPF_READ;
}
@@ -7230,8 +7230,7 @@ static int check_stack_range_initialized(
stype = &state->stack[spi].slot_type[slot % BPF_REG_SIZE];
if (*stype == STACK_MISC)
goto mark;
- if ((*stype == STACK_ZERO) ||
- (*stype == STACK_INVALID && env->allow_uninit_stack)) {
+ if (*stype == STACK_ZERO) {
if (clobber) {
/* helper can write anything into the stack */
*stype = STACK_MISC;
@@ -8748,6 +8747,8 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
meta->map_uid = reg->map_uid;
break;
case ARG_PTR_TO_MAP_KEY:
+ /* always mark read access */
+ meta->raw_mode = false;
/* bpf_map_xxx(..., map_ptr, ..., key) call:
* check that [key, key + map->key_size) are within
* stack limits and initialized
@@ -8763,7 +8764,7 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
}
err = check_helper_mem_access(env, regno,
meta->map_ptr->key_size, false,
- NULL);
+ meta);
break;
case ARG_PTR_TO_MAP_VALUE:
if (type_may_be_null(arg_type) && register_is_null(reg))
--
2.35.3
Powered by blists - more mailing lists