bpf: Fix extable address check.
authorAlexei Starovoitov <ast@kernel.org>
Wed, 15 Dec 2021 03:25:13 +0000 (19:25 -0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 22 Dec 2021 08:32:50 +0000 (09:32 +0100)
commit303644fe7e0c30df6925ede3dd35b3a5b2c454b8
tree83239d61b3862c00251747177e323099ae2ef662
parenteea5a58d86a4cc19660bc8e03be926c928cf4db0
bpf: Fix extable address check.

commit 588a25e92458c6efeb7a261d5ca5726f5de89184 upstream.

The verifier checks that PTR_TO_BTF_ID pointer is either valid or NULL,
but it cannot distinguish IS_ERR pointer from valid one.

When offset is added to IS_ERR pointer it may become small positive
value which is a user address that is not handled by extable logic
and has to be checked for at the runtime.

Tighten BPF_PROBE_MEM pointer check code to prevent this case.

Fixes: 4c5de127598e ("bpf: Emit explicit NULL pointer checks for PROBE_LDX instructions.")
Reported-by: Lorenzo Fontana <lorenzo.fontana@elastic.co>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
arch/x86/net/bpf_jit_comp.c