]> git.proxmox.com Git - mirror_ubuntu-kernels.git/commit
bpf: prevent r10 register from being marked as precise
authorAndrii Nakryiko <andrii@kernel.org>
Thu, 4 Apr 2024 21:45:35 +0000 (14:45 -0700)
committerAlexei Starovoitov <ast@kernel.org>
Fri, 5 Apr 2024 01:31:08 +0000 (18:31 -0700)
commit1f2a74b41ea8b902687eb97c4e7e3f558801865b
tree118282cc4c739cc119bf3428482f8433f9b72317
parentf91717007217d975aa975ddabd91ae1a107b9bff
bpf: prevent r10 register from being marked as precise

r10 is a special register that is not under BPF program's control and is
always effectively precise. The rest of precision logic assumes that
only r0-r9 SCALAR registers are marked as precise, so prevent r10 from
being marked precise.

This can happen due to signed cast instruction allowing to do something
like `r0 = (s8)r10;`, which later, if r0 needs to be precise, would lead
to an attempt to mark r10 as precise.

Prevent this with an extra check during instruction backtracking.

Fixes: 8100928c8814 ("bpf: Support new sign-extension mov insns")
Reported-by: syzbot+148110ee7cf72f39f33e@syzkaller.appspotmail.com
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: Yonghong Song <yonghong.song@linux.dev>
Link: https://lore.kernel.org/r/20240404214536.3551295-1-andrii@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
kernel/bpf/verifier.c