Youlin Li f1db20814a bpf: Fix wrong reg type conversion in release_reference() ... Some helper functions will allocate memory. To avoid memory leaks, the verifier requires the eBPF program to release these memories by calling the corresponding helper functions. When a resource is released, all pointer registers corresponding to the resource should be invalidated. The verifier use release_references() to do this job, by apply __mark_reg_unknown() to each relevant register. It will give these registers the type of SCALAR_VALUE. A register that will contain a pointer value at runtime, but of type SCALAR_VALUE, which may allow the unprivileged user to get a kernel pointer by storing this register into a map. Using __mark_reg_not_init() while NOT allow_ptr_leaks can mitigate this problem. Fixes: fd978bf7fd ("bpf: Add reference tracking to verifier") Signed-off-by: Youlin Li <liulin063@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/20221103093440.3161-1-liulin063@gmail.com		2022-11-04 00:24:12 +01:00
..
preload	bpf: iterators: Build and use lightweight bootstrap version of bpftool	2022-07-15 12:01:30 -07:00
arraymap.c	bpf: Support kptrs in percpu arraymap	2022-09-07 11:46:08 -07:00
bloom_filter.c	treewide: use get_random_u32() when possible	2022-10-11 17:42:58 -06:00
bpf_inode_storage.c	bpf: Compute map_btf_id during build time	2022-04-26 11:35:21 -07:00
bpf_iter.c	bpf: Initialize the bpf_run_ctx in bpf_iter_run_prog()	2022-08-18 17:06:13 -07:00
bpf_local_storage.c	bpf: Use this_cpu_{inc|dec|inc_return} for bpf_task_storage_busy	2022-09-01 12:16:12 -07:00
bpf_lru_list.c	bpf_lru_list: Read double-checked variable once without lock	2021-02-10 15:54:26 -08:00
bpf_lru_list.h	printk: stop including cache.h from printk.h	2022-05-13 07:20:07 -07:00
bpf_lsm.c	Networking changes for 6.1.	2022-10-04 13:38:03 -07:00
bpf_struct_ops_types.h	bpf: Add dummy BPF STRUCT_OPS for test purpose	2021-11-01 14:10:00 -07:00
bpf_struct_ops.c	bpf: Remove is_valid_bpf_tramp_flags()	2022-07-11 21:04:58 +02:00
bpf_task_storage.c	bpf: Use this_cpu_{inc|dec|inc_return} for bpf_task_storage_busy	2022-09-01 12:16:12 -07:00
btf.c	bpf: prevent decl_tag from being referenced in func_proto	2022-10-17 10:56:12 -07:00
cgroup_iter.c	bpf: cgroup_iter: support cgroup1 using cgroup fd	2022-10-11 06:50:15 -10:00
cgroup.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-10-03 17:44:18 -07:00
core.c	treewide: use get_random_u32() when possible	2022-10-11 17:42:58 -06:00
cpumap.c	bpf: Use bpf_map_area_alloc consistently on bpf map creation	2022-08-10 11:50:43 -07:00
devmap.c	bpf: Use bpf_map_area_alloc consistently on bpf map creation	2022-08-10 11:50:43 -07:00
disasm.c	bpf: Relicense disassembler as GPL-2.0-only OR BSD-2-Clause	2021-09-02 14:49:23 +02:00
disasm.h	bpf: Relicense disassembler as GPL-2.0-only OR BSD-2-Clause	2021-09-02 14:49:23 +02:00
dispatcher.c	bpf: Fix dispatcher patchable function entry to 5 bytes nop	2022-10-20 18:57:51 -07:00
hashtab.c	treewide: use get_random_u32() when possible	2022-10-11 17:42:58 -06:00
helpers.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-10-03 17:44:18 -07:00
inode.c	bpf: Convert bpf_preload.ko to use light skeleton.	2022-02-10 23:31:51 +01:00
Kconfig	rcu: Make the TASKS_RCU Kconfig option be selected	2022-04-20 16:52:58 -07:00
link_iter.c	bpf: Add bpf_link iterator	2022-05-10 11:20:45 -07:00
local_storage.c	bpf: Use bpf_map_area_alloc consistently on bpf map creation	2022-08-10 11:50:43 -07:00
lpm_trie.c	bpf: Use bpf_map_area_alloc consistently on bpf map creation	2022-08-10 11:50:43 -07:00
Makefile	bpf: Introduce any context BPF specific memory allocator.	2022-09-05 15:33:05 +02:00
map_in_map.c	bpf: Allow storing unreferenced kptr in map	2022-04-25 17:31:35 -07:00
map_in_map.h	bpf: Add map_meta_equal map ops	2020-08-28 15:41:30 +02:00
map_iter.c	bpf: Introduce MEM_RDONLY flag	2021-12-18 13:27:41 -08:00
memalloc.c	bpf: Use __llist_del_all() whenever possbile during memory draining	2022-10-21 19:17:38 -07:00
mmap_unlock_work.h	bpf: Introduce helper bpf_find_vma	2021-11-07 11:54:51 -08:00
net_namespace.c	net: Add includes masked by netdevice.h including uapi/bpf.h	2021-12-29 20:03:05 -08:00
offload.c	bpf: Use bpf_map_area_alloc consistently on bpf map creation	2022-08-10 11:50:43 -07:00
percpu_freelist.c	bpf: Simplify code by using for_each_cpu_wrap()	2022-09-10 16:18:55 -07:00
percpu_freelist.h	bpf: Use raw_spin_trylock() for pcpu_freelist_push/pop in NMI	2020-10-06 00:04:11 +02:00
prog_iter.c	bpf: Refactor bpf_iter_reg to have separate seq_info member	2020-07-25 20:16:32 -07:00
queue_stack_maps.c	bpf: Remove unneeded memset in queue_stack_map creation	2022-08-10 11:48:22 -07:00
reuseport_array.c	net: Fix suspicious RCU usage in bpf_sk_reuseport_detach()	2022-08-17 16:42:59 -07:00
ringbuf.c	bpf: Add bpf_user_ringbuf_drain() helper	2022-09-21 16:24:58 -07:00
stackmap.c	perf/bpf: Always use perf callchains if exist	2022-09-13 15:03:22 +02:00
syscall.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-10-03 17:44:18 -07:00
sysfs_btf.c	bpf: Load and verify kernel module BTFs	2020-11-10 15:25:53 -08:00
task_iter.c	- Yu Zhao's Multi-Gen LRU patches are here. They've been under test in	2022-10-10 17:53:04 -07:00
tnum.c	bpf, tnums: Provably sound, faster, and more precise algorithm for tnum_mul	2021-06-01 13:34:15 +02:00
trampoline.c	bpf: Add __bpf_prog_{enter,exit}_struct_ops for struct_ops trampoline	2022-09-29 09:25:47 -07:00
verifier.c	bpf: Fix wrong reg type conversion in release_reference()	2022-11-04 00:24:12 +01:00