tmakin/ack-tegra
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

bpf: abort verification if env->cur_state->loop_entry != NULL

Browse Source 
commit f3c2d243a36ef23be07bc2bce7c6a5cb6e07d9e3 upstream.

In addition to warning abort verification with -EFAULT.
If env->cur_state->loop_entry != NULL something is irrecoverably
buggy.

Fixes: bbbc02b7445e ("bpf: copy_verifier_state() should copy 'loop_entry' field")
Suggested-by: Andrii Nakryiko <andrii.nakryiko@gmail.com>
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/r/20250225003838.135319-1-eddyz87@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Eduard Zingerman
2025-02-24 16:38:38 -08:00
committed by Greg Kroah-Hartman
parent fdee1dc816
commit 80eb73778d
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
kernel/bpf/verifier.c
View File

@@ -18721,8 +18721,10 @@ process_bpf_exit:
return err;
break;
} else {
if (WARN_ON_ONCE(env->cur_state->loop_entry))
env->cur_state->loop_entry = NULL;
if (WARN_ON_ONCE(env->cur_state->loop_entry)) {
verbose(env, "verifier bug: env->cur_state->loop_entry != NULL\n");
return -EFAULT;
}
do_print_state = true;
continue;
}