• Daniel Borkmann's avatar
    ebpf: verifier: check that call reg with ARG_ANYTHING is initialized · 80f1d68c
    Daniel Borkmann authored
    I noticed that a helper function with argument type ARG_ANYTHING does
    not need to have an initialized value (register).
    
    This can worst case lead to unintented stack memory leakage in future
    helper functions if they are not carefully designed, or unintended
    application behaviour in case the application developer was not careful
    enough to match a correct helper function signature in the API.
    
    The underlying issue is that ARG_ANYTHING should actually be split
    into two different semantics:
    
      1) ARG_DONTCARE for function arguments that the helper function
         does not care about (in other words: the default for unused
         function arguments), and
    
      2) ARG_ANYTHING that is an argument actually being used by a
         helper function and *guaranteed* to be an initialized register.
    
    The current risk is low: ARG_ANYTHING is only used for the 'flags'
    argument (r4) in bpf_map_update_elem() that internally does strict
    checking.
    
    Fixes: 17a52670 ("bpf: verifier (add verifier core)")
    Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
    Acked-by: default avatarAlexei Starovoitov <ast@plumgrid.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    80f1d68c
verifier.c 55.3 KB