KP Singh 436bc4c45a bpf: Local storage helpers should check nullness of owner ptr passed ... commit 1a9c72ad4c26821e215a396167c14959cf24a7f1 upstream. The verifier allows ARG_PTR_TO_BTF_ID helper arguments to be NULL, so helper implementations need to check this before dereferencing them. This was already fixed for the socket storage helpers but not for task and inode. The issue can be reproduced by attaching an LSM program to inode_rename hook (called when moving files) which tries to get the inode of the new file without checking for its nullness and then trying to move an existing file to a new path: mv existing_file new_file_does_not_exist The report including the sample program and the steps for reproducing the bug: https://lore.kernel.org/bpf/CANaYP3HWkH91SN=wTNO9FL_2ztHfqcXKX38SSE-JJ2voh+vssw@mail.gmail.com Fixes: 4cf1bc1f1045 ("bpf: Implement task local storage") Fixes: 8ea636848a ("bpf: Implement bpf_local_storage for inodes") Reported-by: Gilad Reti <gilad.reti@gmail.com> Signed-off-by: KP Singh <kpsingh@kernel.org> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Martin KaFai Lau <kafai@fb.com> Acked-by: Yonghong Song <yhs@fb.com> Link: https://lore.kernel.org/bpf/20210112075525.256820-3-kpsingh@kernel.org [ just take 1/2 of this patch for 5.10.y - gregkh ] Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2021-01-27 11:55:28 +01:00
..
bpf	bpf: Local storage helpers should check nullness of owner ptr passed	2021-01-27 11:55:28 +01:00
cgroup	cgroup: Fix memory leak when parsing multiple source parameters	2021-01-06 14:56:51 +01:00
configs
debug	kdb: Fix pager search for multi-line strings	2020-10-01 14:44:08 +01:00
dma	swiotlb: remove the tbl_dma_addr argument to swiotlb_tbl_map_single	2020-11-02 10:10:39 -05:00
entry	entry: Fix the incorrect ordering of lockdep and RCU check	2020-11-04 18:06:14 +01:00
events	exec: Transform exec_update_mutex into a rw_semaphore	2021-01-09 13:46:24 +01:00
gcov	gcov: add support for GCC 10.1	2020-09-11 09:33:54 -07:00
irq	genirq/irqdomain: Don't try to free an interrupt that has no mapping	2020-12-30 11:53:25 +01:00
kcsan	kernel/: fix repeated words in comments	2020-10-16 11:11:19 -07:00
livepatch	kernel/: fix repeated words in comments	2020-10-16 11:11:19 -07:00
locking	locking/lockdep: Cure noinstr fail	2021-01-27 11:55:21 +01:00
power	PM: sleep: fix typo in kernel/power/process.c	2020-10-27 19:11:44 +01:00
printk	printk: fix kmsg_dump_get_buffer length calulations	2021-01-27 11:55:08 +01:00
rcu	rcu-tasks: Move RCU-tasks initialization to before early_initcall()	2021-01-19 18:27:28 +01:00
sched	sched: Reenable interrupts in do_sched_yield()	2020-12-30 11:52:59 +01:00
time	tick/sched: Remove bogus boot "safety" check	2021-01-06 14:56:55 +01:00
trace	tracing/kprobes: Do the notrace functions check without kprobes on ftrace	2021-01-19 18:27:19 +01:00
.gitignore
acct.c	kernel: acct.c: fix some kernel-doc nits	2020-10-16 11:11:19 -07:00
async.c	treewide: Remove uninitialized_var() usage	2020-07-16 12:35:15 -07:00
audit_fsnotify.c	fsnotify: generalize handle_inode_event()	2020-12-30 11:54:18 +01:00
audit_tree.c	fsnotify: generalize handle_inode_event()	2020-12-30 11:54:18 +01:00
audit_watch.c	fsnotify: generalize handle_inode_event()	2020-12-30 11:54:18 +01:00
audit.c	audit: Remove redundant null check	2020-08-26 09:10:39 -04:00
audit.h	audit: change unnecessary globals into statics	2020-08-17 20:26:58 -04:00
auditfilter.c	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
auditsc.c	audit/stable-5.9 PR 20200803	2020-08-04 14:20:26 -07:00
backtracetest.c	treewide: Replace DECLARE_TASKLET() with DECLARE_TASKLET_OLD()	2020-07-30 11:15:58 -07:00
bounds.c
capability.c	LSM: Signal to SafeSetID when setting group IDs	2020-10-13 09:17:34 -07:00
compat.c	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
configs.c
context_tracking.c
cpu_pm.c	notifier: Fix broken error handling pattern	2020-09-01 09:58:03 +02:00
cpu.c	kernel/cpu: add arch override for clear_tasks_mm_cpumask() mm handling	2020-11-27 00:10:39 +11:00
crash_core.c	kdump: append kernel build-id string to VMCOREINFO	2020-08-12 10:58:01 -07:00
crash_dump.c
cred.c
delayacct.c
dma.c
exec_domain.c
exit.c	don't dump the threads that had been already exiting when zapped.	2020-10-28 16:39:49 -04:00
extable.c
fail_function.c	fail_function: Remove a redundant mutex unlock	2020-11-19 11:58:16 -08:00
fork.c	exec: Transform exec_update_mutex into a rw_semaphore	2021-01-09 13:46:24 +01:00
freezer.c
futex.c	futex: Don't enable IRQs unconditionally in put_pi_state()	2020-11-09 14:30:30 +01:00
gen_kheaders.sh
groups.c	LSM: Signal to SafeSetID when setting group IDs	2020-10-13 09:17:34 -07:00
hung_task.c	kernel/hung_task.c: make type annotations consistent	2020-11-02 12:14:19 -08:00
iomem.c
irq_work.c
jump_label.c	kernel/: fix repeated words in comments	2020-10-16 11:11:19 -07:00
kallsyms.c	treewide: Convert macro and uses of __section(foo) to __section("foo")	2020-10-25 14:51:49 -07:00
kcmp.c	exec: Transform exec_update_mutex into a rw_semaphore	2021-01-09 13:46:24 +01:00
Kconfig.freezer
Kconfig.hz
Kconfig.locks
Kconfig.preempt
kcov.c	kcov: make some symbols static	2020-08-12 10:58:02 -07:00
kexec_core.c	kernel/: fix repeated words in comments	2020-10-16 11:11:19 -07:00
kexec_elf.c
kexec_file.c	kernel/resource: move and rename IORESOURCE_MEM_DRIVER_MANAGED	2020-10-16 11:11:18 -07:00
kexec_internal.h
kexec.c	LSM: Introduce kernel_post_load_data() hook	2020-10-05 13:37:03 +02:00
kheaders.c
kmod.c	kmod: remove redundant "be an" in the comment	2020-08-12 10:58:01 -07:00
kprobes.c	kprobes: Tell lockdep about kprobe nesting	2020-11-04 09:46:06 -05:00
ksysfs.c
kthread.c	kthread_worker: prevent queuing delayed work from timer_fn when it is being canceled	2020-11-02 12:14:19 -08:00
latencytop.c
Makefile	elfcore: fix building with clang	2020-12-11 14:02:14 -08:00
module_signature.c
module_signing.c
module-internal.h
module.c	module: delay kobject uevent until after module init call	2021-01-06 14:56:54 +01:00
notifier.c	notifier: Fix broken error handling pattern	2020-09-01 09:58:03 +02:00
nsproxy.c	nsproxy: support CLONE_NEWTIME with setns()	2020-07-08 11:14:22 +02:00
padata.c	padata: fix possible padata_works_lock deadlock	2020-09-04 17:51:55 +10:00
panic.c	panic: don't dump stack twice on warn	2020-11-14 11:26:04 -08:00
params.c	params: Replace zero-length array with flexible-array member	2020-10-29 17:22:59 -05:00
pid_namespace.c	kernel/: fix repeated words in comments	2020-10-16 11:11:19 -07:00
pid.c	exec: Transform exec_update_mutex into a rw_semaphore	2021-01-09 13:46:24 +01:00
profile.c
ptrace.c	ptrace: Set PF_SUPERPRIV when checking capability	2020-11-17 12:53:22 -08:00
range.c	kernel.h: split out min()/max() et al. helpers	2020-10-16 11:11:19 -07:00
reboot.c	reboot: fix overflow parsing reboot cpu number	2020-11-14 11:26:03 -08:00
regset.c	regset: kill ->get()	2020-07-27 14:31:12 -04:00
relay.c	kernel/relay.c: drop unneeded initialization	2020-10-16 11:11:22 -07:00
resource.c	kernel/resource: make iomem_resource implicit in release_mem_region_adjustable()	2020-10-16 11:11:18 -07:00
rseq.c
scftorture.c	scftorture: Add cond_resched() to test loop	2020-08-24 18:38:38 -07:00
scs.c	mm: memcontrol: account kernel stack per node	2020-08-07 11:33:25 -07:00
seccomp.c	seccomp: Set PF_SUPERPRIV when checking capability	2020-11-17 12:53:22 -08:00
signal.c	ptrace: fix task_join_group_stop() for the case when current is traced	2020-11-02 12:14:19 -08:00
smp.c	Merge tag 'core-rcu-2020-10-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2020-10-18 14:34:50 -07:00
smpboot.c
smpboot.h
softirq.c	softirq: Add debug check to __raise_softirq_irqoff()	2020-09-16 15:18:56 +02:00
stackleak.c	stackleak: let stack_erasing_sysctl take a kernel pointer buffer	2020-09-19 13:13:39 -07:00
stacktrace.c	stacktrace: Remove reliable argument from arch_stack_walk() callback	2020-09-18 14:24:16 +01:00
static_call.c	static_call: Fix return type of static_call_init	2020-10-02 21:18:25 +02:00
stop_machine.c	stop_machine, rcu: Mark functions as notrace	2020-10-26 12:12:27 +01:00
sys_ni.c	mm/madvise: introduce process_madvise() syscall: an external memory hinting API	2020-10-18 09:27:10 -07:00
sys.c	kernel/sys.c: fix prototype of prctl_get_tid_address()	2020-10-25 11:44:16 -07:00
sysctl-test.c
sysctl.c	mm: allow a controlled amount of unfairness in the page lock	2020-09-17 10:26:41 -07:00
task_work.c	task_work: cleanup notification modes	2020-10-17 15:05:30 -06:00
taskstats.c	taskstats: move specifying netlink policy back to ops	2020-10-02 19:11:12 -07:00
test_kprobes.c
torture.c	torture: Dump ftrace at shutdown only if requested	2020-06-29 12:01:45 -07:00
tracepoint.c	tracepoint: Replace zero-length array with flexible-array member	2020-10-29 17:22:59 -05:00
tsacct.c
ucount.c
uid16.c
uid16.h	kernel: provide ksys_*() wrappers for syscalls called by kernel/uid16.c	2018-04-02 20:15:30 +02:00
umh.c	usermodehelper: reset umask to default before executing user process	2020-10-06 10:31:52 -07:00
up.c
user_namespace.c	kernel/: fix repeated words in comments	2020-10-16 11:11:19 -07:00
user-return-notifier.c
user.c
usermode_driver.c	umd: Stop using split_argv	2020-07-07 11:58:59 -05:00
utsname_sysctl.c
utsname.c
watch_queue.c	watch_queue: Limit the number of watches a user can hold	2020-08-17 09:39:18 -07:00
watchdog_hld.c
watchdog.c	kernel/watchdog: fix watchdog_allowed_mask not used warning	2020-11-14 11:26:03 -08:00
workqueue_internal.h
workqueue.c	workqueue: Kick a worker based on the actual activation of delayed works	2021-01-12 20:18:14 +01:00