| Message ID | 20250322045340.18010-4-enjuk@amazon.com (mailing list archive) |
|---|---|
| Headers | show |
| Series | bpf: Fix OOB read and add tests for load-acquire/store-release | expand |
Hello: This series was applied to bpf/bpf-next.git (master) by Alexei Starovoitov <ast@kernel.org>: On Sat, 22 Mar 2025 13:52:54 +0900 you wrote: > This patch series addresses an out-of-bounds read issue in > check_atomic_load/store() reported by syzkaller when an invalid register > number (MAX_BPF_REG or greater) is used. > > The first patch fixes the actual bug by changing the order of validity > checks, ensuring register validity is checked before atomic_ptr_type_ok() > is called. > It also updates some tests that were assuming the previous order of checks. > > [...] Here is the summary with links: - [v3,bpf-next,1/2] bpf: Fix out-of-bounds read in check_atomic_load/store() https://git.kernel.org/bpf/bpf-next/c/c03bb2fa327e - [v3,bpf-next,2/2] selftests/bpf: Add selftests for load-acquire/store-release when register number is invalid https://git.kernel.org/bpf/bpf-next/c/5f3077d7fcd4 You are awesome, thank you!
This patch series addresses an out-of-bounds read issue in check_atomic_load/store() reported by syzkaller when an invalid register number (MAX_BPF_REG or greater) is used. The first patch fixes the actual bug by changing the order of validity checks, ensuring register validity is checked before atomic_ptr_type_ok() is called. It also updates some tests that were assuming the previous order of checks. The second patch adds new tests specifically for the invalid register number case to prevent regression in the future. Changes: v3: - Change invalid register from R11 to R15 in new tests v2: https://lore.kernel.org/all/20250321110010.95217-4-enjuk@amazon.com/ - Just swap atomic_ptr_type_ok() and check_load_mem()/check_store_reg() - Update some tests that were assuming the previous order of checks - Add new tests specifically for the invalid register number v1: https://lore.kernel.org/bpf/20250314195619.23772-2-enjuk@amazon.com/ Reported-by: syzbot+a5964227adc0f904549c@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=a5964227adc0f904549c Kohei Enju (2): bpf: Fix out-of-bounds read in check_atomic_load/store() selftests/bpf: Add selftests for load-acquire/store-release when register number is invalid kernel/bpf/verifier.c | 16 +++++++++-- .../bpf/progs/verifier_load_acquire.c | 26 +++++++++++++++-- .../bpf/progs/verifier_store_release.c | 28 +++++++++++++++++-- 3 files changed, 63 insertions(+), 7 deletions(-)