From patchwork Fri Dec 23 18:28:44 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 13081063 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 22076C4332F for ; Fri, 23 Dec 2022 18:28:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229658AbiLWS2x (ORCPT ); Fri, 23 Dec 2022 13:28:53 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54332 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231295AbiLWS2w (ORCPT ); Fri, 23 Dec 2022 13:28:52 -0500 Received: from mail-pj1-x1032.google.com (mail-pj1-x1032.google.com [IPv6:2607:f8b0:4864:20::1032]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9C3A9186C0 for ; Fri, 23 Dec 2022 10:28:50 -0800 (PST) Received: by mail-pj1-x1032.google.com with SMTP id ge16so1989308pjb.5 for ; Fri, 23 Dec 2022 10:28:50 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=uFmJ94vgdYtHsEMf0/KuGJB8O++/BC7ohIyt5Fgn7pI=; b=ElgK4ZOatixFeDSXHWG1Ja36Gaa/aRySfgH6IWbKvHwrt+qWRmB8Q0V6Axbh6WUnIS 95A/hEHYA64Jr/hlfVkIc/NbGXmDDT1rwsY2QZorZnE25auressDUTSkJCD91hYmSBgT 3B58T79yKrzeMcWOjAtdRIiMm1gQfdBnlNI20= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=uFmJ94vgdYtHsEMf0/KuGJB8O++/BC7ohIyt5Fgn7pI=; b=ctHR0/0T+o+28ZJ0rJnHimDBT/bxxTWAN3exel5jltUZE6pwyS1/RVJx0zCLfqqafr oOKZHz0K6kSYGdoqwoExcV+WsK7h1YddSfvVSuvEcRE0tVAUvgZABll61PxcLHR6Gvjs GRR3gQfBWC1Sqa8sjAkouzDQWkamSRauy+35pjegbEhJ/Cki7ok3dqU2Co0mQQR4s7tK lkjneutF0xr0+Kt3ps5CD3R/ty1IP4k3VkgE7EVnzf56e2ln5Ry53M/M7WDW0LN5rPzZ dsOP0O7/ajOUXRU1pdfzQAII9A6nbhLuYR/8We3nrv0DrYcnNFK3XWvdlsyeoIIaIciA cihg== X-Gm-Message-State: AFqh2krE6hhx0UA3FtQt9x3N83JuVcAsXt6rwrnzoVaVdPKrKHRMUSov K9HCatRazPmsyf3tNc10DcmgLg== X-Google-Smtp-Source: AMrXdXvdOaCB6ie+xu0/3TyseJFb8oYp2nnjiDsW9wbBkVz+xBXlhD9nOsqGw7ayHOFxxe0wYLovFw== X-Received: by 2002:a17:903:328e:b0:191:191f:e7af with SMTP id jh14-20020a170903328e00b00191191fe7afmr11434481plb.16.1671820130175; Fri, 23 Dec 2022 10:28:50 -0800 (PST) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id z5-20020a1709027e8500b00189c62eac37sm2727890pla.32.2022.12.23.10.28.49 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 23 Dec 2022 10:28:49 -0800 (PST) From: Kees Cook To: Alexei Starovoitov Cc: Kees Cook , Hyunwoo Kim , Daniel Borkmann , John Fastabend , Andrii Nakryiko , Martin KaFai Lau , Song Liu , Yonghong Song , KP Singh , Stanislav Fomichev , Hao Luo , Jiri Olsa , bpf@vger.kernel.org, syzbot+b1e1f7feb407b56d0355@syzkaller.appspotmail.com, linux-kernel@vger.kernel.org, linux-hardening@vger.kernel.org Subject: [PATCH] bpf: Always use maximal size for copy_array() Date: Fri, 23 Dec 2022 10:28:44 -0800 Message-Id: <20221223182836.never.866-kees@kernel.org> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2069; h=from:subject:message-id; bh=t1OBGhUbcR8nf2++QuxM7FqpZ9UFkmqZvOnliSZEUTE=; b=owEBbQKS/ZANAwAKAYly9N/cbcAmAcsmYgBjpfNcsRz8afKnm1B38atDy/LxrBm3b4UZpSVoEyiC oYseHr6JAjMEAAEKAB0WIQSlw/aPIp3WD3I+bhOJcvTf3G3AJgUCY6XzXAAKCRCJcvTf3G3AJkA0EA CQvcv59+py3Ot0bfishkg0yCD3rI/T6QxpeFBbXklzHVSMjI++zbfBaTXo91O4rwjrC2NoDxEPY0xx D5mr5lj2NDFwNMvff8tSRJyH7COrX9W7wMoHR38Bhp4klOmbWWIeLjL8weeD7vm+17jmOP/PtTo/wM ++vHN/270KNs9+XfDR81LRnRze89Oir88FBWTtQDVmyz1t/ILTosrmkczJ/WhTKOZD8epirnm883Id Ixer5RmOPNpZCNu8H0KM32WKmyClUDMdy5JBIAqCPd8mjWY0ke9b6zhExgu9z6oBLelR/WFkmAs45w ThqMBox1hgSWHHZPD3lPfbaLIdaR5YwO7VHlKdCzgnnt1Vp6KeuoDuOSHoiXpauzS2tB/NW41p+h6M 8C6fFzPZfF8sgLwXRpoOasVGgrdCCZAGd7TE3wS3KcPh7BlM9UI7Yr6O6I8gik9sQCvhis1jsxUmHD Pysboz4zLQPLmA9dhBFWLCBfUpQ8AWk8ytREuiNrPrX1mLI3vKrFGCY12vF0MPvg0h8RWG00+dOwrP XBcasg0ir+Jd3pdQDUwS3AW+t2/WFyJH6Id5UvAJX9t/GzhMYFTAhT+Z8W7AuUI3mhn8Qgih8/6n5l zLTvUzzDuG3+3qhaytMOM265N8GDR2JIsH3tXcSa7B6I0XzQ2+PqoOki0lMQ== X-Developer-Key: i=keescook@chromium.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 Precedence: bulk List-ID: X-Mailing-List: linux-hardening@vger.kernel.org Instead of counting on prior allocations to have sized allocations to the next kmalloc bucket size, always perform a krealloc that is at least ksize(dst) in size (which is a no-op), so the size can be correctly tracked by all the various allocation size trackers (KASAN, __alloc_size, etc). Reported-by: Hyunwoo Kim Link: https://lore.kernel.org/bpf/20221223094551.GA1439509@ubuntu Fixes: ceb35b666d42 ("bpf/verifier: Use kmalloc_size_roundup() to match ksize() usage") Cc: Alexei Starovoitov Cc: Daniel Borkmann Cc: John Fastabend Cc: Andrii Nakryiko Cc: Martin KaFai Lau Cc: Song Liu Cc: Yonghong Song Cc: KP Singh Cc: Stanislav Fomichev Cc: Hao Luo Cc: Jiri Olsa Cc: bpf@vger.kernel.org Signed-off-by: Kees Cook --- kernel/bpf/verifier.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index a5255a0dcbb6..969e61bd6d39 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -1054,6 +1054,8 @@ static void print_insn_state(struct bpf_verifier_env *env, */ static void *copy_array(void *dst, const void *src, size_t n, size_t size, gfp_t flags) { + size_t alloc_bytes; + void *orig = dst; size_t bytes; if (ZERO_OR_NULL_PTR(src)) @@ -1062,11 +1064,11 @@ static void *copy_array(void *dst, const void *src, size_t n, size_t size, gfp_t if (unlikely(check_mul_overflow(n, size, &bytes))) return NULL; - if (ksize(dst) < ksize(src)) { - kfree(dst); - dst = kmalloc_track_caller(kmalloc_size_roundup(bytes), flags); - if (!dst) - return NULL; + alloc_bytes = max(ksize(orig), kmalloc_size_roundup(bytes)); + dst = krealloc(orig, alloc_bytes, flags); + if (!dst) { + kfree(orig); + return NULL; } memcpy(dst, src, bytes);