bpf: Mark PTR_TO_FUNC register initially with zero offset
authorDaniel Borkmann <daniel@iogearbox.net>
Fri, 14 Jan 2022 13:58:36 +0000 (13:58 +0000)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 27 Jan 2022 10:05:26 +0000 (11:05 +0100)
commit95429d6b64b1f6ed5fff4b91b9f8eb5fbf337c0d
treed378a55ebdd5b414207edca1d8696e2cf91bb1e2
parent20ceec871b66f8d9fec11ee8bc6b98755049c760
bpf: Mark PTR_TO_FUNC register initially with zero offset

commit d400a6cf1c8a57cdf10f35220ead3284320d85ff upstream.

Similar as with other pointer types where we use ldimm64, clear the register
content to zero first, and then populate the PTR_TO_FUNC type and subprogno
number. Currently this is not done, and leads to reuse of stale register
tracking data.

Given for special ldimm64 cases we always clear the register offset, make it
common for all cases, so it won't be forgotten in future.

Fixes: 69c087ba6225 ("bpf: Add bpf_for_each_map_elem() helper")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: John Fastabend <john.fastabend@gmail.com>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
kernel/bpf/verifier.c