[PATCH bpf-next v2 0/2] bpf: Reject arena frees below the arena base

[Yiyang Chen]

bpf_arena_free_pages() can be called with a scalar arena address. The
runtime reconstructs a full user address from the arena base and the low
32 bits before returning the range to the arena free tree. A scalar one
page below the arena base can otherwise produce an out-of-domain free-tree
offset and make a later allocation return an address below the arena
mapping.

Patch 1 rejects frees whose reconstructed full user address is below
user_vm_start. Patch 2 adds verifier_arena coverage for the
scalar-below-base case.

Changes in v2:
- Add Reviewed-by tags from Emil Tsalapatis.
- Remove the empty inline asm from the selftest.

v1: https://lore.kernel.org/bpf/cover.1782813442.git.chenyy23@xxxxxxxxxxxxxxxxxxxxx/

Yiyang Chen (2):
  bpf: Reject arena frees below the arena base
  selftests/bpf: Cover scalar arena frees below the base

 kernel/bpf/arena.c                                 |  2 ++
 tools/testing/selftests/bpf/progs/verifier_arena.c | 40 +++++++++++++++++++---
 2 files changed, 37 insertions(+), 5 deletions(-)

base-commit: 1d91ea01185656ac3ee63c5f9f6f8bde3c746b3d
-- 
2.34.1