GitHub-Mirror/Star64_linux
2
0
Fork 0
mirror of https://github.com/Fishwaldo/Star64_linux.git synced 2025-06-29 10:01:25 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

bpf: Rework ptr_limit into alu_limit and add common error path

Browse source 
Small refactor with no semantic changes in order to consolidate the max
ptr_limit boundary check.

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: John Fastabend <john.fastabend@gmail.com>
Acked-by: Alexei Starovoitov <ast@kernel.org>
This commit is contained in:
Daniel Borkmann 2021-03-23 09:04:10 +01:00
parent 24c109bb15
commit b658bbb844
1 changed files with 13 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

21
kernel/bpf/verifier.c
View file

@ -5858,12 +5858,12 @@ static struct bpf_insn_aux_data *cur_aux(struct bpf_verifier_env *env)
static int retrieve_ptr_limit(const struct bpf_reg_state *ptr_reg, static int retrieve_ptr_limit(const struct bpf_reg_state *ptr_reg,
const struct bpf_reg_state *off_reg, const struct bpf_reg_state *off_reg,
u32 *ptr_limit, u8 opcode) u32 *alu_limit, u8 opcode)
{ {
bool off_is_neg = off_reg->smin_value < 0; bool off_is_neg = off_reg->smin_value < 0;
bool mask_to_left = (opcode == BPF_ADD && off_is_neg) || bool mask_to_left = (opcode == BPF_ADD && off_is_neg) ||
(opcode == BPF_SUB && !off_is_neg); (opcode == BPF_SUB && !off_is_neg);
u32 off, max; u32 off, max = 0, ptr_limit = 0;
if (!tnum_is_const(off_reg->var_off) && if (!tnum_is_const(off_reg->var_off) &&
(off_reg->smin_value < 0) != (off_reg->smax_value < 0)) (off_reg->smin_value < 0) != (off_reg->smax_value < 0))
@ -5880,22 +5880,27 @@ static int retrieve_ptr_limit(const struct bpf_reg_state *ptr_reg,
*/ */
off = ptr_reg->off + ptr_reg->var_off.value; off = ptr_reg->off + ptr_reg->var_off.value;
if (mask_to_left) if (mask_to_left)
*ptr_limit = MAX_BPF_STACK + off; ptr_limit = MAX_BPF_STACK + off;
else else
*ptr_limit = -off - 1; ptr_limit = -off - 1;
return *ptr_limit >= max ? -ERANGE : 0; break;
case PTR_TO_MAP_VALUE: case PTR_TO_MAP_VALUE:
max = ptr_reg->map_ptr->value_size; max = ptr_reg->map_ptr->value_size;
if (mask_to_left) { if (mask_to_left) {
*ptr_limit = ptr_reg->umax_value + ptr_reg->off; ptr_limit = ptr_reg->umax_value + ptr_reg->off;
} else { } else {
off = ptr_reg->smin_value + ptr_reg->off; off = ptr_reg->smin_value + ptr_reg->off;
*ptr_limit = ptr_reg->map_ptr->value_size - off - 1; ptr_limit = ptr_reg->map_ptr->value_size - off - 1;
} }
return *ptr_limit >= max ? -ERANGE : 0; break;
default: default:
return -EINVAL; return -EINVAL;
} }
if (ptr_limit >= max)
return -ERANGE;
*alu_limit = ptr_limit;
return 0;
} }
static bool can_skip_alu_sanitation(const struct bpf_verifier_env *env, static bool can_skip_alu_sanitation(const struct bpf_verifier_env *env,