mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-06 08:46:46 +00:00
bpf: Rework ptr_limit into alu_limit and add common error path
commit b658bbb844
upstream.
Small refactor with no semantic changes in order to consolidate the max
ptr_limit boundary check.
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: John Fastabend <john.fastabend@gmail.com>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
60eb41ad98
commit
670494f9fb
1 changed files with 13 additions and 8 deletions
|
@ -2026,12 +2026,12 @@ static struct bpf_insn_aux_data *cur_aux(struct bpf_verifier_env *env)
|
||||||
|
|
||||||
static int retrieve_ptr_limit(const struct bpf_reg_state *ptr_reg,
|
static int retrieve_ptr_limit(const struct bpf_reg_state *ptr_reg,
|
||||||
const struct bpf_reg_state *off_reg,
|
const struct bpf_reg_state *off_reg,
|
||||||
u32 *ptr_limit, u8 opcode)
|
u32 *alu_limit, u8 opcode)
|
||||||
{
|
{
|
||||||
bool off_is_neg = off_reg->smin_value < 0;
|
bool off_is_neg = off_reg->smin_value < 0;
|
||||||
bool mask_to_left = (opcode == BPF_ADD && off_is_neg) ||
|
bool mask_to_left = (opcode == BPF_ADD && off_is_neg) ||
|
||||||
(opcode == BPF_SUB && !off_is_neg);
|
(opcode == BPF_SUB && !off_is_neg);
|
||||||
u32 off, max;
|
u32 off, max = 0, ptr_limit = 0;
|
||||||
|
|
||||||
if (!tnum_is_const(off_reg->var_off) &&
|
if (!tnum_is_const(off_reg->var_off) &&
|
||||||
(off_reg->smin_value < 0) != (off_reg->smax_value < 0))
|
(off_reg->smin_value < 0) != (off_reg->smax_value < 0))
|
||||||
|
@ -2045,22 +2045,27 @@ static int retrieve_ptr_limit(const struct bpf_reg_state *ptr_reg,
|
||||||
max = MAX_BPF_STACK + mask_to_left;
|
max = MAX_BPF_STACK + mask_to_left;
|
||||||
off = ptr_reg->off + ptr_reg->var_off.value;
|
off = ptr_reg->off + ptr_reg->var_off.value;
|
||||||
if (mask_to_left)
|
if (mask_to_left)
|
||||||
*ptr_limit = MAX_BPF_STACK + off;
|
ptr_limit = MAX_BPF_STACK + off;
|
||||||
else
|
else
|
||||||
*ptr_limit = -off - 1;
|
ptr_limit = -off - 1;
|
||||||
return *ptr_limit >= max ? -ERANGE : 0;
|
break;
|
||||||
case PTR_TO_MAP_VALUE:
|
case PTR_TO_MAP_VALUE:
|
||||||
max = ptr_reg->map_ptr->value_size;
|
max = ptr_reg->map_ptr->value_size;
|
||||||
if (mask_to_left) {
|
if (mask_to_left) {
|
||||||
*ptr_limit = ptr_reg->umax_value + ptr_reg->off;
|
ptr_limit = ptr_reg->umax_value + ptr_reg->off;
|
||||||
} else {
|
} else {
|
||||||
off = ptr_reg->smin_value + ptr_reg->off;
|
off = ptr_reg->smin_value + ptr_reg->off;
|
||||||
*ptr_limit = ptr_reg->map_ptr->value_size - off - 1;
|
ptr_limit = ptr_reg->map_ptr->value_size - off - 1;
|
||||||
}
|
}
|
||||||
return *ptr_limit >= max ? -ERANGE : 0;
|
break;
|
||||||
default:
|
default:
|
||||||
return -EINVAL;
|
return -EINVAL;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
if (ptr_limit >= max)
|
||||||
|
return -ERANGE;
|
||||||
|
*alu_limit = ptr_limit;
|
||||||
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
static bool can_skip_alu_sanitation(const struct bpf_verifier_env *env,
|
static bool can_skip_alu_sanitation(const struct bpf_verifier_env *env,
|
||||||
|
|
Loading…
Reference in a new issue