diff options
Diffstat (limited to 'debian/patches/bugfix/all/bpf-Simplify-alu_limit-masking-for-pointer-arithmeti.patch')
| -rw-r--r-- | debian/patches/bugfix/all/bpf-Simplify-alu_limit-masking-for-pointer-arithmeti.patch | 57 |
1 files changed, 57 insertions, 0 deletions
diff --git a/debian/patches/bugfix/all/bpf-Simplify-alu_limit-masking-for-pointer-arithmeti.patch b/debian/patches/bugfix/all/bpf-Simplify-alu_limit-masking-for-pointer-arithmeti.patch new file mode 100644 index 000000000..e743118cb --- /dev/null +++ b/debian/patches/bugfix/all/bpf-Simplify-alu_limit-masking-for-pointer-arithmeti.patch @@ -0,0 +1,57 @@ +From: Piotr Krysiuk <piotras@gmail.com> +Date: Tue, 16 Mar 2021 08:26:25 +0100 +Subject: bpf: Simplify alu_limit masking for pointer arithmetic +Origin: https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf.git/commit?id=b5871dca250cd391885218b99cc015aca1a51aea + +Instead of having the mov32 with aux->alu_limit - 1 immediate, move this +operation to retrieve_ptr_limit() instead to simplify the logic and to +allow for subsequent sanity boundary checks inside retrieve_ptr_limit(). +This avoids in future that at the time of the verifier masking rewrite +we'd run into an underflow which would not sign extend due to the nature +of mov32 instruction. + +Signed-off-by: Piotr Krysiuk <piotras@gmail.com> +Co-developed-by: Daniel Borkmann <daniel@iogearbox.net> +Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> +Acked-by: Alexei Starovoitov <ast@kernel.org> +--- + kernel/bpf/verifier.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 56c63658b702..d16722a99b61 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -5870,16 +5870,16 @@ static int retrieve_ptr_limit(const struct bpf_reg_state *ptr_reg, + */ + off = ptr_reg->off + ptr_reg->var_off.value; + if (mask_to_left) +- *ptr_limit = MAX_BPF_STACK + off + 1; ++ *ptr_limit = MAX_BPF_STACK + off; + else +- *ptr_limit = -off; ++ *ptr_limit = -off - 1; + return 0; + case PTR_TO_MAP_VALUE: + if (mask_to_left) { +- *ptr_limit = ptr_reg->umax_value + ptr_reg->off + 1; ++ *ptr_limit = ptr_reg->umax_value + ptr_reg->off; + } else { + off = ptr_reg->smin_value + ptr_reg->off; +- *ptr_limit = ptr_reg->map_ptr->value_size - off; ++ *ptr_limit = ptr_reg->map_ptr->value_size - off - 1; + } + return 0; + default: +@@ -11668,7 +11668,7 @@ static int fixup_bpf_calls(struct bpf_verifier_env *env) + off_reg = issrc ? insn->src_reg : insn->dst_reg; + if (isneg) + *patch++ = BPF_ALU64_IMM(BPF_MUL, off_reg, -1); +- *patch++ = BPF_MOV32_IMM(BPF_REG_AX, aux->alu_limit - 1); ++ *patch++ = BPF_MOV32_IMM(BPF_REG_AX, aux->alu_limit); + *patch++ = BPF_ALU64_REG(BPF_SUB, BPF_REG_AX, off_reg); + *patch++ = BPF_ALU64_REG(BPF_OR, BPF_REG_AX, off_reg); + *patch++ = BPF_ALU64_IMM(BPF_NEG, BPF_REG_AX, 0); +-- +2.31.0 + |