summaryrefslogtreecommitdiffstats
path: root/include
diff options
context:
space:
mode:
authorJosef Bacik <jbacik@fb.com>2016-11-14 15:45:36 -0500
committerDavid S. Miller <davem@davemloft.net>2016-11-16 13:21:45 -0500
commitf23cc643f9baec7f71f2b74692da3cf03abbbfda (patch)
tree7a4064ef679c1a0394386eaf5dc538c47c9007a7 /include
parentb3cfaa31e3851c743d3f9d3441710f7ff6f7e868 (diff)
downloadlinux-stable-f23cc643f9baec7f71f2b74692da3cf03abbbfda.tar.gz
linux-stable-f23cc643f9baec7f71f2b74692da3cf03abbbfda.tar.bz2
linux-stable-f23cc643f9baec7f71f2b74692da3cf03abbbfda.zip
bpf: fix range arithmetic for bpf map access
I made some invalid assumptions with BPF_AND and BPF_MOD that could result in invalid accesses to bpf map entries. Fix this up by doing a few things 1) Kill BPF_MOD support. This doesn't actually get used by the compiler in real life and just adds extra complexity. 2) Fix the logic for BPF_AND, don't allow AND of negative numbers and set the minimum value to 0 for positive AND's. 3) Don't do operations on the ranges if they are set to the limits, as they are by definition undefined, and allowing arithmetic operations on those values could make them appear valid when they really aren't. This fixes the testcase provided by Jann as well as a few other theoretical problems. Reported-by: Jann Horn <jannh@google.com> Signed-off-by: Josef Bacik <jbacik@fb.com> Acked-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'include')
-rw-r--r--include/linux/bpf_verifier.h5
1 files changed, 3 insertions, 2 deletions
diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h
index 7035b997aaa5..6aaf425cebc3 100644
--- a/include/linux/bpf_verifier.h
+++ b/include/linux/bpf_verifier.h
@@ -14,7 +14,7 @@
* are obviously wrong for any sort of memory access.
*/
#define BPF_REGISTER_MAX_RANGE (1024 * 1024 * 1024)
-#define BPF_REGISTER_MIN_RANGE -(1024 * 1024 * 1024)
+#define BPF_REGISTER_MIN_RANGE -1
struct bpf_reg_state {
enum bpf_reg_type type;
@@ -22,7 +22,8 @@ struct bpf_reg_state {
* Used to determine if any memory access using this register will
* result in a bad access.
*/
- u64 min_value, max_value;
+ s64 min_value;
+ u64 max_value;
union {
/* valid when type == CONST_IMM | PTR_TO_STACK | UNKNOWN_VALUE */
s64 imm;