diff options
| author | Edward Cree <ecree@solarflare.com> | 2018-11-16 12:00:07 +0000 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2018-12-17 09:24:42 +0100 |
| commit | bddeb44981c1f5dd699ff45cce6ce31e59c0300c (patch) | |
| tree | c681bbdef17036d15f2fd454ac43710d139232c9 /kernel/bpf | |
| parent | 1fd99ac175e63102876c6ae135c06c72575c5d24 (diff) | |
| download | linux-stable-bddeb44981c1f5dd699ff45cce6ce31e59c0300c.tar.gz linux-stable-bddeb44981c1f5dd699ff45cce6ce31e59c0300c.tar.bz2 linux-stable-bddeb44981c1f5dd699ff45cce6ce31e59c0300c.zip | |
bpf: fix off-by-one error in adjust_subprog_starts
commit afd594240806acc138cf696c09f2f4829d55d02f upstream.
When patching in a new sequence for the first insn of a subprog, the start
of that subprog does not change (it's the first insn of the sequence), so
adjust_subprog_starts should check start <= off (rather than < off).
Also added a test to test_verifier.c (it's essentially the syz reproducer).
Fixes: cc8b0b92a169 ("bpf: introduce function calls (function boundaries)")
Reported-by: syzbot+4fc427c7af994b0948be@syzkaller.appspotmail.com
Signed-off-by: Edward Cree <ecree@solarflare.com>
Acked-by: Yonghong Song <yhs@fb.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'kernel/bpf')
| -rw-r--r-- | kernel/bpf/verifier.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 5780876ac81a..56acfbb80104 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -5283,7 +5283,7 @@ static void adjust_subprog_starts(struct bpf_verifier_env *env, u32 off, u32 len return; /* NOTE: fake 'exit' subprog should be updated as well. */ for (i = 0; i <= env->subprog_cnt; i++) { - if (env->subprog_info[i].start < off) + if (env->subprog_info[i].start <= off) continue; env->subprog_info[i].start += len - 1; } |