diff options
| author | Jiong Wang <jiong.wang@netronome.com> | 2018-11-08 04:08:42 -0500 |
|---|---|---|
| committer | Daniel Borkmann <daniel@iogearbox.net> | 2018-11-09 09:16:31 +0100 |
| commit | e647815a4d3b3be9d85b5750ed0f2947fd78fac7 (patch) | |
| tree | 3f5c73cd81f673cacdd375e1e3f5381b5ce1c296 /kernel | |
| parent | bce6a14996f991e570d973179b5ff57544efaa9a (diff) | |
| download | linux-stable-e647815a4d3b3be9d85b5750ed0f2947fd78fac7.tar.gz linux-stable-e647815a4d3b3be9d85b5750ed0f2947fd78fac7.tar.bz2 linux-stable-e647815a4d3b3be9d85b5750ed0f2947fd78fac7.zip | |
bpf: let verifier to calculate and record max_pkt_offset
In check_packet_access, update max_pkt_offset after the offset has passed
__check_packet_access.
It should be safe to use u32 for max_pkt_offset as explained in code
comment.
Also, when there is tail call, the max_pkt_offset of the called program is
unknown, so conservatively set max_pkt_offset to MAX_PACKET_OFF for such
case.
Reviewed-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Jiong Wang <jiong.wang@netronome.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Diffstat (limited to 'kernel')
| -rw-r--r-- | kernel/bpf/verifier.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 1971ca325fb4..75dab40b19a3 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -1455,6 +1455,17 @@ static int check_packet_access(struct bpf_verifier_env *env, u32 regno, int off, verbose(env, "R%d offset is outside of the packet\n", regno); return err; } + + /* __check_packet_access has made sure "off + size - 1" is within u16. + * reg->umax_value can't be bigger than MAX_PACKET_OFF which is 0xffff, + * otherwise find_good_pkt_pointers would have refused to set range info + * that __check_packet_access would have rejected this pkt access. + * Therefore, "off + reg->umax_value + size - 1" won't overflow u32. + */ + env->prog->aux->max_pkt_offset = + max_t(u32, env->prog->aux->max_pkt_offset, + off + reg->umax_value + size - 1); + return err; } @@ -6138,6 +6149,7 @@ static int fixup_bpf_calls(struct bpf_verifier_env *env) */ prog->cb_access = 1; env->prog->aux->stack_depth = MAX_BPF_STACK; + env->prog->aux->max_pkt_offset = MAX_PACKET_OFF; /* mark bpf_tail_call as different opcode to avoid * conditional branch in the interpeter for every normal |