diff options
author | Luke Nelson <lukenels@cs.washington.edu> | 2020-04-09 15:17:52 -0700 |
---|---|---|
committer | Daniel Borkmann <daniel@iogearbox.net> | 2020-04-14 21:27:54 +0200 |
commit | 4178417cc5359c329790a4a8f4a6604612338cca (patch) | |
tree | 4816744db5c1f822f9a5b55822213b890617f660 /security/safesetid/Kconfig | |
parent | e154659ba39a1c2be576aaa0a5bda8088d707950 (diff) | |
download | linux-stable-4178417cc5359c329790a4a8f4a6604612338cca.tar.gz linux-stable-4178417cc5359c329790a4a8f4a6604612338cca.tar.bz2 linux-stable-4178417cc5359c329790a4a8f4a6604612338cca.zip |
arm, bpf: Fix offset overflow for BPF_MEM BPF_DW
This patch fixes an incorrect check in how immediate memory offsets are
computed for BPF_DW on arm.
For BPF_LDX/ST/STX + BPF_DW, the 32-bit arm JIT breaks down an 8-byte
access into two separate 4-byte accesses using off+0 and off+4. If off
fits in imm12, the JIT emits a ldr/str instruction with the immediate
and avoids the use of a temporary register. While the current check off
<= 0xfff ensures that the first immediate off+0 doesn't overflow imm12,
it's not sufficient for the second immediate off+4, which may cause the
second access of BPF_DW to read/write the wrong address.
This patch fixes the problem by changing the check to
off <= 0xfff - 4 for BPF_DW, ensuring off+4 will never overflow.
A side effect of simplifying the check is that it now allows using
negative immediate offsets in ldr/str. This means that small negative
offsets can also avoid the use of a temporary register.
This patch introduces no new failures in test_verifier or test_bpf.c.
Fixes: c5eae692571d6 ("ARM: net: bpf: improve 64-bit store implementation")
Fixes: ec19e02b343db ("ARM: net: bpf: fix LDX instructions")
Co-developed-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Xi Wang <xi.wang@gmail.com>
Signed-off-by: Luke Nelson <luke.r.nels@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20200409221752.28448-1-luke.r.nels@gmail.com
Diffstat (limited to 'security/safesetid/Kconfig')
0 files changed, 0 insertions, 0 deletions