diff options
| author | Edward Cree <ecree@solarflare.com> | 2018-11-16 12:00:07 +0000 |
|---|---|---|
| committer | Alexei Starovoitov <ast@kernel.org> | 2018-11-16 21:10:00 -0800 |
| commit | afd594240806acc138cf696c09f2f4829d55d02f (patch) | |
| tree | 88202cf526afbabd2388e3eec49ade42e36c8457 /kernel/bpf/verifier.c | |
| parent | da85d8bfd1512461bcfb64929e8426cf340b3707 (diff) | |
| download | linux-afd594240806acc138cf696c09f2f4829d55d02f.tar.gz linux-afd594240806acc138cf696c09f2f4829d55d02f.tar.bz2 linux-afd594240806acc138cf696c09f2f4829d55d02f.zip | |
bpf: fix off-by-one error in adjust_subprog_starts
When patching in a new sequence for the first insn of a subprog, the start
of that subprog does not change (it's the first insn of the sequence), so
adjust_subprog_starts should check start <= off (rather than < off).
Also added a test to test_verifier.c (it's essentially the syz reproducer).
Fixes: cc8b0b92a169 ("bpf: introduce function calls (function boundaries)")
Reported-by: syzbot+4fc427c7af994b0948be@syzkaller.appspotmail.com
Signed-off-by: Edward Cree <ecree@solarflare.com>
Acked-by: Yonghong Song <yhs@fb.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Diffstat (limited to 'kernel/bpf/verifier.c')
| -rw-r--r-- | kernel/bpf/verifier.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 1971ca325fb4..6dd419550aba 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -5650,7 +5650,7 @@ static void adjust_subprog_starts(struct bpf_verifier_env *env, u32 off, u32 len return; /* NOTE: fake 'exit' subprog should be updated as well. */ for (i = 0; i <= env->subprog_cnt; i++) { - if (env->subprog_info[i].start < off) + if (env->subprog_info[i].start <= off) continue; env->subprog_info[i].start += len - 1; } |