Commit 0d004c02 authored by Lorenz Bauer's avatar Lorenz Bauer Committed by Alexei Starovoitov
Browse files

bpf: Check scalar or invalid register in check_helper_mem_access 



Move the check for a NULL or zero register to check_helper_mem_access. This
makes check_stack_boundary easier to understand.

Signed-off-by: default avatarLorenz Bauer <lmb@cloudflare.com>
Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
Acked-by: default avatarAndrii Nakryiko <andriin@fb.com>
Link: https://lore.kernel.org/bpf/20200921121227.255763-3-lmb@cloudflare.com
parent 2af30f11

kernel/bpf/verifier.c

+11 −13
Original line number Diff line number Diff line
@@ -3641,18 +3641,6 @@ static int check_stack_boundary(struct bpf_verifier_env *env, int regno, 
	struct bpf_func_state *state = func(env, reg);

	int err, min_off, max_off, i, j, slot, spi;



	if (reg->type != PTR_TO_STACK) {

		/* Allow zero-byte read from NULL, regardless of pointer type */

		if (zero_size_allowed && access_size == 0 &&

		    register_is_null(reg))

			return 0;



		verbose(env, "R%d type=%s expected=%s\n", regno,

			reg_type_str[reg->type],

			reg_type_str[PTR_TO_STACK]);

		return -EACCES;

	}



	if (tnum_is_const(reg->var_off)) {

		min_off = max_off = reg->var_off.value + reg->off;

		err = __check_stack_boundary(env, regno, min_off, access_size,
@@ -3797,9 +3785,19 @@ static int check_helper_mem_access(struct bpf_verifier_env *env, int regno, 
					   access_size, zero_size_allowed,

					   "rdwr",

					   &env->prog->aux->max_rdwr_access);

	default: /* scalar_value|ptr_to_stack or invalid ptr */

	case PTR_TO_STACK:

		return check_stack_boundary(env, regno, access_size,

					    zero_size_allowed, meta);

	default: /* scalar_value or invalid ptr */

		/* Allow zero-byte read from NULL, regardless of pointer type */

		if (zero_size_allowed && access_size == 0 &&

		    register_is_null(reg))

			return 0;



		verbose(env, "R%d type=%s expected=%s\n", regno,

			reg_type_str[reg->type],

			reg_type_str[PTR_TO_STACK]);

		return -EACCES;

	}

}