Unverified Commit 15aa5565 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!12943 bpf: Fix a sdiv overflow issue 

Merge Pull Request from: @ci-robot 
 
PR sync from: Xiaomeng Zhang <zhangxiaomeng13@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/R7DUJJPXI3UZIBSYQW3PFSE52OKXWHTK/ 
 
https://gitee.com/src-openeuler/kernel/issues/IAYRCO 
 
Link:https://gitee.com/openeuler/kernel/pulls/12943

 

Reviewed-by: default avatarXu Kuohai <xukuohai@huawei.com>
Signed-off-by: default avatarZhang Peng <zhangpeng362@huawei.com>
parents 38369e90 1153583e

kernel/bpf/verifier.c

+89 −4
Original line number Diff line number Diff line
@@ -18984,13 +18984,46 @@ static int do_misc_fixups(struct bpf_verifier_env *env) 
	int i, ret, cnt, delta = 0;









	for (i = 0; i < insn_cnt; i++, insn++) {









		/* Make divide-by-zero exceptions impossible. */









		/* Make sdiv/smod divide-by-minus-one exceptions impossible. */









		if ((insn->code == (BPF_ALU64 | BPF_MOD | BPF_K) ||









		     insn->code == (BPF_ALU64 | BPF_DIV | BPF_K) ||









		     insn->code == (BPF_ALU | BPF_MOD | BPF_K) ||









		     insn->code == (BPF_ALU | BPF_DIV | BPF_K)) &&









		    insn->off == 1 && insn->imm == -1) {









			bool is64 = BPF_CLASS(insn->code) == BPF_ALU64;









			bool isdiv = BPF_OP(insn->code) == BPF_DIV;









			struct bpf_insn *patchlet;









			struct bpf_insn chk_and_sdiv[] = {









				BPF_RAW_INSN((is64 ? BPF_ALU64 : BPF_ALU) |









					     BPF_NEG | BPF_K, insn->dst_reg,









					     0, 0, 0),









			};









			struct bpf_insn chk_and_smod[] = {









				BPF_MOV32_IMM(insn->dst_reg, 0),









			};

















			patchlet = isdiv ? chk_and_sdiv : chk_and_smod;









			cnt = isdiv ? ARRAY_SIZE(chk_and_sdiv) : ARRAY_SIZE(chk_and_smod);

















			new_prog = bpf_patch_insn_data(env, i + delta, patchlet, cnt);









			if (!new_prog)









				return -ENOMEM;

















			delta    += cnt - 1;









			env->prog = prog = new_prog;









			insn      = new_prog->insnsi + i + delta;









			continue;









		}

















		/* Make divide-by-zero and divide-by-minus-one exceptions impossible. */









		if (insn->code == (BPF_ALU64 | BPF_MOD | BPF_X) ||









		    insn->code == (BPF_ALU64 | BPF_DIV | BPF_X) ||









		    insn->code == (BPF_ALU | BPF_MOD | BPF_X) ||









		    insn->code == (BPF_ALU | BPF_DIV | BPF_X)) {









			bool is64 = BPF_CLASS(insn->code) == BPF_ALU64;









			bool isdiv = BPF_OP(insn->code) == BPF_DIV;









			bool is_sdiv = isdiv && insn->off == 1;









			bool is_smod = !isdiv && insn->off == 1;









			struct bpf_insn *patchlet;









			struct bpf_insn chk_and_div[] = {









				/* [R,W]x div 0 -> 0 */








@@ -19010,10 +19043,62 @@ static int do_misc_fixups(struct bpf_verifier_env *env)







				BPF_JMP_IMM(BPF_JA, 0, 0, 1),









				BPF_MOV32_REG(insn->dst_reg, insn->dst_reg),









			};









			struct bpf_insn chk_and_sdiv[] = {









				/* [R,W]x sdiv 0 -> 0









				 * LLONG_MIN sdiv -1 -> LLONG_MIN









				 * INT_MIN sdiv -1 -> INT_MIN









				 */









				BPF_MOV64_REG(BPF_REG_AX, insn->src_reg),









				BPF_RAW_INSN((is64 ? BPF_ALU64 : BPF_ALU) |









					     BPF_ADD | BPF_K, BPF_REG_AX,









					     0, 0, 1),









				BPF_RAW_INSN((is64 ? BPF_JMP : BPF_JMP32) |









					     BPF_JGT | BPF_K, BPF_REG_AX,









					     0, 4, 1),









				BPF_RAW_INSN((is64 ? BPF_JMP : BPF_JMP32) |









					     BPF_JEQ | BPF_K, BPF_REG_AX,









					     0, 1, 0),









				BPF_RAW_INSN((is64 ? BPF_ALU64 : BPF_ALU) |









					     BPF_MOV | BPF_K, insn->dst_reg,









					     0, 0, 0),









				/* BPF_NEG(LLONG_MIN) == -LLONG_MIN == LLONG_MIN */









				BPF_RAW_INSN((is64 ? BPF_ALU64 : BPF_ALU) |









					     BPF_NEG | BPF_K, insn->dst_reg,









					     0, 0, 0),









				BPF_JMP_IMM(BPF_JA, 0, 0, 1),









				*insn,









			};









			struct bpf_insn chk_and_smod[] = {









				/* [R,W]x mod 0 -> [R,W]x */









				/* [R,W]x mod -1 -> 0 */









				BPF_MOV64_REG(BPF_REG_AX, insn->src_reg),









				BPF_RAW_INSN((is64 ? BPF_ALU64 : BPF_ALU) |









					     BPF_ADD | BPF_K, BPF_REG_AX,









					     0, 0, 1),









				BPF_RAW_INSN((is64 ? BPF_JMP : BPF_JMP32) |









					     BPF_JGT | BPF_K, BPF_REG_AX,









					     0, 3, 1),









				BPF_RAW_INSN((is64 ? BPF_JMP : BPF_JMP32) |









					     BPF_JEQ | BPF_K, BPF_REG_AX,









					     0, 3 + (is64 ? 0 : 1), 1),









				BPF_MOV32_IMM(insn->dst_reg, 0),









				BPF_JMP_IMM(BPF_JA, 0, 0, 1),









				*insn,









				BPF_JMP_IMM(BPF_JA, 0, 0, 1),









				BPF_MOV32_REG(insn->dst_reg, insn->dst_reg),









			};

















			if (is_sdiv) {









				patchlet = chk_and_sdiv;









				cnt = ARRAY_SIZE(chk_and_sdiv);









			} else if (is_smod) {









				patchlet = chk_and_smod;









				cnt = ARRAY_SIZE(chk_and_smod) - (is64 ? 2 : 0);









			} else {









				patchlet = isdiv ? chk_and_div : chk_and_mod;









				cnt = isdiv ? ARRAY_SIZE(chk_and_div) :









					      ARRAY_SIZE(chk_and_mod) - (is64 ? 2 : 0);









			}

















			new_prog = bpf_patch_insn_data(env, i + delta, patchlet, cnt);









			if (!new_prog)