Commit b5871dca authored by Piotr Krysiuk's avatar Piotr Krysiuk Committed by Daniel Borkmann
Browse files

bpf: Simplify alu_limit masking for pointer arithmetic 



Instead of having the mov32 with aux->alu_limit - 1 immediate, move this
operation to retrieve_ptr_limit() instead to simplify the logic and to
allow for subsequent sanity boundary checks inside retrieve_ptr_limit().
This avoids in future that at the time of the verifier masking rewrite
we'd run into an underflow which would not sign extend due to the nature
of mov32 instruction.

Signed-off-by: default avatarPiotr Krysiuk <piotras@gmail.com>
Co-developed-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Acked-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent 10d2bb2e

kernel/bpf/verifier.c

+5 −5
Original line number Diff line number Diff line
@@ -5870,16 +5870,16 @@ static int retrieve_ptr_limit(const struct bpf_reg_state *ptr_reg, 
		 */

		off = ptr_reg->off + ptr_reg->var_off.value;

		if (mask_to_left)

			*ptr_limit = MAX_BPF_STACK + off + 1;

			*ptr_limit = MAX_BPF_STACK + off;

		else

			*ptr_limit = -off;

			*ptr_limit = -off - 1;

		return 0;

	case PTR_TO_MAP_VALUE:

		if (mask_to_left) {

			*ptr_limit = ptr_reg->umax_value + ptr_reg->off + 1;

			*ptr_limit = ptr_reg->umax_value + ptr_reg->off;

		} else {

			off = ptr_reg->smin_value + ptr_reg->off;

			*ptr_limit = ptr_reg->map_ptr->value_size - off;

			*ptr_limit = ptr_reg->map_ptr->value_size - off - 1;

		}

		return 0;

	default:
@@ -11668,7 +11668,7 @@ static int fixup_bpf_calls(struct bpf_verifier_env *env) 
			off_reg = issrc ? insn->src_reg : insn->dst_reg;

			if (isneg)

				*patch++ = BPF_ALU64_IMM(BPF_MUL, off_reg, -1);

			*patch++ = BPF_MOV32_IMM(BPF_REG_AX, aux->alu_limit - 1);

			*patch++ = BPF_MOV32_IMM(BPF_REG_AX, aux->alu_limit);

			*patch++ = BPF_ALU64_REG(BPF_SUB, BPF_REG_AX, off_reg);

			*patch++ = BPF_ALU64_REG(BPF_OR, BPF_REG_AX, off_reg);

			*patch++ = BPF_ALU64_IMM(BPF_NEG, BPF_REG_AX, 0);