Commit b658bbb8 authored by Daniel Borkmann's avatar Daniel Borkmann
Browse files

bpf: Rework ptr_limit into alu_limit and add common error path 



Small refactor with no semantic changes in order to consolidate the max
ptr_limit boundary check.

Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Reviewed-by: default avatarJohn Fastabend <john.fastabend@gmail.com>
Acked-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent 24c109bb

kernel/bpf/verifier.c

+13 −8
Original line number Diff line number Diff line
@@ -5858,12 +5858,12 @@ static struct bpf_insn_aux_data *cur_aux(struct bpf_verifier_env *env) 


static int retrieve_ptr_limit(const struct bpf_reg_state *ptr_reg,

			      const struct bpf_reg_state *off_reg,

			      u32 *ptr_limit, u8 opcode)

			      u32 *alu_limit, u8 opcode)

{

	bool off_is_neg = off_reg->smin_value < 0;

	bool mask_to_left = (opcode == BPF_ADD &&  off_is_neg) ||

			    (opcode == BPF_SUB && !off_is_neg);

	u32 off, max;

	u32 off, max = 0, ptr_limit = 0;



	if (!tnum_is_const(off_reg->var_off) &&

	    (off_reg->smin_value < 0) != (off_reg->smax_value < 0))
@@ -5880,22 +5880,27 @@ static int retrieve_ptr_limit(const struct bpf_reg_state *ptr_reg, 
		 */

		off = ptr_reg->off + ptr_reg->var_off.value;

		if (mask_to_left)

			*ptr_limit = MAX_BPF_STACK + off;

			ptr_limit = MAX_BPF_STACK + off;

		else

			*ptr_limit = -off - 1;

		return *ptr_limit >= max ? -ERANGE : 0;

			ptr_limit = -off - 1;

		break;

	case PTR_TO_MAP_VALUE:

		max = ptr_reg->map_ptr->value_size;

		if (mask_to_left) {

			*ptr_limit = ptr_reg->umax_value + ptr_reg->off;

			ptr_limit = ptr_reg->umax_value + ptr_reg->off;

		} else {

			off = ptr_reg->smin_value + ptr_reg->off;

			*ptr_limit = ptr_reg->map_ptr->value_size - off - 1;

			ptr_limit = ptr_reg->map_ptr->value_size - off - 1;

		}

		return *ptr_limit >= max ? -ERANGE : 0;

		break;

	default:

		return -EINVAL;

	}



	if (ptr_limit >= max)

		return -ERANGE;

	*alu_limit = ptr_limit;

	return 0;

}



static bool can_skip_alu_sanitation(const struct bpf_verifier_env *env,