Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b9848116 authored by Daniel Borkmann's avatar Daniel Borkmann Committed by Greg Kroah-Hartman
Browse files

bpf: Fix buggy rsh min/max bounds tracking 



[ no upstream commit ]

Fix incorrect bounds tracking for RSH opcode. Commit f23cc643 ("bpf: fix
range arithmetic for bpf map access") had a wrong assumption about min/max
bounds. The new dst_reg->min_value needs to be derived by right shifting the
max_val bounds, not min_val, and likewise new dst_reg->max_value needs to be
derived by right shifting the min_val bounds, not max_val. Later stable kernels
than 4.9 are not affected since bounds tracking was overall reworked and they
already track this similarly as in the fix.

Fixes: f23cc643 ("bpf: fix range arithmetic for bpf map access")
Reported-by: Ryota Shiga (Flatt Security)
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Reviewed-by: default avatarJohn Fastabend <john.fastabend@gmail.com>
Cc: Josef Bacik <jbacik@fb.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 20089f32

kernel/bpf/verifier.c

+3 −4
Original line number Diff line number Diff line
@@ -1732,12 +1732,11 @@ static void adjust_reg_min_max_vals(struct bpf_verifier_env *env, 
		 * unsigned shift, so make the appropriate casts.

		 */

		if (min_val < 0 || dst_reg->min_value < 0)

			dst_reg->min_value = BPF_REGISTER_MIN_RANGE;

			reset_reg_range_values(regs, insn->dst_reg);

		else

			dst_reg->min_value =

				(u64)(dst_reg->min_value) >> min_val;

			dst_reg->min_value = (u64)(dst_reg->min_value) >> max_val;

		if (dst_reg->max_value != BPF_REGISTER_MAX_RANGE)

			dst_reg->max_value >>= max_val;

			dst_reg->max_value >>= min_val;

		break;

	default:

		reset_reg_range_values(regs, insn->dst_reg);