Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7891a87e authored by Daniel Borkmann's avatar Daniel Borkmann Committed by Alexei Starovoitov
Browse files

bpf: arsh is not supported in 32 bit alu thus reject it 



The following snippet was throwing an 'unknown opcode cc' warning
in BPF interpreter:

  0: (18) r0 = 0x0
  2: (7b) *(u64 *)(r10 -16) = r0
  3: (cc) (u32) r0 s>>= (u32) r0
  4: (95) exit

Although a number of JITs do support BPF_ALU | BPF_ARSH | BPF_{K,X}
generation, not all of them do and interpreter does neither. We can
leave existing ones and implement it later in bpf-next for the
remaining ones, but reject this properly in verifier for the time
being.

Fixes: 17a52670 ("bpf: verifier (add verifier core)")
Reported-by: default avatar <syzbot+93c4904c5c70348a6890@syzkaller.appspotmail.com>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent 40950343

kernel/bpf/verifier.c

+5 −0
Original line number Diff line number Diff line
@@ -2493,6 +2493,11 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn) 
			return -EINVAL;

		}



		if (opcode == BPF_ARSH && BPF_CLASS(insn->code) != BPF_ALU64) {

			verbose(env, "BPF_ARSH not supported for 32 bit ALU\n");

			return -EINVAL;

		}



		if ((opcode == BPF_LSH || opcode == BPF_RSH ||

		     opcode == BPF_ARSH) && BPF_SRC(insn->code) == BPF_K) {

			int size = BPF_CLASS(insn->code) == BPF_ALU64 ? 64 : 32;

tools/testing/selftests/bpf/test_verifier.c

+40 −0
Original line number Diff line number Diff line
@@ -272,6 +272,46 @@ static struct bpf_test tests[] = { 
		.errstr = "invalid bpf_ld_imm64 insn",

		.result = REJECT,

	},

	{

		"arsh32 on imm",

		.insns = {

			BPF_MOV64_IMM(BPF_REG_0, 1),

			BPF_ALU32_IMM(BPF_ARSH, BPF_REG_0, 5),

			BPF_EXIT_INSN(),

		},

		.result = REJECT,

		.errstr = "BPF_ARSH not supported for 32 bit ALU",

	},

	{

		"arsh32 on reg",

		.insns = {

			BPF_MOV64_IMM(BPF_REG_0, 1),

			BPF_MOV64_IMM(BPF_REG_1, 5),

			BPF_ALU32_REG(BPF_ARSH, BPF_REG_0, BPF_REG_1),

			BPF_EXIT_INSN(),

		},

		.result = REJECT,

		.errstr = "BPF_ARSH not supported for 32 bit ALU",

	},

	{

		"arsh64 on imm",

		.insns = {

			BPF_MOV64_IMM(BPF_REG_0, 1),

			BPF_ALU64_IMM(BPF_ARSH, BPF_REG_0, 5),

			BPF_EXIT_INSN(),

		},

		.result = ACCEPT,

	},

	{

		"arsh64 on reg",

		.insns = {

			BPF_MOV64_IMM(BPF_REG_0, 1),

			BPF_MOV64_IMM(BPF_REG_1, 5),

			BPF_ALU64_REG(BPF_ARSH, BPF_REG_0, BPF_REG_1),

			BPF_EXIT_INSN(),

		},

		.result = ACCEPT,

	},

	{

		"no bpf_exit",

		.insns = {