Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit aad2eeaf authored by Joe Stringer's avatar Joe Stringer Committed by Daniel Borkmann
Browse files

bpf: Simplify ptr_min_max_vals adjustment 



An upcoming commit will add another two pointer types that need very
similar behaviour, so generalise this function now.

Signed-off-by: default avatarJoe Stringer <joe@wand.net.nz>
Acked-by: default avatarAlexei Starovoitov <ast@kernel.org>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
parent f3709f69

kernel/bpf/verifier.c

+10 −12
Original line number Diff line number Diff line
@@ -2669,20 +2669,18 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env, 
		return -EACCES;

	}



	if (ptr_reg->type == PTR_TO_MAP_VALUE_OR_NULL) {

		verbose(env, "R%d pointer arithmetic on PTR_TO_MAP_VALUE_OR_NULL prohibited, null-check it first\n",

			dst);

		return -EACCES;

	}

	if (ptr_reg->type == CONST_PTR_TO_MAP) {

		verbose(env, "R%d pointer arithmetic on CONST_PTR_TO_MAP prohibited\n",

			dst);

	switch (ptr_reg->type) {

	case PTR_TO_MAP_VALUE_OR_NULL:

		verbose(env, "R%d pointer arithmetic on %s prohibited, null-check it first\n",

			dst, reg_type_str[ptr_reg->type]);

		return -EACCES;

	}

	if (ptr_reg->type == PTR_TO_PACKET_END) {

		verbose(env, "R%d pointer arithmetic on PTR_TO_PACKET_END prohibited\n",

			dst);

	case CONST_PTR_TO_MAP:

	case PTR_TO_PACKET_END:

		verbose(env, "R%d pointer arithmetic on %s prohibited\n",

			dst, reg_type_str[ptr_reg->type]);

		return -EACCES;

	default:

		break;

	}



	/* In case of 'scalar += pointer', dst_reg inherits pointer type and id.

tools/testing/selftests/bpf/test_verifier.c

+7 −7
Original line number Diff line number Diff line
@@ -3638,7 +3638,7 @@ static struct bpf_test tests[] = { 
			BPF_MOV64_IMM(BPF_REG_0, 0),

			BPF_EXIT_INSN(),

		},

		.errstr = "R3 pointer arithmetic on PTR_TO_PACKET_END",

		.errstr = "R3 pointer arithmetic on pkt_end",

		.result = REJECT,

		.prog_type = BPF_PROG_TYPE_SCHED_CLS,

	},
@@ -4896,7 +4896,7 @@ static struct bpf_test tests[] = { 
			BPF_EXIT_INSN(),

		},

		.fixup_map1 = { 4 },

		.errstr = "R4 pointer arithmetic on PTR_TO_MAP_VALUE_OR_NULL",

		.errstr = "R4 pointer arithmetic on map_value_or_null",

		.result = REJECT,

		.prog_type = BPF_PROG_TYPE_SCHED_CLS

	},
@@ -4917,7 +4917,7 @@ static struct bpf_test tests[] = { 
			BPF_EXIT_INSN(),

		},

		.fixup_map1 = { 4 },

		.errstr = "R4 pointer arithmetic on PTR_TO_MAP_VALUE_OR_NULL",

		.errstr = "R4 pointer arithmetic on map_value_or_null",

		.result = REJECT,

		.prog_type = BPF_PROG_TYPE_SCHED_CLS

	},
@@ -4938,7 +4938,7 @@ static struct bpf_test tests[] = { 
			BPF_EXIT_INSN(),

		},

		.fixup_map1 = { 4 },

		.errstr = "R4 pointer arithmetic on PTR_TO_MAP_VALUE_OR_NULL",

		.errstr = "R4 pointer arithmetic on map_value_or_null",

		.result = REJECT,

		.prog_type = BPF_PROG_TYPE_SCHED_CLS

	},
@@ -7253,7 +7253,7 @@ static struct bpf_test tests[] = { 
			BPF_EXIT_INSN(),

		},

		.fixup_map_in_map = { 3 },

		.errstr = "R1 pointer arithmetic on CONST_PTR_TO_MAP prohibited",

		.errstr = "R1 pointer arithmetic on map_ptr prohibited",

		.result = REJECT,

	},

	{
@@ -8927,7 +8927,7 @@ static struct bpf_test tests[] = { 
			BPF_MOV64_IMM(BPF_REG_0, 0),

			BPF_EXIT_INSN(),

		},

		.errstr = "R3 pointer arithmetic on PTR_TO_PACKET_END",

		.errstr = "R3 pointer arithmetic on pkt_end",

		.result = REJECT,

		.prog_type = BPF_PROG_TYPE_XDP,

	},
@@ -8946,7 +8946,7 @@ static struct bpf_test tests[] = { 
			BPF_MOV64_IMM(BPF_REG_0, 0),

			BPF_EXIT_INSN(),

		},

		.errstr = "R3 pointer arithmetic on PTR_TO_PACKET_END",

		.errstr = "R3 pointer arithmetic on pkt_end",

		.result = REJECT,

		.prog_type = BPF_PROG_TYPE_XDP,

	},