Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 59ee4129 authored by Daniel Borkmann's avatar Daniel Borkmann Committed by Alexei Starovoitov
Browse files

bpf: fix ldx in ld_abs rewrite for large offsets 



Mark reported that syzkaller triggered a KASAN detected slab-out-of-bounds
bug in ___bpf_prog_run() with a BPF_LD | BPF_ABS word load at offset 0x8001.
After further investigation it became clear that the issue was the
BPF_LDX_MEM() which takes offset as an argument whereas it cannot encode
larger than S16_MAX offsets into it. For this synthetical case we need to
move the full address into tmp register instead and do the LDX without
immediate value.

Fixes: e0cea7ce ("bpf: implement ld_abs/ld_ind in native bpf")
Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
Reported-by: default avatarMark Rutland <mark.rutland@arm.com>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent b9626f45

net/core/filter.c

+13 −3
Original line number Diff line number Diff line
@@ -459,11 +459,21 @@ static bool convert_bpf_ld_abs(struct sock_filter *fp, struct bpf_insn **insnp) 
	     (!unaligned_ok && offset >= 0 &&

	      offset + ip_align >= 0 &&

	      offset + ip_align % size == 0))) {

		bool ldx_off_ok = offset <= S16_MAX;



		*insn++ = BPF_MOV64_REG(BPF_REG_TMP, BPF_REG_H);

		*insn++ = BPF_ALU64_IMM(BPF_SUB, BPF_REG_TMP, offset);

		*insn++ = BPF_JMP_IMM(BPF_JSLT, BPF_REG_TMP, size, 2 + endian);

		*insn++ = BPF_LDX_MEM(BPF_SIZE(fp->code), BPF_REG_A, BPF_REG_D,

				      offset);

		*insn++ = BPF_JMP_IMM(BPF_JSLT, BPF_REG_TMP,

				      size, 2 + endian + (!ldx_off_ok * 2));

		if (ldx_off_ok) {

			*insn++ = BPF_LDX_MEM(BPF_SIZE(fp->code), BPF_REG_A,

					      BPF_REG_D, offset);

		} else {

			*insn++ = BPF_MOV64_REG(BPF_REG_TMP, BPF_REG_D);

			*insn++ = BPF_ALU64_IMM(BPF_ADD, BPF_REG_TMP, offset);

			*insn++ = BPF_LDX_MEM(BPF_SIZE(fp->code), BPF_REG_A,

					      BPF_REG_TMP, 0);

		}

		if (endian)

			*insn++ = BPF_ENDIAN(BPF_FROM_BE, BPF_REG_A, size * 8);

		*insn++ = BPF_JMP_A(8);