Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 63dfef75 authored by William Tu's avatar William Tu Committed by David S. Miller
Browse files

bpf: enable verifier to add 0 to packet ptr 



The patch fixes the case when adding a zero value to the packet
pointer.  The zero value could come from src_reg equals type
BPF_K or CONST_IMM.  The patch fixes both, otherwise the verifer
reports the following error:
  [...]
    R0=imm0,min_value=0,max_value=0
    R1=pkt(id=0,off=0,r=4)
    R2=pkt_end R3=fp-12
    R4=imm4,min_value=4,max_value=4
    R5=pkt(id=0,off=4,r=4)
  269: (bf) r2 = r0     // r2 becomes imm0
  270: (77) r2 >>= 3
  271: (bf) r4 = r1     // r4 becomes pkt ptr
  272: (0f) r4 += r2    // r4 += 0
  addition of negative constant to packet pointer is not allowed

Signed-off-by: default avatarWilliam Tu <u9012063@gmail.com>
Signed-off-by: default avatarMihai Budiu <mbudiu@vmware.com>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Alexei Starovoitov <ast@kernel.org>
Acked-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Acked-by: default avatarAlexei Starovoitov <ast@kernel.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 29200c19

kernel/bpf/verifier.c

+1 −1
Original line number Diff line number Diff line
@@ -1397,7 +1397,7 @@ static int check_packet_ptr_add(struct bpf_verifier_env *env, 
		imm = insn->imm;



add_imm:

		if (imm <= 0) {

		if (imm < 0) {

			verbose("addition of negative constant to packet pointer is not allowed\n");

			return -EACCES;

		}

tools/testing/selftests/bpf/test_verifier.c

+23 −0
Original line number Diff line number Diff line
@@ -2403,6 +2403,29 @@ static struct bpf_test tests[] = { 
		.result = ACCEPT,

		.prog_type = BPF_PROG_TYPE_SCHED_CLS,

	},

	{

		"direct packet access: test14 (pkt_ptr += 0, CONST_IMM, good access)",

		.insns = {

			BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,

				    offsetof(struct __sk_buff, data)),

			BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,

				    offsetof(struct __sk_buff, data_end)),

			BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),

			BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),

			BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 7),

			BPF_MOV64_IMM(BPF_REG_5, 12),

			BPF_ALU64_IMM(BPF_RSH, BPF_REG_5, 4),

			BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),

			BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),

			BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_6, 0),

			BPF_MOV64_IMM(BPF_REG_0, 1),

			BPF_EXIT_INSN(),

			BPF_MOV64_IMM(BPF_REG_0, 0),

			BPF_EXIT_INSN(),

		},

		.result = ACCEPT,

		.prog_type = BPF_PROG_TYPE_SCHED_CLS,

	},

	{

		"helper access to packet: test1, valid packet_ptr range",

		.insns = {