diff options
| author | Maxim Mikityanskiy <maximmi@nvidia.com> | 2021-11-30 20:16:07 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2021-12-14 10:16:53 +0100 |
| commit | e0d837ac05701a1a05c76f50647cf249d4871362 (patch) | |
| tree | 973b0d97dd78f2329b7108a8cabda71a14a59366 /kernel | |
| parent | 811a7576747760bcaf60502f096d1e6e91d566fa (diff) | |
| download | linux-e0d837ac05701a1a05c76f50647cf249d4871362.tar.gz linux-e0d837ac05701a1a05c76f50647cf249d4871362.tar.bz2 linux-e0d837ac05701a1a05c76f50647cf249d4871362.zip | |
bpf: Fix the off-by-two error in range markings
commit 2fa7d94afc1afbb4d702760c058dc2d7ed30f226 upstream.
The first commit cited below attempts to fix the off-by-one error that
appeared in some comparisons with an open range. Due to this error,
arithmetically equivalent pieces of code could get different verdicts
from the verifier, for example (pseudocode):
// 1. Passes the verifier:
if (data + 8 > data_end)
return early
read *(u64 *)data, i.e. [data; data+7]
// 2. Rejected by the verifier (should still pass):
if (data + 7 >= data_end)
return early
read *(u64 *)data, i.e. [data; data+7]
The attempted fix, however, shifts the range by one in a wrong
direction, so the bug not only remains, but also such piece of code
starts failing in the verifier:
// 3. Rejected by the verifier, but the check is stricter than in #1.
if (data + 8 >= data_end)
return early
read *(u64 *)data, i.e. [data; data+7]
The change performed by that fix converted an off-by-one bug into
off-by-two. The second commit cited below added the BPF selftests
written to ensure than code chunks like #3 are rejected, however,
they should be accepted.
This commit fixes the off-by-two error by adjusting new_range in the
right direction and fixes the tests by changing the range into the
one that should actually fail.
Fixes: fb2a311a31d3 ("bpf: fix off by one for range markings with L{T, E} patterns")
Fixes: b37242c773b2 ("bpf: add test cases to bpf selftests to cover all access tests")
Signed-off-by: Maxim Mikityanskiy <maximmi@nvidia.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20211130181607.593149-1-maximmi@nvidia.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'kernel')
| -rw-r--r-- | kernel/bpf/verifier.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 4a3333039bf2..08f0588fa832 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -2989,7 +2989,7 @@ static void find_good_pkt_pointers(struct bpf_verifier_state *state, new_range = dst_reg->off; if (range_right_open) - new_range--; + new_range++; /* Examples for register markings: * |