[PATCH] bpf: fix array-index-out-of-bounds in print_bpf_insn

[Rik van Riel <riel@surriel.com>]

syzkaller triggers UBSAN array-index-out-of-bounds and panic_on_warn
panic in print_bpf_insn() when loading a BPF program containing
BPF_LDX | BPF_MEMSX | BPF_DW.

bpf_ldsx_string[] holds three entries for B/H/W (s8/s16/s32).
BPF_DW gives index 3 and reads past the array. check_subprogs()
prints the program via bpf_diag_program_structure() before
do_check() validates the instruction, so the illegal insn reaches
the disassembler.

    UBSAN: array-index-out-of-bounds in kernel/bpf/disasm.c:306:21
    index 3 is out of range for type 'char *[3]'
    print_bpf_insn+0x2328/0x2940 kernel/bpf/disasm.c:306
    format_disasm_line kernel/bpf/diagnostics.c:633
    diag_print_insn_context+0x3a5/0x930 kernel/bpf/diagnostics.c:783
    bpf_diag_source+0x615/0x14a0 kernel/bpf/diagnostics.c:896
    bpf_diag_program_structure+0x1f9/0x280 kernel/bpf/diagnostics.c:1215
    check_subprogs+0x5c3/0x650 kernel/bpf/verifier.c:3057
    bpf_check+0x1935/0x89f0 kernel/bpf/verifier.c:21097
    bpf_prog_load+0x17dd/0x2990 kernel/bpf/syscall.c:3133

Guard any size index beyond the corresponding string table and emit
BUG_ldx instead of accessing memory beyond the end of the the array.

Fixes: f835bb622299 ("bpf: Add kernel/bpftool asm support for new instructions")
Assisted-by: claw:muse-spark-1.2 syzkaller
Signed-off-by: Rik van Riel <riel@surriel.coM>
---
 kernel/bpf/disasm.c | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/kernel/bpf/disasm.c b/kernel/bpf/disasm.c
index 50b3ca5149a0..67bdda1c021c 100644
--- a/kernel/bpf/disasm.c
+++ b/kernel/bpf/disasm.c
@@ -295,15 +295,27 @@ void print_bpf_insn(const struct bpf_insn_cbs *cbs,
 			verbose(cbs->private_data, "BUG_st_%02x", insn->code);
 		}
 	} else if (class == BPF_LDX) {
+		unsigned int array_size = ARRAY_SIZE(bpf_ldsx_string);
+		unsigned int size_idx = BPF_SIZE(insn->code) >> 3;
+
 		if (BPF_MODE(insn->code) != BPF_MEM && BPF_MODE(insn->code) != BPF_MEMSX) {
 			verbose(cbs->private_data, "BUG_ldx_%02x", insn->code);
 			return;
 		}
+
+		if (BPF_MODE(insn->code) == BPF_MEM)
+			array_size = ARRAY_SIZE(bpf_ldst_string);
+
+		if (size_idx >= array_size) {
+			verbose(cbs->private_data, "BUG_ldx_%02x", insn->code);
+			return;
+		}
+
 		verbose(cbs->private_data, "(%02x) r%d = *(%s *)(r%d %+d)",
 			insn->code, insn->dst_reg,
 			BPF_MODE(insn->code) == BPF_MEM ?
-				 bpf_ldst_string[BPF_SIZE(insn->code) >> 3] :
-				 bpf_ldsx_string[BPF_SIZE(insn->code) >> 3],
+				 bpf_ldst_string[size_idx] :
+				 bpf_ldsx_string[size_idx],
 			insn->src_reg, insn->off);
 	} else if (class == BPF_LD) {
 		if (BPF_MODE(insn->code) == BPF_ABS) {
-- 
2.53.0-Meta