From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5780210942; Mon, 13 Oct 2025 15:16:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760368615; cv=none; b=IApUvosBd3erhJ/DHp6LdTU4n3HikF9zX892Bvgmzn393+cGfhEit8qsPfABBMP+pToaQ/4pW02wEBhOTsQFZ8UTXDBhWdII4T8asucK0WMjM6G2cMFxmpy+vYDUI7ZNau5RnECZeVrAtL0lcj+WVSrweP+BRZjPLCgRszY91b4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760368615; c=relaxed/simple; bh=SfbFCdwXFHxdhFEzD+/sg7mjc538JQ8D+gb1ufsBS5E=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Fef7D3GfXUtsklKvW1fmRIoMnzyFLHeztmkWKYit2QyraYvImC31d/brY/nu1V+q3UzJUU7ULDRqleifpwPgo8AZSgmFdTPpfTMXaOzOpLSE6WzQQ054IJ/Is0udFPdDUcv/PSUgHvq//gdrcKEfu2sxPpc2jeU/qFVJVoVD/b8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=uOkjTsnL; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="uOkjTsnL" Received: by smtp.kernel.org (Postfix) with ESMTPSA id D86A9C4CEE7; Mon, 13 Oct 2025 15:16:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1760368615; bh=SfbFCdwXFHxdhFEzD+/sg7mjc538JQ8D+gb1ufsBS5E=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=uOkjTsnLE1zVsxPaPqJyrJbL+m9bSDBRnyvgyEif5JTUx1HDQErVF8+1XWr+4mJQZ 1EGqrKnWJ1FSFSEVzXvDMOrhcN/oL0C824gp6regWZWrKIamn+kQhTDNqdvNySMKk9 hxtIe7nifnn9wtIcJevAVfI4Uw1T5ijq8NtmfZQc= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Shenghao Yuan , Tianci Cao , Yazhou Tang , Yonghong Song , Alexei Starovoitov , Sasha Levin Subject: [PATCH 6.12 223/262] bpf: Reject negative offsets for ALU ops Date: Mon, 13 Oct 2025 16:46:05 +0200 Message-ID: <20251013144334.273455057@linuxfoundation.org> X-Mailer: git-send-email 2.51.0 In-Reply-To: <20251013144326.116493600@linuxfoundation.org> References: <20251013144326.116493600@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.12-stable review patch. If anyone has any objections, please let me know. ------------------ From: Yazhou Tang [ Upstream commit 55c0ced59fe17dee34e9dfd5f7be63cbab207758 ] When verifying BPF programs, the check_alu_op() function validates instructions with ALU operations. The 'offset' field in these instructions is a signed 16-bit integer. The existing check 'insn->off > 1' was intended to ensure the offset is either 0, or 1 for BPF_MOD/BPF_DIV. However, because 'insn->off' is signed, this check incorrectly accepts all negative values (e.g., -1). This commit tightens the validation by changing the condition to '(insn->off != 0 && insn->off != 1)'. This ensures that any value other than the explicitly permitted 0 and 1 is rejected, hardening the verifier against malformed BPF programs. Co-developed-by: Shenghao Yuan Signed-off-by: Shenghao Yuan Co-developed-by: Tianci Cao Signed-off-by: Tianci Cao Signed-off-by: Yazhou Tang Acked-by: Yonghong Song Fixes: ec0e2da95f72 ("bpf: Support new signed div/mod instructions.") Link: https://lore.kernel.org/r/tencent_70D024BAE70A0A309A4781694C7B764B0608@qq.com Signed-off-by: Alexei Starovoitov Signed-off-by: Sasha Levin --- kernel/bpf/verifier.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 1829f62a74a9e..96640a80fd9c4 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -14545,7 +14545,7 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn) } else { /* all other ALU ops: and, sub, xor, add, ... */ if (BPF_SRC(insn->code) == BPF_X) { - if (insn->imm != 0 || insn->off > 1 || + if (insn->imm != 0 || (insn->off != 0 && insn->off != 1) || (insn->off == 1 && opcode != BPF_MOD && opcode != BPF_DIV)) { verbose(env, "BPF_ALU uses reserved fields\n"); return -EINVAL; @@ -14555,7 +14555,7 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn) if (err) return err; } else { - if (insn->src_reg != BPF_REG_0 || insn->off > 1 || + if (insn->src_reg != BPF_REG_0 || (insn->off != 0 && insn->off != 1) || (insn->off == 1 && opcode != BPF_MOD && opcode != BPF_DIV)) { verbose(env, "BPF_ALU uses reserved fields\n"); return -EINVAL; -- 2.51.0