* [PATCH net] bpf/verifier: reject invalid LD_ABS | BPF_DW instruction
@ 2016-04-12 17:26 Alexei Starovoitov
2016-04-14 5:32 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: Alexei Starovoitov @ 2016-04-12 17:26 UTC (permalink / raw)
To: David S . Miller; +Cc: Daniel Borkmann, netdev
verifier must check for reserved size bits in instruction opcode and
reject BPF_LD | BPF_ABS | BPF_DW and BPF_LD | BPF_IND | BPF_DW instructions,
otherwise interpreter will WARN_RATELIMIT on them during execution.
Fixes: ddd872bc3098 ("bpf: verifier: add checks for BPF_ABS | BPF_IND instructions")
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
---
kernel/bpf/verifier.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 2e08f8e9b771..618ef77c302a 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -1374,6 +1374,7 @@ static int check_ld_abs(struct verifier_env *env, struct bpf_insn *insn)
}
if (insn->dst_reg != BPF_REG_0 || insn->off != 0 ||
+ BPF_SIZE(insn->code) == BPF_DW ||
(mode == BPF_ABS && insn->src_reg != BPF_REG_0)) {
verbose("BPF_LD_ABS uses reserved fields\n");
return -EINVAL;
--
2.8.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH net] bpf/verifier: reject invalid LD_ABS | BPF_DW instruction
2016-04-12 17:26 [PATCH net] bpf/verifier: reject invalid LD_ABS | BPF_DW instruction Alexei Starovoitov
@ 2016-04-14 5:32 ` David Miller
0 siblings, 0 replies; 2+ messages in thread
From: David Miller @ 2016-04-14 5:32 UTC (permalink / raw)
To: ast; +Cc: daniel, netdev
From: Alexei Starovoitov <ast@fb.com>
Date: Tue, 12 Apr 2016 10:26:19 -0700
> verifier must check for reserved size bits in instruction opcode and
> reject BPF_LD | BPF_ABS | BPF_DW and BPF_LD | BPF_IND | BPF_DW instructions,
> otherwise interpreter will WARN_RATELIMIT on them during execution.
>
> Fixes: ddd872bc3098 ("bpf: verifier: add checks for BPF_ABS | BPF_IND instructions")
> Signed-off-by: Alexei Starovoitov <ast@kernel.org>
> Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Applied and queued up for -stable, thanks.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2016-04-14 5:32 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-04-12 17:26 [PATCH net] bpf/verifier: reject invalid LD_ABS | BPF_DW instruction Alexei Starovoitov
2016-04-14 5:32 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).