From: David Miller <davem@davemloft.net>
To: ecree@solarflare.com
Cc: daniel@iogearbox.net, ast@fb.com, netdev@vger.kernel.org
Subject: Re: Bug with BPF_ALU64 | BPF_END?
Date: Thu, 14 Sep 2017 11:14:24 -0700 (PDT) [thread overview]
Message-ID: <20170914.111424.934672262035736390.davem@davemloft.net> (raw)
In-Reply-To: <52c7df55-84d9-f6d2-ed84-51ac90eb6bcc@solarflare.com>
From: Edward Cree <ecree@solarflare.com>
Date: Thu, 14 Sep 2017 18:53:17 +0100
> Is BPF_END supposed to only be used with BPF_ALU, never with BPF_ALU64?
> In kernel/bpf/core.c:___bpf_prog_run(), there are only jump table targets
> for the BPF_ALU case, not for the BPF_ALU64 case (opcodes 0xd7 and 0xdf).
> But the verifier doesn't enforce this; by crafting a program that uses
> these opcodes I can get a WARN when they're run (without JIT; it looks
> like the x86 JIT, at least, won't like it either).
> Proposed patch below the cut; build-tested only.
Good catch.
A really neat test would be a program that uploads random BPF programs
into the kernel, in a syzkaller'ish way. It might have triggered this
(eventually).
next prev parent reply other threads:[~2017-09-14 18:14 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-09-14 17:53 Bug with BPF_ALU64 | BPF_END? Edward Cree
2017-09-14 18:14 ` David Miller [this message]
2017-09-14 21:22 ` Y Song
2017-09-14 23:04 ` Daniel Borkmann
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170914.111424.934672262035736390.davem@davemloft.net \
--to=davem@davemloft.net \
--cc=ast@fb.com \
--cc=daniel@iogearbox.net \
--cc=ecree@solarflare.com \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox