From mboxrd@z Thu Jan 1 00:00:00 1970 From: Arnaldo Carvalho de Melo Subject: Re: Help with the BPF verifier Date: Thu, 1 Nov 2018 16:13:10 -0300 Message-ID: <20181101191310.GB20495@kernel.org> References: <20181101185217.GA20495@kernel.org> <20181101.121039.2134340499361533233.davem@davemloft.net> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: yhs@fb.com, daniel@iogearbox.net, jolsa@redhat.com, kafai@fb.com, alexei.starovoitov@gmail.com, netdev@vger.kernel.org To: David Miller Return-path: Received: from mail.kernel.org ([198.145.29.99]:46322 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726594AbeKBERa (ORCPT ); Fri, 2 Nov 2018 00:17:30 -0400 Content-Disposition: inline In-Reply-To: <20181101.121039.2134340499361533233.davem@davemloft.net> Sender: netdev-owner@vger.kernel.org List-ID: Em Thu, Nov 01, 2018 at 12:10:39PM -0700, David Miller escreveu: > From: Arnaldo Carvalho de Melo > Date: Thu, 1 Nov 2018 15:52:17 -0300 > > > 50 unsigned int filename_arg = 6; > ... > > --- /wb/augmented_raw_syscalls.c.old 2018-11-01 15:43:55.000394234 -0300 > > +++ /wb/augmented_raw_syscalls.c 2018-11-01 15:44:15.102367838 -0300 > > @@ -67,7 +67,7 @@ > > augmented_args.filename.reserved = 0; > > augmented_args.filename.size = probe_read_str(&augmented_args.filename.value, > > sizeof(augmented_args.filename.value), > > - (const void *)args->args[0]); > > + (const void *)args->args[filename_arg]); > > args[] is sized to '6', therefore the last valid index is '5', yet you're using '6' here which > is one entry past the end of the declared array. Nope... this is inside an if: if (filename_arg <= 5) { augmented_args.filename.reserved = 0; augmented_args.filename.size = probe_read_str(&augmented_args.filename.value, sizeof(augmented_args.filename.value), (const void *)args->args[filename_arg]); if (augmented_args.filename.size < sizeof(augmented_args.filename.value)) { len -= sizeof(augmented_args.filename.value) - augmented_args.filename.size; len &= sizeof(augmented_args.filename.value) - 1; } } else { I use 6 to mean "hey, this syscall doesn't have any string argument, don't bother with it". - Arnaldo