From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-sn1nam02on0126.outbound.protection.outlook.com ([104.47.36.126]:27641 "EHLO NAM02-SN1-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1032298AbeCAPcN (ORCPT ); Thu, 1 Mar 2018 10:32:13 -0500 From: Sasha Levin To: "stable@vger.kernel.org" , "stable-commits@vger.kernel.org" CC: Daniel Borkmann , Alexei Starovoitov , Sasha Levin Subject: [added to the 4.1 stable tree] bpf: arsh is not supported in 32 bit alu thus reject it Date: Thu, 1 Mar 2018 15:25:16 +0000 Message-ID: <20180301152116.1486-252-alexander.levin@microsoft.com> References: <20180301152116.1486-1-alexander.levin@microsoft.com> In-Reply-To: <20180301152116.1486-1-alexander.levin@microsoft.com> Content-Language: en-US Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org List-ID: From: Daniel Borkmann This patch has been added to the 4.1 stable tree. If you have any objections, please let us know. =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D [ Upstream commit 7891a87efc7116590eaba57acc3c422487802c6f ] The following snippet was throwing an 'unknown opcode cc' warning in BPF interpreter: 0: (18) r0 =3D 0x0 2: (7b) *(u64 *)(r10 -16) =3D r0 3: (cc) (u32) r0 s>>=3D (u32) r0 4: (95) exit Although a number of JITs do support BPF_ALU | BPF_ARSH | BPF_{K,X} generation, not all of them do and interpreter does neither. We can leave existing ones and implement it later in bpf-next for the remaining ones, but reject this properly in verifier for the time being. Fixes: 17a5267067f3 ("bpf: verifier (add verifier core)") Reported-by: syzbot+93c4904c5c70348a6890@syzkaller.appspotmail.com Signed-off-by: Daniel Borkmann Signed-off-by: Alexei Starovoitov Signed-off-by: Sasha Levin --- kernel/bpf/verifier.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 1bdc6f910a1d..03d74868c709 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -1020,6 +1020,11 @@ static int check_alu_op(struct reg_state *regs, stru= ct bpf_insn *insn) return -EINVAL; } =20 + if (opcode =3D=3D BPF_ARSH && BPF_CLASS(insn->code) !=3D BPF_ALU64) { + verbose("BPF_ARSH not supported for 32 bit ALU\n"); + return -EINVAL; + } + if ((opcode =3D=3D BPF_LSH || opcode =3D=3D BPF_RSH || opcode =3D=3D BPF_ARSH) && BPF_SRC(insn->code) =3D=3D BPF_K) { int size =3D BPF_CLASS(insn->code) =3D=3D BPF_ALU64 ? 64 : 32; --=20 2.14.1