Alexei Starovoitov 0ea3c23577 bpf: improve verifier packet range checks ...

[ Upstream commit b1977682a3 ]

llvm can optimize the 'if (ptr > data_end)' checks to be in the order
slightly different than the original C code which will confuse verifier.
Like:
if (ptr + 16 > data_end)
  return TC_ACT_SHOT;
// may be followed by
if (ptr + 14 > data_end)
  return TC_ACT_SHOT;
while llvm can see that 'ptr' is valid for all 16 bytes,
the verifier could not.
Fix verifier logic to account for such case and add a test.

Reported-by: Huapeng Zhou <hzhou@fb.com>
Fixes: 969bf05eb3 ("bpf: direct packet access")
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2017-05-03 08:36:35 -07:00

..

arraymap.c

bpf: Add bpf_current_task_under_cgroup helper

2016-08-12 21:49:41 -07:00

core.c

bpf: clean up put_cpu_var usage

2016-09-27 22:09:17 -04:00

hashtab.c

bpf: fix htab map destruction when extra reserve is in use

2016-11-07 13:20:52 -05:00

helpers.c

bpf: direct packet write and access for helpers for clsact progs

2016-09-20 23:32:11 -04:00

inode.c

fs: Replace CURRENT_TIME with current_time() for inode timestamps

2016-09-27 21:06:21 -04:00

Makefile

bpf: introduce percpu_freelist

2016-03-08 15:28:31 -05:00

percpu_freelist.c

bpf: introduce percpu_freelist

2016-03-08 15:28:31 -05:00

percpu_freelist.h

bpf: introduce percpu_freelist

2016-03-08 15:28:31 -05:00

stackmap.c

bpf: add BPF_CALL_x macros for declaring helpers

2016-09-09 19:36:04 -07:00

syscall.c

bpf: fix map not being uncharged during map creation failure

2016-11-07 13:22:26 -05:00

verifier.c

bpf: improve verifier packet range checks

2017-05-03 08:36:35 -07:00