Messages in this thread Patch in this message | | | From | Arnd Bergmann <> | Subject | [PATCH 2/2] [net-next] bpf: fix out-of-bounds access warning in bpf_check | Date | Thu, 2 Nov 2017 12:05:52 +0100 |
| |
The bpf_verifer_ops array is generated dynamically and may be empty depending on configuration, which then causes an out of bounds access:
kernel/bpf/verifier.c: In function 'bpf_check': kernel/bpf/verifier.c:4320:29: error: array subscript is above array bounds [-Werror=array-bounds]
This adds a check to the start of the function as a workaround. I would assume that the function is never called in that configuration, so the warning is probably harmless.
Fixes: 00176a34d9e2 ("bpf: remove the verifier ops from program structure") Signed-off-by: Arnd Bergmann <arnd@arndb.de> --- Since there hasn't been a linux-next release in two weeks, I'm not entirely sure this is still needed, but from looking of the net-next contents it seems it is. I did not check any other trees that might have a fix already. --- kernel/bpf/verifier.c | 4 ++++ 1 file changed, 4 insertions(+)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 750aff880ecb..debb60ad08ee 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -4447,6 +4447,10 @@ int bpf_check(struct bpf_prog **prog, union bpf_attr *attr) struct bpf_verifer_log *log; int ret = -EINVAL; + /* no program is valid */ + if (ARRAY_SIZE(bpf_verifier_ops) == 0) + return -EINVAL; + /* 'struct bpf_verifier_env' can be global, but since it's not small, * allocate/free it every time bpf_check() is called */ -- 2.9.0
| |