lkml.org 
[lkml]   [2019]   [Jan]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 4.20 293/304] bpf: fix check_map_access smin_value test when pointer contains offset
    Date
    From: Daniel Borkmann <daniel@iogearbox.net>

    [ Upstream commit b7137c4eab85c1cf3d46acdde90ce1163b28c873 ]

    In check_map_access() we probe actual bounds through __check_map_access()
    with offset of reg->smin_value + off for lower bound and offset of
    reg->umax_value + off for the upper bound. However, even though the
    reg->smin_value could have a negative value, the final result of the
    sum with off could be positive when pointer arithmetic with known and
    unknown scalars is combined. In this case we reject the program with
    an error such as "R<x> min value is negative, either use unsigned index
    or do a if (index >=0) check." even though the access itself would be
    fine. Therefore extend the check to probe whether the actual resulting
    reg->smin_value + off is less than zero.

    Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
    Acked-by: Alexei Starovoitov <ast@kernel.org>
    Signed-off-by: Alexei Starovoitov <ast@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    kernel/bpf/verifier.c | 6 +++++-
    1 file changed, 5 insertions(+), 1 deletion(-)

    diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
    index eedc7bd4185d..8ae4c7f8eaf6 100644
    --- a/kernel/bpf/verifier.c
    +++ b/kernel/bpf/verifier.c
    @@ -1345,13 +1345,17 @@ static int check_map_access(struct bpf_verifier_env *env, u32 regno,
    */
    if (env->log.level)
    print_verifier_state(env, state);
    +
    /* The minimum value is only important with signed
    * comparisons where we can't assume the floor of a
    * value is 0. If we are using signed variables for our
    * index'es we need to make sure that whatever we use
    * will have a set floor within our range.
    */
    - if (reg->smin_value < 0) {
    + if (reg->smin_value < 0 &&
    + (reg->smin_value == S64_MIN ||
    + (off + reg->smin_value != (s64)(s32)(off + reg->smin_value)) ||
    + reg->smin_value + off < 0)) {
    verbose(env, "R%d min value is negative, either use unsigned index or do a if (index >=0) check.\n",
    regno);
    return -EACCES;
    --
    2.19.1
    \
     
     \ /
      Last update: 2019-01-28 18:31    [W:4.746 / U:0.576 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site