lkml.org 
[lkml]   [2022]   [May]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH bpf-next 2/4] bpf: verifier: explain opcode check in check_ld_imm()
    Date
    The BPF_SIZE check in the beginning of check_ld_imm() actually guard
    against program with JMP instructions that goes to the second
    instruction of BPF_LD_IMM64, but may be easily dismissed as an simple
    opcode check that's duplicating the effort of bpf_opcode_in_insntable().

    Add comment to better reflect the importance of the check.

    Signed-off-by: Shung-Hsi Yu <shung-hsi.yu@suse.com>
    ---
    kernel/bpf/verifier.c | 4 ++++
    1 file changed, 4 insertions(+)

    diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
    index 79a2695ee2e2..133929751f80 100644
    --- a/kernel/bpf/verifier.c
    +++ b/kernel/bpf/verifier.c
    @@ -9921,6 +9921,10 @@ static int check_ld_imm(struct bpf_verifier_env *env, struct bpf_insn *insn)
    struct bpf_map *map;
    int err;

    + /* checks that this is not the second part of BPF_LD_IMM64, which is
    + * skipped over during opcode check, but a JMP with invalid offset may
    + * cause check_ld_imm() to be called upon it.
    + */
    if (BPF_SIZE(insn->code) != BPF_DW) {
    verbose(env, "invalid BPF_LD_IMM insn\n");
    return -EINVAL;
    --
    2.36.1
    \
     
     \ /
      Last update: 2022-05-20 13:39    [W:3.276 / U:0.880 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site