github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-08 14:42:37 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

bpf: Wrap aux data inside bpf_sanitize_info container

Browse Source 
commit 3d0220f686 upstream.

Add a container structure struct bpf_sanitize_info which holds
the current aux info, and update call-sites to sanitize_ptr_alu()
to pass it in. This is needed for passing in additional state
later on.

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Piotr Krysiuk <piotras@gmail.com>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Daniel Borkmann 2021-05-21 10:17:36 +00:00 committed by Greg Kroah-Hartman
parent 4068786a86
commit 4e2c7b2974
1 changed files with 11 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
kernel/bpf/verifier.c
View File

@ -5743,15 +5743,19 @@ static bool sanitize_needed(u8 opcode)
return opcode == BPF_ADD || opcode == BPF_SUB; return opcode == BPF_ADD || opcode == BPF_SUB;
} }
struct bpf_sanitize_info {
struct bpf_insn_aux_data aux;
};
static int sanitize_ptr_alu(struct bpf_verifier_env *env, static int sanitize_ptr_alu(struct bpf_verifier_env *env,
struct bpf_insn *insn, struct bpf_insn *insn,
const struct bpf_reg_state *ptr_reg, const struct bpf_reg_state *ptr_reg,
const struct bpf_reg_state *off_reg, const struct bpf_reg_state *off_reg,
struct bpf_reg_state *dst_reg, struct bpf_reg_state *dst_reg,
struct bpf_insn_aux_data *tmp_aux, struct bpf_sanitize_info *info,
const bool commit_window) const bool commit_window)
{ {
struct bpf_insn_aux_data *aux = commit_window ? cur_aux(env) : tmp_aux; struct bpf_insn_aux_data *aux = commit_window ? cur_aux(env) : &info->aux;
struct bpf_verifier_state *vstate = env->cur_state; struct bpf_verifier_state *vstate = env->cur_state;
bool off_is_imm = tnum_is_const(off_reg->var_off); bool off_is_imm = tnum_is_const(off_reg->var_off);
bool off_is_neg = off_reg->smin_value < 0; bool off_is_neg = off_reg->smin_value < 0;
@ -5780,8 +5784,8 @@ static int sanitize_ptr_alu(struct bpf_verifier_env *env,
/* In commit phase we narrow the masking window based on /* In commit phase we narrow the masking window based on
* the observed pointer move after the simulated operation. * the observed pointer move after the simulated operation.
*/ */
alu_state = tmp_aux->alu_state; alu_state = info->aux.alu_state;
alu_limit = abs(tmp_aux->alu_limit - alu_limit); alu_limit = abs(info->aux.alu_limit - alu_limit);
} else { } else {
alu_state = off_is_neg ? BPF_ALU_NEG_VALUE : 0; alu_state = off_is_neg ? BPF_ALU_NEG_VALUE : 0;
alu_state |= off_is_imm ? BPF_ALU_IMMEDIATE : 0; alu_state |= off_is_imm ? BPF_ALU_IMMEDIATE : 0;
@ -5942,7 +5946,7 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env,
smin_ptr = ptr_reg->smin_value, smax_ptr = ptr_reg->smax_value; smin_ptr = ptr_reg->smin_value, smax_ptr = ptr_reg->smax_value;
u64 umin_val = off_reg->umin_value, umax_val = off_reg->umax_value, u64 umin_val = off_reg->umin_value, umax_val = off_reg->umax_value,
umin_ptr = ptr_reg->umin_value, umax_ptr = ptr_reg->umax_value; umin_ptr = ptr_reg->umin_value, umax_ptr = ptr_reg->umax_value;
struct bpf_insn_aux_data tmp_aux = {}; struct bpf_sanitize_info info = {};
u8 opcode = BPF_OP(insn->code); u8 opcode = BPF_OP(insn->code);
u32 dst = insn->dst_reg; u32 dst = insn->dst_reg;
int ret; int ret;
@ -6011,7 +6015,7 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env,
if (sanitize_needed(opcode)) { if (sanitize_needed(opcode)) {
ret = sanitize_ptr_alu(env, insn, ptr_reg, off_reg, dst_reg, ret = sanitize_ptr_alu(env, insn, ptr_reg, off_reg, dst_reg,
&tmp_aux, false); &info, false);
if (ret < 0) if (ret < 0)
return sanitize_err(env, insn, ret, off_reg, dst_reg); return sanitize_err(env, insn, ret, off_reg, dst_reg);
} }
@ -6152,7 +6156,7 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env,
return -EACCES; return -EACCES;
if (sanitize_needed(opcode)) { if (sanitize_needed(opcode)) {
ret = sanitize_ptr_alu(env, insn, dst_reg, off_reg, dst_reg, ret = sanitize_ptr_alu(env, insn, dst_reg, off_reg, dst_reg,
&tmp_aux, true); &info, true);
if (ret < 0) if (ret < 0)
return sanitize_err(env, insn, ret, off_reg, dst_reg); return sanitize_err(env, insn, ret, off_reg, dst_reg);
} }