bpf: arsh is not supported in 32 bit alu thus reject it
The following snippet was throwing an 'unknown opcode cc' warning
in BPF interpreter:
0: (18) r0 = 0x0
2: (7b) *(u64 *)(r10 -16) = r0
3: (cc) (u32) r0 s>>= (u32) r0
4: (95) exit
Although a number of JITs do support BPF_ALU | BPF_ARSH | BPF_{K,X}
generation, not all of them do and interpreter does neither. We can
leave existing ones and implement it later in bpf-next for the
remaining ones, but reject this properly in verifier for the time
being.
Fixes: 17a5267067
("bpf: verifier (add verifier core)")
Reported-by: syzbot+93c4904c5c70348a6890@syzkaller.appspotmail.com
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
This commit is contained in:
parent
4095034393
commit
7891a87efc
|
@ -2493,6 +2493,11 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn)
|
||||||
return -EINVAL;
|
return -EINVAL;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
if (opcode == BPF_ARSH && BPF_CLASS(insn->code) != BPF_ALU64) {
|
||||||
|
verbose(env, "BPF_ARSH not supported for 32 bit ALU\n");
|
||||||
|
return -EINVAL;
|
||||||
|
}
|
||||||
|
|
||||||
if ((opcode == BPF_LSH || opcode == BPF_RSH ||
|
if ((opcode == BPF_LSH || opcode == BPF_RSH ||
|
||||||
opcode == BPF_ARSH) && BPF_SRC(insn->code) == BPF_K) {
|
opcode == BPF_ARSH) && BPF_SRC(insn->code) == BPF_K) {
|
||||||
int size = BPF_CLASS(insn->code) == BPF_ALU64 ? 64 : 32;
|
int size = BPF_CLASS(insn->code) == BPF_ALU64 ? 64 : 32;
|
||||||
|
|
|
@ -272,6 +272,46 @@ static struct bpf_test tests[] = {
|
||||||
.errstr = "invalid bpf_ld_imm64 insn",
|
.errstr = "invalid bpf_ld_imm64 insn",
|
||||||
.result = REJECT,
|
.result = REJECT,
|
||||||
},
|
},
|
||||||
|
{
|
||||||
|
"arsh32 on imm",
|
||||||
|
.insns = {
|
||||||
|
BPF_MOV64_IMM(BPF_REG_0, 1),
|
||||||
|
BPF_ALU32_IMM(BPF_ARSH, BPF_REG_0, 5),
|
||||||
|
BPF_EXIT_INSN(),
|
||||||
|
},
|
||||||
|
.result = REJECT,
|
||||||
|
.errstr = "BPF_ARSH not supported for 32 bit ALU",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"arsh32 on reg",
|
||||||
|
.insns = {
|
||||||
|
BPF_MOV64_IMM(BPF_REG_0, 1),
|
||||||
|
BPF_MOV64_IMM(BPF_REG_1, 5),
|
||||||
|
BPF_ALU32_REG(BPF_ARSH, BPF_REG_0, BPF_REG_1),
|
||||||
|
BPF_EXIT_INSN(),
|
||||||
|
},
|
||||||
|
.result = REJECT,
|
||||||
|
.errstr = "BPF_ARSH not supported for 32 bit ALU",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"arsh64 on imm",
|
||||||
|
.insns = {
|
||||||
|
BPF_MOV64_IMM(BPF_REG_0, 1),
|
||||||
|
BPF_ALU64_IMM(BPF_ARSH, BPF_REG_0, 5),
|
||||||
|
BPF_EXIT_INSN(),
|
||||||
|
},
|
||||||
|
.result = ACCEPT,
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"arsh64 on reg",
|
||||||
|
.insns = {
|
||||||
|
BPF_MOV64_IMM(BPF_REG_0, 1),
|
||||||
|
BPF_MOV64_IMM(BPF_REG_1, 5),
|
||||||
|
BPF_ALU64_REG(BPF_ARSH, BPF_REG_0, BPF_REG_1),
|
||||||
|
BPF_EXIT_INSN(),
|
||||||
|
},
|
||||||
|
.result = ACCEPT,
|
||||||
|
},
|
||||||
{
|
{
|
||||||
"no bpf_exit",
|
"no bpf_exit",
|
||||||
.insns = {
|
.insns = {
|
||||||
|
|
Loading…
Reference in New Issue