linux/kernel/bpf
Krzesimir Nowak e2f7fc0ac6 bpf: fix undefined behavior in narrow load handling
Commit 31fd85816d ("bpf: permits narrower load from bpf program
context fields") made the verifier add AND instructions to clear the
unwanted bits with a mask when doing a narrow load. The mask is
computed with

  (1 << size * 8) - 1

where "size" is the size of the narrow load. When doing a 4 byte load
of a an 8 byte field the verifier shifts the literal 1 by 32 places to
the left. This results in an overflow of a signed integer, which is an
undefined behavior. Typically, the computed mask was zero, so the
result of the narrow load ended up being zero too.

Cast the literal to long long to avoid overflows. Note that narrow
load of the 4 byte fields does not have the undefined behavior,
because the load size can only be either 1 or 2 bytes, so shifting 1
by 8 or 16 places will not overflow it. And reading 4 bytes would not
be a narrow load of a 4 bytes field.

Fixes: 31fd85816d ("bpf: permits narrower load from bpf program context fields")
Reviewed-by: Alban Crequy <alban@kinvolk.io>
Reviewed-by: Iago López Galeiras <iago@kinvolk.io>
Signed-off-by: Krzesimir Nowak <krzesimir@kinvolk.io>
Cc: Yonghong Song <yhs@fb.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2019-05-13 02:05:50 +02:00
..
Makefile bpf: add queue and stack maps 2018-10-19 13:24:31 -07:00
arraymap.c bpf: allow for key-less BTF in array map 2019-04-09 17:05:46 -07:00
bpf_lru_list.c bpf: lru: Lower the PERCPU_NR_SCANS from 16 to 4 2017-04-17 13:55:52 -04:00
bpf_lru_list.h bpf: Only set node->ref = 1 if it has not been set 2017-09-01 09:57:39 -07:00
btf.c bpf: allow for key-less BTF in array map 2019-04-09 17:05:46 -07:00
cgroup.c bpf: add map helper functions push, pop, peek in more BPF programs 2019-04-16 10:24:02 +02:00
core.c bpf: fix out of bounds backwards jmps due to dead code removal 2019-05-10 18:49:27 -07:00
cpumap.c bpf: cpumap memory prefetchw optimizations for struct page 2019-04-17 19:09:25 -07:00
devmap.c bpf: devmap: fix wrong interface selection in notifier_call 2018-10-26 00:32:21 +02:00
disasm.c bpf: implement lookup-free direct value access for maps 2019-04-09 17:05:46 -07:00
disasm.h bpf: Remove struct bpf_verifier_env argument from print_bpf_insn 2018-03-23 17:38:57 +01:00
hashtab.c bpf: add program side {rd, wr}only support for maps 2019-04-09 17:05:46 -07:00
helpers.c bpf: Introduce bpf_strtol and bpf_strtoul helpers 2019-04-12 13:54:59 -07:00
inode.c bpf: switch to ->free_inode() 2019-05-01 22:43:26 -04:00
local_storage.c bpf: add program side {rd, wr}only support for maps 2019-04-09 17:05:46 -07:00
lpm_trie.c bpf: add program side {rd, wr}only support for maps 2019-04-09 17:05:46 -07:00
map_in_map.c bpf: set inner_map_meta->spin_lock_off correctly 2019-02-27 17:03:13 -08:00
map_in_map.h bpf: Add syscall lookup support for fd array and htab 2017-06-29 13:13:25 -04:00
offload.c bpf: offload: add priv field for drivers 2019-02-12 17:07:09 +01:00
percpu_freelist.c bpf: fix lockdep false positive in percpu_freelist 2019-01-31 23:18:21 +01:00
percpu_freelist.h bpf: fix lockdep false positive in percpu_freelist 2019-01-31 23:18:21 +01:00
queue_stack_maps.c bpf: add program side {rd, wr}only support for maps 2019-04-09 17:05:46 -07:00
reuseport_array.c bpf: Introduce BPF_MAP_TYPE_REUSEPORT_SOCKARRAY 2018-08-11 01:58:46 +02:00
stackmap.c bpf: fix lockdep false positive in stackmap 2019-02-11 16:36:24 +01:00
syscall.c bpf: Introduce bpf sk local storage 2019-04-27 09:07:04 -07:00
tnum.c bpf/verifier: improve register value range tracking with ARSH 2018-04-29 08:45:53 -07:00
verifier.c bpf: fix undefined behavior in narrow load handling 2019-05-13 02:05:50 +02:00
xskmap.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2018-10-19 11:03:06 -07:00