Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1693707 > unrolled thread
| Started by | Edward Cree <ecree@solarflare.com> |
|---|---|
| First post | 2017-07-21 15:40 +0200 |
| Last post | 2017-07-21 16:40 +0200 |
| Articles | 2 — 2 participants |
Back to article view | Back to linux.kernel
This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by
below is the oldest one visible, not the original post.
[PATCH net 2/2] bpf/verifier: fix min/max handling in BPF_SUB Edward Cree <ecree@solarflare.com> - 2017-07-21 15:40 +0200
Re: [PATCH net 2/2] bpf/verifier: fix min/max handling in BPF_SUB Daniel Borkmann <daniel@iogearbox.net> - 2017-07-21 16:40 +0200
| From | Edward Cree <ecree@solarflare.com> |
|---|---|
| Date | 2017-07-21 15:40 +0200 |
| Subject | [PATCH net 2/2] bpf/verifier: fix min/max handling in BPF_SUB |
| Message-ID | <u5GjT-5qP-17@gated-at.bofh.it> |
We have to subtract the src max from the dst min, and vice-versa, since
(e.g.) the smallest result comes from the largest subtrahend.
Fixes: 484611357c19 ("bpf: allow access into map value arrays")
Signed-off-by: Edward Cree <ecree@solarflare.com>
---
kernel/bpf/verifier.c | 21 +++++++++++++++------
1 file changed, 15 insertions(+), 6 deletions(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index af9e84a..664d939 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -1865,10 +1865,12 @@ static void adjust_reg_min_max_vals(struct bpf_verifier_env *env,
* do our normal operations to the register, we need to set the values
* to the min/max since they are undefined.
*/
- if (min_val == BPF_REGISTER_MIN_RANGE)
- dst_reg->min_value = BPF_REGISTER_MIN_RANGE;
- if (max_val == BPF_REGISTER_MAX_RANGE)
- dst_reg->max_value = BPF_REGISTER_MAX_RANGE;
+ if (opcode != BPF_SUB) {
+ if (min_val == BPF_REGISTER_MIN_RANGE)
+ dst_reg->min_value = BPF_REGISTER_MIN_RANGE;
+ if (max_val == BPF_REGISTER_MAX_RANGE)
+ dst_reg->max_value = BPF_REGISTER_MAX_RANGE;
+ }
switch (opcode) {
case BPF_ADD:
@@ -1879,10 +1881,17 @@ static void adjust_reg_min_max_vals(struct bpf_verifier_env *env,
dst_reg->min_align = min(src_align, dst_align);
break;
case BPF_SUB:
+ /* If one of our values was at the end of our ranges, then the
+ * _opposite_ value in the dst_reg goes to the end of our range.
+ */
+ if (min_val == BPF_REGISTER_MIN_RANGE)
+ dst_reg->max_value = BPF_REGISTER_MAX_RANGE;
+ if (max_val == BPF_REGISTER_MAX_RANGE)
+ dst_reg->min_value = BPF_REGISTER_MIN_RANGE;
if (dst_reg->min_value != BPF_REGISTER_MIN_RANGE)
- dst_reg->min_value -= min_val;
+ dst_reg->min_value -= max_val;
if (dst_reg->max_value != BPF_REGISTER_MAX_RANGE)
- dst_reg->max_value -= max_val;
+ dst_reg->max_value -= min_val;
dst_reg->min_align = min(src_align, dst_align);
break;
case BPF_MUL:
[toc] | [next] | [standalone]
| From | Daniel Borkmann <daniel@iogearbox.net> |
|---|---|
| Date | 2017-07-21 16:40 +0200 |
| Message-ID | <u5HfX-5Zt-1@gated-at.bofh.it> |
| In reply to | #1693707 |
On 07/21/2017 03:37 PM, Edward Cree wrote:
> We have to subtract the src max from the dst min, and vice-versa, since
> (e.g.) the smallest result comes from the largest subtrahend.
>
> Fixes: 484611357c19 ("bpf: allow access into map value arrays")
> Signed-off-by: Edward Cree <ecree@solarflare.com>
LGTM, thanks for the fix!
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
> ---
> kernel/bpf/verifier.c | 21 +++++++++++++++------
> 1 file changed, 15 insertions(+), 6 deletions(-)
>
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index af9e84a..664d939 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -1865,10 +1865,12 @@ static void adjust_reg_min_max_vals(struct bpf_verifier_env *env,
> * do our normal operations to the register, we need to set the values
> * to the min/max since they are undefined.
> */
> - if (min_val == BPF_REGISTER_MIN_RANGE)
> - dst_reg->min_value = BPF_REGISTER_MIN_RANGE;
> - if (max_val == BPF_REGISTER_MAX_RANGE)
> - dst_reg->max_value = BPF_REGISTER_MAX_RANGE;
> + if (opcode != BPF_SUB) {
> + if (min_val == BPF_REGISTER_MIN_RANGE)
> + dst_reg->min_value = BPF_REGISTER_MIN_RANGE;
> + if (max_val == BPF_REGISTER_MAX_RANGE)
> + dst_reg->max_value = BPF_REGISTER_MAX_RANGE;
> + }
>
> switch (opcode) {
> case BPF_ADD:
> @@ -1879,10 +1881,17 @@ static void adjust_reg_min_max_vals(struct bpf_verifier_env *env,
> dst_reg->min_align = min(src_align, dst_align);
> break;
> case BPF_SUB:
> + /* If one of our values was at the end of our ranges, then the
> + * _opposite_ value in the dst_reg goes to the end of our range.
> + */
> + if (min_val == BPF_REGISTER_MIN_RANGE)
> + dst_reg->max_value = BPF_REGISTER_MAX_RANGE;
> + if (max_val == BPF_REGISTER_MAX_RANGE)
> + dst_reg->min_value = BPF_REGISTER_MIN_RANGE;
> if (dst_reg->min_value != BPF_REGISTER_MIN_RANGE)
> - dst_reg->min_value -= min_val;
> + dst_reg->min_value -= max_val;
> if (dst_reg->max_value != BPF_REGISTER_MAX_RANGE)
> - dst_reg->max_value -= max_val;
> + dst_reg->max_value -= min_val;
> dst_reg->min_align = min(src_align, dst_align);
> break;
> case BPF_MUL:
>
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web