mirror of
https://mirrors.bfsu.edu.cn/git/linux.git
synced 2024-12-14 06:24:53 +08:00
bpf: Fix masking negation logic upon negative dst register
The negation logic for the case where the off_reg is sitting in the
dst register is not correct given then we cannot just invert the add
to a sub or vice versa. As a fix, perform the final bitwise and-op
unconditionally into AX from the off_reg, then move the pointer from
the src to dst and finally use AX as the source for the original
pointer arithmetic operation such that the inversion yields a correct
result. The single non-AX mov in between is possible given constant
blinding is retaining it as it's not an immediate based operation.
Fixes: 979d63d50c
("bpf: prevent out of bounds speculation on pointer arithmetic")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Tested-by: Piotr Krysiuk <piotras@gmail.com>
Reviewed-by: Piotr Krysiuk <piotras@gmail.com>
Reviewed-by: John Fastabend <john.fastabend@gmail.com>
Acked-by: Alexei Starovoitov <ast@kernel.org>
This commit is contained in:
parent
f80f88f0e2
commit
b9b34ddbe2
@ -12391,14 +12391,10 @@ static int do_misc_fixups(struct bpf_verifier_env *env)
|
||||
*patch++ = BPF_ALU64_REG(BPF_OR, BPF_REG_AX, off_reg);
|
||||
*patch++ = BPF_ALU64_IMM(BPF_NEG, BPF_REG_AX, 0);
|
||||
*patch++ = BPF_ALU64_IMM(BPF_ARSH, BPF_REG_AX, 63);
|
||||
if (issrc) {
|
||||
*patch++ = BPF_ALU64_REG(BPF_AND, BPF_REG_AX,
|
||||
off_reg);
|
||||
insn->src_reg = BPF_REG_AX;
|
||||
} else {
|
||||
*patch++ = BPF_ALU64_REG(BPF_AND, off_reg,
|
||||
BPF_REG_AX);
|
||||
}
|
||||
*patch++ = BPF_ALU64_REG(BPF_AND, BPF_REG_AX, off_reg);
|
||||
if (!issrc)
|
||||
*patch++ = BPF_MOV64_REG(insn->dst_reg, insn->src_reg);
|
||||
insn->src_reg = BPF_REG_AX;
|
||||
if (isneg)
|
||||
insn->code = insn->code == code_add ?
|
||||
code_sub : code_add;
|
||||
|
Loading…
Reference in New Issue
Block a user