linux/kernel/bpf
Josef Bacik f23cc643f9 bpf: fix range arithmetic for bpf map access
I made some invalid assumptions with BPF_AND and BPF_MOD that could result in
invalid accesses to bpf map entries.  Fix this up by doing a few things

1) Kill BPF_MOD support.  This doesn't actually get used by the compiler in real
life and just adds extra complexity.

2) Fix the logic for BPF_AND, don't allow AND of negative numbers and set the
minimum value to 0 for positive AND's.

3) Don't do operations on the ranges if they are set to the limits, as they are
by definition undefined, and allowing arithmetic operations on those values
could make them appear valid when they really aren't.

This fixes the testcase provided by Jann as well as a few other theoretical
problems.

Reported-by: Jann Horn <jannh@google.com>
Signed-off-by: Josef Bacik <jbacik@fb.com>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
2016-11-16 13:21:45 -05:00
..
arraymap.c bpf: Add bpf_current_task_under_cgroup helper 2016-08-12 21:49:41 -07:00
core.c bpf: clean up put_cpu_var usage 2016-09-27 22:09:17 -04:00
hashtab.c bpf: fix htab map destruction when extra reserve is in use 2016-11-07 13:20:52 -05:00
helpers.c bpf: direct packet write and access for helpers for clsact progs 2016-09-20 23:32:11 -04:00
inode.c fs: Replace CURRENT_TIME with current_time() for inode timestamps 2016-09-27 21:06:21 -04:00
Makefile bpf: introduce percpu_freelist 2016-03-08 15:28:31 -05:00
percpu_freelist.c bpf: introduce percpu_freelist 2016-03-08 15:28:31 -05:00
percpu_freelist.h bpf: introduce percpu_freelist 2016-03-08 15:28:31 -05:00
stackmap.c bpf: add BPF_CALL_x macros for declaring helpers 2016-09-09 19:36:04 -07:00
syscall.c bpf: fix map not being uncharged during map creation failure 2016-11-07 13:22:26 -05:00
verifier.c bpf: fix range arithmetic for bpf map access 2016-11-16 13:21:45 -05:00