Commit d2a4dd37 authored by Alexei Starovoitov's avatar Alexei Starovoitov Committed by David S. Miller

bpf: fix state equivalence

Commmits 57a09bf0 ("bpf: Detect identical PTR_TO_MAP_VALUE_OR_NULL registers")
and 48461135 ("bpf: allow access into map value arrays") by themselves
are correct, but in combination they make state equivalence ignore 'id' field
of the register state which can lead to accepting invalid program.

Fixes: 57a09bf0 ("bpf: Detect identical PTR_TO_MAP_VALUE_OR_NULL registers")
Fixes: 48461135 ("bpf: allow access into map value arrays")
Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
Acked-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Acked-by: default avatarThomas Graf <tgraf@suug.ch>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 3665f381
...@@ -18,13 +18,6 @@ ...@@ -18,13 +18,6 @@
struct bpf_reg_state { struct bpf_reg_state {
enum bpf_reg_type type; enum bpf_reg_type type;
/*
* Used to determine if any memory access using this register will
* result in a bad access.
*/
s64 min_value;
u64 max_value;
u32 id;
union { union {
/* valid when type == CONST_IMM | PTR_TO_STACK | UNKNOWN_VALUE */ /* valid when type == CONST_IMM | PTR_TO_STACK | UNKNOWN_VALUE */
s64 imm; s64 imm;
...@@ -40,6 +33,13 @@ struct bpf_reg_state { ...@@ -40,6 +33,13 @@ struct bpf_reg_state {
*/ */
struct bpf_map *map_ptr; struct bpf_map *map_ptr;
}; };
u32 id;
/* Used to determine if any memory access using this register will
* result in a bad access. These two fields must be last.
* See states_equal()
*/
s64 min_value;
u64 max_value;
}; };
enum bpf_stack_slot_type { enum bpf_stack_slot_type {
......
...@@ -2528,7 +2528,7 @@ static bool states_equal(struct bpf_verifier_env *env, ...@@ -2528,7 +2528,7 @@ static bool states_equal(struct bpf_verifier_env *env,
* we didn't do a variable access into a map then we are a-ok. * we didn't do a variable access into a map then we are a-ok.
*/ */
if (!varlen_map_access && if (!varlen_map_access &&
rold->type == rcur->type && rold->imm == rcur->imm) memcmp(rold, rcur, offsetofend(struct bpf_reg_state, id)) == 0)
continue; continue;
/* If we didn't map access then again we don't care about the /* If we didn't map access then again we don't care about the
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment