Re: [PATCH bpf 1/2] bpf: Fix reg_set_min_max corruption of fake_reg

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 6/13/24 1:13 AM, Alexei Starovoitov wrote:
On Wed, Jun 12, 2024 at 3:40 PM Daniel Borkmann <daniel@xxxxxxxxxxxxx> wrote:
[...]
Fixes: 67420501e868 ("bpf: generalize reg_set_min_max() to handle non-const register comparisons")
Reported-by: Juan José López Jaimez <jjlopezjaimez@xxxxxxxxxx>
Signed-off-by: Daniel Borkmann <daniel@xxxxxxxxxxxxx>
---
  kernel/bpf/verifier.c | 13 +++++++++----
  1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 36ef8e96787e..366b312203d2 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -15112,8 +15112,8 @@ static int check_cond_jmp_op(struct bpf_verifier_env *env,
         struct bpf_verifier_state *other_branch;
         struct bpf_reg_state *regs = this_branch->frame[this_branch->curframe]->regs;
         struct bpf_reg_state *dst_reg, *other_branch_regs, *src_reg = NULL;
+       struct bpf_reg_state fake_reg1 = {}, fake_reg2 = {};

That's too much stack increase.
Even a single reg on the stack is a bit high.

Hm, agree 120 bytes.. we can actually move it away from stack altogether
into env. I found another such location as well where stack can be reduced.
Updated in v2, thanks!




[Index of Archives]     [Linux Samsung SoC]     [Linux Rockchip SoC]     [Linux Actions SoC]     [Linux for Synopsys ARC Processors]     [Linux NFS]     [Linux NILFS]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]


  Powered by Linux