On Wed, 2024-06-19 at 16:53 -0700, Alexei Starovoitov wrote: > From: Alexei Starovoitov <ast@xxxxxxxxxx> > > Zac's syzbot crafted a bpf prog that exposed two bugs in may_goto. > The 1st bug is the way may_goto is patched. When offset is negative > it should be patched differently. > The 2nd bug is in the verifier: > when current state may_goto_depth is equal to visited state may_goto_depth > it means there is an actual infinite loop. It's not correct to prune > exploration of the program at this point. > Note, that this check doesn't limit the program to only one may_goto insn, > since 2nd and any further may_goto will increment may_goto_depth only > in the queued state pushed for future exploration. The current state > will have may_goto_depth == 0 regardless of number of may_goto insns > and the verifier has to explore the program until bpf_exit. > > Reported-by: Zac Ecob <zacecob@xxxxxxxxxxxxxx> > Closes: https://lore.kernel.org/bpf/CAADnVQL-15aNp04-cyHRn47Yv61NXfYyhopyZtUyxNojUZUXpA@xxxxxxxxxxxxxx/ > Fixes: 011832b97b31 ("bpf: Introduce may_goto instruction") > Signed-off-by: Alexei Starovoitov <ast@xxxxxxxxxx> > --- Took me a while to figure out why we don't need this for iterators. Acked-by: Eduard Zingerman <eddyz87@xxxxxxxxx>
