Re: linux-next: manual merge of the net-next tree with the net tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 





On 3/19/21 12:21 AM, Daniel Borkmann wrote:
On 3/19/21 3:11 AM, Piotr Krysiuk wrote:
Hi Daniel,

On Fri, Mar 19, 2021 at 12:16 AM Stephen Rothwell <sfr@xxxxxxxxxxxxxxxx>
wrote:

diff --cc kernel/bpf/verifier.c
index 44e4ec1640f1,f9096b049cd6..000000000000
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@@ -5876,10 -6056,22 +6060,23 @@@ static int retrieve_ptr_limit(const str
                 if (mask_to_left)
                         *ptr_limit = MAX_BPF_STACK + off;
                 else
  -                      *ptr_limit = -off;
  -              return 0;
  +                      *ptr_limit = -off - 1;
  +              return *ptr_limit >= max ? -ERANGE : 0;
+       case PTR_TO_MAP_KEY:
+               /* Currently, this code is not exercised as the only use
+                * is bpf_for_each_map_elem() helper which requires
+                * bpf_capble. The code has been tested manually for
+                * future use.
+                */
+               if (mask_to_left) {
+                       *ptr_limit = ptr_reg->umax_value + ptr_reg->off;
+               } else {
+                       off = ptr_reg->smin_value + ptr_reg->off;
+                       *ptr_limit = ptr_reg->map_ptr->key_size - off;
+               }
+               return 0;


PTR_TO_MAP_VALUE logic above looks like copy-paste of old PTR_TO_MAP_VALUE
code from before "bpf: Fix off-by-one for area size in creating mask to
left" and is apparently affected by the same off-by-one, except this time
on "key_size" area and not "value_size".

This needs to be fixed in the same way as we did with PTR_TO_MAP_VALUE.
What is the best way to proceed?

Hm, not sure why PTR_TO_MAP_KEY was added by 69c087ba6225 in the first place, I presume noone expects this to be used from unprivileged as the comment says. Resolution should be to remove the PTR_TO_MAP_KEY case entirely from that switch
until we have an actual user.

Alexei suggested so that we don't forget it in the future if
bpf_capable() requirement is removed.
   https://lore.kernel.org/bpf/c837ae55-2487-2f39-47f6-a18781dc6fcc@xxxxxx/

I am okay with either way, fix it or remove it.


Thanks,
Daniel



[Index of Archives]     [Linux Kernel]     [Linux USB Development]     [Yosemite News]     [Linux SCSI]

  Powered by Linux