Patch "bpf: arsh is not supported in 32 bit alu thus reject it" has been added to the 4.9-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    bpf: arsh is not supported in 32 bit alu thus reject it

to the 4.9-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     bpf-arsh-is-not-supported-in-32-bit-alu-thus-reject-it.patch
and it can be found in the queue-4.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.


>From foo@baz Mon Jan 29 13:22:08 CET 2018
From: Daniel Borkmann <daniel@xxxxxxxxxxxxx>
Date: Mon, 29 Jan 2018 02:48:57 +0100
Subject: bpf: arsh is not supported in 32 bit alu thus reject it
To: gregkh@xxxxxxxxxxxxxxxxxxx
Cc: ast@xxxxxxxxxx, stable@xxxxxxxxxxxxxxx, Daniel Borkmann <daniel@xxxxxxxxxxxxx>
Message-ID: <f236d9b875aa2ab63ab155cafa0f10376883da00.1517190206.git.daniel@xxxxxxxxxxxxx>

From: Daniel Borkmann <daniel@xxxxxxxxxxxxx>

[ upstream commit 7891a87efc7116590eaba57acc3c422487802c6f ]

The following snippet was throwing an 'unknown opcode cc' warning
in BPF interpreter:

  0: (18) r0 = 0x0
  2: (7b) *(u64 *)(r10 -16) = r0
  3: (cc) (u32) r0 s>>= (u32) r0
  4: (95) exit

Although a number of JITs do support BPF_ALU | BPF_ARSH | BPF_{K,X}
generation, not all of them do and interpreter does neither. We can
leave existing ones and implement it later in bpf-next for the
remaining ones, but reject this properly in verifier for the time
being.

Fixes: 17a5267067f3 ("bpf: verifier (add verifier core)")
Reported-by: syzbot+93c4904c5c70348a6890@xxxxxxxxxxxxxxxxxxxxxxxxx
Signed-off-by: Daniel Borkmann <daniel@xxxxxxxxxxxxx>
Signed-off-by: Alexei Starovoitov <ast@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
 kernel/bpf/verifier.c |    5 +++++
 1 file changed, 5 insertions(+)

--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -1843,6 +1843,11 @@ static int check_alu_op(struct bpf_verif
 			return -EINVAL;
 		}
 
+		if (opcode == BPF_ARSH && BPF_CLASS(insn->code) != BPF_ALU64) {
+			verbose("BPF_ARSH not supported for 32 bit ALU\n");
+			return -EINVAL;
+		}
+
 		if ((opcode == BPF_LSH || opcode == BPF_RSH ||
 		     opcode == BPF_ARSH) && BPF_SRC(insn->code) == BPF_K) {
 			int size = BPF_CLASS(insn->code) == BPF_ALU64 ? 64 : 32;


Patches currently in stable-queue which might be from daniel@xxxxxxxxxxxxx are

queue-4.9/bpf-avoid-false-sharing-of-map-refcount-with-max_entries.patch
queue-4.9/x86-bpf_jit-small-optimization-in-emit_bpf_tail_call.patch
queue-4.9/bpf-reject-stores-into-ctx-via-st-and-xadd.patch
queue-4.9/bpf-fix-32-bit-divide-by-zero.patch
queue-4.9/bpf-fix-bpf_tail_call-x64-jit.patch
queue-4.9/bpf-arsh-is-not-supported-in-32-bit-alu-thus-reject-it.patch
queue-4.9/bpf-fix-divides-by-zero.patch
queue-4.9/bpf-introduce-bpf_jit_always_on-config.patch



[Index of Archives]     [Linux Kernel]     [Kernel Development Newbies]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Yosemite Hiking]     [Linux Kernel]     [Linux SCSI]