提交 2e32965a 编写于 作者: D Daniel Borkmann 提交者: Zheng Zengkai

bpf: Fix signed_{sub,add32}_overflows type handling

stable inclusion
from stable-5.10.10
commit 5f52a8a71b62418d62c736e5aa68aaba0a8da918
bugzilla: 47610

--------------------------------

commit bc895e8b upstream.

Fix incorrect signed_{sub,add32}_overflows() input types (and a related buggy
comment). It looks like this might have slipped in via copy/paste issue, also
given prior to 3f50f132 ("bpf: Verifier, do explicit ALU32 bounds tracking")
the signature of signed_sub_overflows() had s64 a and s64 b as its input args
whereas now they are truncated to s32. Thus restore proper types. Also, the case
of signed_add32_overflows() is not consistent to signed_sub32_overflows(). Both
have s32 as inputs, therefore align the former.

Fixes: 3f50f132 ("bpf: Verifier, do explicit ALU32 bounds tracking")
Reported-by: NDe4dCr0w <sa516203@mail.ustc.edu.cn>
Signed-off-by: NDaniel Borkmann <daniel@iogearbox.net>
Reviewed-by: NJohn Fastabend <john.fastabend@gmail.com>
Acked-by: NAlexei Starovoitov <ast@kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: NZheng Zengkai <zhengzengkai@huawei.com>
Acked-by: NXie XiuQi <xiexiuqi@huawei.com>
上级 bbefa90c
...@@ -5255,7 +5255,7 @@ static bool signed_add_overflows(s64 a, s64 b) ...@@ -5255,7 +5255,7 @@ static bool signed_add_overflows(s64 a, s64 b)
return res < a; return res < a;
} }
static bool signed_add32_overflows(s64 a, s64 b) static bool signed_add32_overflows(s32 a, s32 b)
{ {
/* Do the add in u32, where overflow is well-defined */ /* Do the add in u32, where overflow is well-defined */
s32 res = (s32)((u32)a + (u32)b); s32 res = (s32)((u32)a + (u32)b);
...@@ -5265,7 +5265,7 @@ static bool signed_add32_overflows(s64 a, s64 b) ...@@ -5265,7 +5265,7 @@ static bool signed_add32_overflows(s64 a, s64 b)
return res < a; return res < a;
} }
static bool signed_sub_overflows(s32 a, s32 b) static bool signed_sub_overflows(s64 a, s64 b)
{ {
/* Do the sub in u64, where overflow is well-defined */ /* Do the sub in u64, where overflow is well-defined */
s64 res = (s64)((u64)a - (u64)b); s64 res = (s64)((u64)a - (u64)b);
...@@ -5277,7 +5277,7 @@ static bool signed_sub_overflows(s32 a, s32 b) ...@@ -5277,7 +5277,7 @@ static bool signed_sub_overflows(s32 a, s32 b)
static bool signed_sub32_overflows(s32 a, s32 b) static bool signed_sub32_overflows(s32 a, s32 b)
{ {
/* Do the sub in u64, where overflow is well-defined */ /* Do the sub in u32, where overflow is well-defined */
s32 res = (s32)((u32)a - (u32)b); s32 res = (s32)((u32)a - (u32)b);
if (b < 0) if (b < 0)
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册