• J
    bpf: fix range arithmetic for bpf map access · f23cc643
    Josef Bacik 提交于
    I made some invalid assumptions with BPF_AND and BPF_MOD that could result in
    invalid accesses to bpf map entries.  Fix this up by doing a few things
    
    1) Kill BPF_MOD support.  This doesn't actually get used by the compiler in real
    life and just adds extra complexity.
    
    2) Fix the logic for BPF_AND, don't allow AND of negative numbers and set the
    minimum value to 0 for positive AND's.
    
    3) Don't do operations on the ranges if they are set to the limits, as they are
    by definition undefined, and allowing arithmetic operations on those values
    could make them appear valid when they really aren't.
    
    This fixes the testcase provided by Jann as well as a few other theoretical
    problems.
    Reported-by: NJann Horn <jannh@google.com>
    Signed-off-by: NJosef Bacik <jbacik@fb.com>
    Acked-by: NAlexei Starovoitov <ast@kernel.org>
    Signed-off-by: NDavid S. Miller <davem@davemloft.net>
    f23cc643
bpf_verifier.h 3.2 KB