Skip to content

Commit 2fa7d94

Browse files
nvmmaxborkmann
nvmmax
authored and
borkmann
committed
bpf: Fix the off-by-two error in range markings
The first commit cited below attempts to fix the off-by-one error that appeared in some comparisons with an open range. Due to this error, arithmetically equivalent pieces of code could get different verdicts from the verifier, for example (pseudocode): // 1. Passes the verifier: if (data + 8 > data_end) return early read *(u64 *)data, i.e. [data; data+7] // 2. Rejected by the verifier (should still pass): if (data + 7 >= data_end) return early read *(u64 *)data, i.e. [data; data+7] The attempted fix, however, shifts the range by one in a wrong direction, so the bug not only remains, but also such piece of code starts failing in the verifier: // 3. Rejected by the verifier, but the check is stricter than in #1. if (data + 8 >= data_end) return early read *(u64 *)data, i.e. [data; data+7] The change performed by that fix converted an off-by-one bug into off-by-two. The second commit cited below added the BPF selftests written to ensure than code chunks like #3 are rejected, however, they should be accepted. This commit fixes the off-by-two error by adjusting new_range in the right direction and fixes the tests by changing the range into the one that should actually fail. Fixes: fb2a311 ("bpf: fix off by one for range markings with L{T, E} patterns") Fixes: b37242c ("bpf: add test cases to bpf selftests to cover all access tests") Signed-off-by: Maxim Mikityanskiy <[email protected]> Signed-off-by: Daniel Borkmann <[email protected]> Link: https://lore.kernel.org/bpf/[email protected]
1 parent 8581fd4 commit 2fa7d94

File tree

2 files changed

+17
-17
lines changed

2 files changed

+17
-17
lines changed

‎kernel/bpf/verifier.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8422,7 +8422,7 @@ static void find_good_pkt_pointers(struct bpf_verifier_state *vstate,
84228422

84238423
new_range = dst_reg->off;
84248424
if (range_right_open)
8425-
new_range--;
8425+
new_range++;
84268426

84278427
/* Examples for register markings:
84288428
*

‎tools/testing/selftests/bpf/verifier/xdp_direct_packet_access.c

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -112,10 +112,10 @@
112112
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
113113
offsetof(struct xdp_md, data_end)),
114114
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
115-
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
115+
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
116116
BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
117117
BPF_JMP_IMM(BPF_JA, 0, 0, 1),
118-
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
118+
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -6),
119119
BPF_MOV64_IMM(BPF_REG_0, 0),
120120
BPF_EXIT_INSN(),
121121
},
@@ -167,10 +167,10 @@
167167
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
168168
offsetof(struct xdp_md, data_end)),
169169
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
170-
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
170+
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
171171
BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
172172
BPF_JMP_IMM(BPF_JA, 0, 0, 1),
173-
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
173+
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -6),
174174
BPF_MOV64_IMM(BPF_REG_0, 0),
175175
BPF_EXIT_INSN(),
176176
},
@@ -274,9 +274,9 @@
274274
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
275275
offsetof(struct xdp_md, data_end)),
276276
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
277-
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
277+
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
278278
BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
279-
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
279+
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -6),
280280
BPF_MOV64_IMM(BPF_REG_0, 0),
281281
BPF_EXIT_INSN(),
282282
},
@@ -437,9 +437,9 @@
437437
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
438438
offsetof(struct xdp_md, data_end)),
439439
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
440-
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
440+
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
441441
BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
442-
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
442+
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -6),
443443
BPF_MOV64_IMM(BPF_REG_0, 0),
444444
BPF_EXIT_INSN(),
445445
},
@@ -544,10 +544,10 @@
544544
offsetof(struct xdp_md, data_meta)),
545545
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
546546
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
547-
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
547+
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
548548
BPF_JMP_REG(BPF_JGT, BPF_REG_3, BPF_REG_1, 1),
549549
BPF_JMP_IMM(BPF_JA, 0, 0, 1),
550-
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
550+
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -6),
551551
BPF_MOV64_IMM(BPF_REG_0, 0),
552552
BPF_EXIT_INSN(),
553553
},
@@ -599,10 +599,10 @@
599599
offsetof(struct xdp_md, data_meta)),
600600
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
601601
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
602-
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
602+
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
603603
BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 1),
604604
BPF_JMP_IMM(BPF_JA, 0, 0, 1),
605-
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
605+
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -6),
606606
BPF_MOV64_IMM(BPF_REG_0, 0),
607607
BPF_EXIT_INSN(),
608608
},
@@ -706,9 +706,9 @@
706706
offsetof(struct xdp_md, data_meta)),
707707
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
708708
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
709-
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
709+
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
710710
BPF_JMP_REG(BPF_JGE, BPF_REG_1, BPF_REG_3, 1),
711-
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
711+
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -6),
712712
BPF_MOV64_IMM(BPF_REG_0, 0),
713713
BPF_EXIT_INSN(),
714714
},
@@ -869,9 +869,9 @@
869869
offsetof(struct xdp_md, data_meta)),
870870
BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, offsetof(struct xdp_md, data)),
871871
BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
872-
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8),
872+
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 6),
873873
BPF_JMP_REG(BPF_JLE, BPF_REG_3, BPF_REG_1, 1),
874-
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
874+
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -6),
875875
BPF_MOV64_IMM(BPF_REG_0, 0),
876876
BPF_EXIT_INSN(),
877877
},

0 commit comments

Comments
 (0)