linux/samples/bpf
Alexei Starovoitov 725f9dcd58 bpf: fix two bugs in verification logic when accessing 'ctx' pointer
1.
first bug is a silly mistake. It broke tracing examples and prevented
simple bpf programs from loading.

In the following code:
if (insn->imm == 0 && BPF_SIZE(insn->code) == BPF_W) {
} else if (...) {
  // this part should have been executed when
  // insn->code == BPF_W and insn->imm != 0
}

Obviously it's not doing that. So simple instructions like:
r2 = *(u64 *)(r1 + 8)
will be rejected. Note the comments in the code around these branches
were and still valid and indicate the true intent.

Replace it with:
if (BPF_SIZE(insn->code) != BPF_W)
  continue;

if (insn->imm == 0) {
} else if (...) {
  // now this code will be executed when
  // insn->code == BPF_W and insn->imm != 0
}

2.
second bug is more subtle.
If malicious code is using the same dest register as source register,
the checks designed to prevent the same instruction to be used with different
pointer types will fail to trigger, since we were assigning src_reg_type
when it was already overwritten by check_mem_access().
The fix is trivial. Just move line:
src_reg_type = regs[insn->src_reg].type;
before check_mem_access().
Add new 'access skb fields bad4' test to check this case.

Fixes: 9bac3d6d54 ("bpf: allow extended BPF programs access skb fields")
Signed-off-by: Alexei Starovoitov <ast@plumgrid.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2015-04-16 14:08:49 -04:00
..
bpf_helpers.h Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2015-04-15 09:00:47 -07:00
bpf_load.c samples/bpf: Add simple non-portable kprobe filter example 2015-04-02 13:25:50 +02:00
bpf_load.h samples/bpf: Add simple non-portable kprobe filter example 2015-04-02 13:25:50 +02:00
libbpf.c samples/bpf: Add simple non-portable kprobe filter example 2015-04-02 13:25:50 +02:00
libbpf.h Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2015-04-15 09:00:47 -07:00
Makefile Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2015-04-15 09:00:47 -07:00
sock_example.c samples/bpf: Add simple non-portable kprobe filter example 2015-04-02 13:25:50 +02:00
sockex1_kern.c samples: bpf: add skb->field examples and tests 2015-03-15 22:02:28 -04:00
sockex1_user.c samples: bpf: add skb->field examples and tests 2015-03-15 22:02:28 -04:00
sockex2_kern.c samples: bpf: add skb->field examples and tests 2015-03-15 22:02:28 -04:00
sockex2_user.c samples: bpf: add skb->field examples and tests 2015-03-15 22:02:28 -04:00
tcbpf1_kern.c bpf: fix bpf helpers to use skb->mac_header relative offsets 2015-04-16 14:08:49 -04:00
test_maps.c samples: bpf: relax test_maps check 2015-01-26 17:20:40 -08:00
test_verifier.c bpf: fix two bugs in verification logic when accessing 'ctx' pointer 2015-04-16 14:08:49 -04:00
tracex1_kern.c samples/bpf: Add simple non-portable kprobe filter example 2015-04-02 13:25:50 +02:00
tracex1_user.c samples/bpf: Add simple non-portable kprobe filter example 2015-04-02 13:25:50 +02:00
tracex2_kern.c samples/bpf: Add counting example for kfree_skb() function calls and the write() syscall 2015-04-02 13:25:50 +02:00
tracex2_user.c samples/bpf: Add counting example for kfree_skb() function calls and the write() syscall 2015-04-02 13:25:50 +02:00
tracex3_kern.c samples/bpf: Add IO latency analysis (iosnoop/heatmap) tool 2015-04-02 13:25:51 +02:00
tracex3_user.c samples/bpf: Add IO latency analysis (iosnoop/heatmap) tool 2015-04-02 13:25:51 +02:00
tracex4_kern.c samples/bpf: Add kmem_alloc()/free() tracker tool 2015-04-02 13:25:51 +02:00
tracex4_user.c samples/bpf: Add kmem_alloc()/free() tracker tool 2015-04-02 13:25:51 +02:00