lkml.org 
[lkml]   [2021]   [Mar]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: linux-next: manual merge of the net-next tree with the net tree
From
Date
On 3/19/21 3:11 AM, Piotr Krysiuk wrote:
> Hi Daniel,
>
> On Fri, Mar 19, 2021 at 12:16 AM Stephen Rothwell <sfr@canb.auug.org.au>
> wrote:
>
>> diff --cc kernel/bpf/verifier.c
>> index 44e4ec1640f1,f9096b049cd6..000000000000
>> --- a/kernel/bpf/verifier.c
>> +++ b/kernel/bpf/verifier.c
>> @@@ -5876,10 -6056,22 +6060,23 @@@ static int retrieve_ptr_limit(const str
>> if (mask_to_left)
>> *ptr_limit = MAX_BPF_STACK + off;
>> else
>> - *ptr_limit = -off;
>> - return 0;
>> + *ptr_limit = -off - 1;
>> + return *ptr_limit >= max ? -ERANGE : 0;
>> + case PTR_TO_MAP_KEY:
>> + /* Currently, this code is not exercised as the only use
>> + * is bpf_for_each_map_elem() helper which requires
>> + * bpf_capble. The code has been tested manually for
>> + * future use.
>> + */
>> + if (mask_to_left) {
>> + *ptr_limit = ptr_reg->umax_value + ptr_reg->off;
>> + } else {
>> + off = ptr_reg->smin_value + ptr_reg->off;
>> + *ptr_limit = ptr_reg->map_ptr->key_size - off;
>> + }
>> + return 0;
>>
>
> PTR_TO_MAP_VALUE logic above looks like copy-paste of old PTR_TO_MAP_VALUE
> code from before "bpf: Fix off-by-one for area size in creating mask to
> left" and is apparently affected by the same off-by-one, except this time
> on "key_size" area and not "value_size".
>
> This needs to be fixed in the same way as we did with PTR_TO_MAP_VALUE.
> What is the best way to proceed?

Hm, not sure why PTR_TO_MAP_KEY was added by 69c087ba6225 in the first place, I
presume noone expects this to be used from unprivileged as the comment says.
Resolution should be to remove the PTR_TO_MAP_KEY case entirely from that switch
until we have an actual user.

Thanks,
Daniel

\
 
 \ /
  Last update: 2021-03-19 08:23    [W:0.069 / U:0.384 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site