diff options
| author | Alexei Starovoitov <ast@kernel.org> | 2024-03-27 09:32:25 -0700 |
|---|---|---|
| committer | Alexei Starovoitov <ast@kernel.org> | 2024-03-27 09:56:43 -0700 |
| commit | a4e02d6b91c5e57f820032ec6ad794694c86f327 (patch) | |
| tree | bf6977a9ab0b8a0c54accee088371e52c6d6d08d /kernel/bpf/verifier.c | |
| parent | 96b98a6552a90690d7bc18dd71b66312c9ded1fb (diff) | |
| parent | ecc6a2101840177e57c925c102d2d29f260d37c8 (diff) | |
| download | linux-a4e02d6b91c5e57f820032ec6ad794694c86f327.tar.gz | |
Merge branch 'check-bloom-filter-map-value-size'
Andrei Matei says:
====================
Check bloom filter map value size
v1->v2:
- prepend a patch addressing the bloom map specifically
- change low-level rejection error to EFAULT, to indicate a bug
====================
Link: https://lore.kernel.org/r/20240327024245.318299-1-andreimatei1@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Diffstat (limited to 'kernel/bpf/verifier.c')
| -rw-r--r-- | kernel/bpf/verifier.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 0bfc0050db28d4..353985b2b6a279 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -6701,6 +6701,11 @@ static int check_stack_access_within_bounds( err = check_stack_slot_within_bounds(env, min_off, state, type); if (!err && max_off > 0) err = -EINVAL; /* out of stack access into non-negative offsets */ + if (!err && access_size < 0) + /* access_size should not be negative (or overflow an int); others checks + * along the way should have prevented such an access. + */ + err = -EFAULT; /* invalid negative access size; integer overflow? */ if (err) { if (tnum_is_const(reg->var_off)) { |