Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
Maxim Mikityanskiy 4174bd4221 bpf: Fix the off-by-two error in range markings ... commit 2fa7d94afc1afbb4d702760c058dc2d7ed30f226 upstream. The first commit cited below attempts to fix the off-by-one error that appeared in some comparisons with an open range. Due to this error, arithmetically equivalent pieces of code could get different verdicts from the verifier, for example (pseudocode): // 1. Passes the verifier: if (data + 8 > data_end) return early read *(u64 *)data, i.e. [data; data+7] // 2. Rejected by the verifier (should still pass): if (data + 7 >= data_end) return early read *(u64 *)data, i.e. [data; data+7] The attempted fix, however, shifts the range by one in a wrong direction, so the bug not only remains, but also such piece of code starts failing in the verifier: // 3. Rejected by the verifier, but the check is stricter than in #1. if (data + 8 >= data_end) return early read *(u64 *)data, i.e. [data; data+7] The change performed by that fix converted an off-by-one bug into off-by-two. The second commit cited below added the BPF selftests written to ensure than code chunks like #3 are rejected, however, they should be accepted. This commit fixes the off-by-two error by adjusting new_range in the right direction and fixes the tests by changing the range into the one that should actually fail. Fixes: fb2a311a31 ("bpf: fix off by one for range markings with L{T, E} patterns") Fixes: b37242c773 ("bpf: add test cases to bpf selftests to cover all access tests") Signed-off-by: Maxim Mikityanskiy <maximmi@nvidia.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/bpf/20211130181607.593149-1-maximmi@nvidia.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2021-12-14 14:48:59 +01:00
..
arraymap.c
bpf_lru_list.c	bpf_lru_list: Read double-checked variable once without lock	2021-03-04 10:26:16 +01:00
bpf_lru_list.h
btf.c
cgroup.c	bpf, cgroup: Fix problematic bounds check	2021-02-10 09:25:27 +01:00
core.c	bpf: Prevent increasing bpf_jit_limit above max	2021-11-17 09:48:20 +01:00
cpumap.c
devmap.c	devmap: Use bpf_map_area_alloc() for allocating hash buckets	2020-06-30 15:36:56 -04:00
disasm.c	bpf: Introduce BPF nospec instruction for mitigating Spectre v4	2021-09-15 09:47:38 +02:00
disasm.h
hashtab.c	bpf: Zero-fill re-used per-cpu map element	2020-11-18 19:20:26 +01:00
helpers.c	bpf: Fix helper bpf_map_peek_elem_proto pointing to wrong callback	2021-01-23 15:57:56 +01:00
inode.c	bpf: Fix a rcu warning for bpffs map pretty-print	2020-10-01 13:18:19 +02:00
local_storage.c
lpm_trie.c
Makefile	bpf: Don't rely on GCC __attribute__((optimize)) to disable GCSE	2020-11-18 19:20:26 +01:00
map_in_map.c
map_in_map.h
offload.c
percpu_freelist.c
percpu_freelist.h
queue_stack_maps.c
reuseport_array.c
stackmap.c	bpf: Fix integer overflow in prealloc_elems_and_freelist()	2021-10-13 10:08:18 +02:00
syscall.c	bpf: sockmap: Require attach_bpf_fd when detaching a program	2020-08-07 09:34:02 +02:00
sysfs_btf.c	bpf: Fix sysfs export of empty BTF section	2020-10-14 10:32:58 +02:00
tnum.c
verifier.c	bpf: Fix the off-by-two error in range markings	2021-12-14 14:48:59 +01:00
xskmap.c