All of lore.kernel.org
 help / color / mirror / Atom feed
From: Jiri Slaby <jslaby@suse.cz>
To: stable@vger.kernel.org
Cc: linux-kernel@vger.kernel.org, Mathias Svensson <idolf@google.com>,
	Kees Cook <keescook@chromium.org>,
	James Morris <james.l.morris@oracle.com>,
	Jiri Slaby <jslaby@suse.cz>
Subject: [PATCH 3.12 29/60] samples/seccomp: fix 64-bit comparison macros
Date: Tue, 14 Mar 2017 14:15:20 +0100	[thread overview]
Message-ID: <cfe74e80a5d26c388267f55cbf82fd562630b993.1489497268.git.jslaby@suse.cz> (raw)
In-Reply-To: <d93cf67053e241539a1ef7c30ee8583022bc0e89.1489497268.git.jslaby@suse.cz>
In-Reply-To: <cover.1489497268.git.jslaby@suse.cz>

From: Mathias Svensson <idolf@google.com>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit 916cafdc95843fb9af5fd5f83ca499d75473d107 upstream.

There were some bugs in the JNE64 and JLT64 comparision macros. This fixes
them, improves comments, and cleans up the file while we are at it.

Reported-by: Stephen Röttger <sroettger@google.com>
Signed-off-by: Mathias Svensson <idolf@google.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: James Morris <james.l.morris@oracle.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 samples/seccomp/bpf-helper.h | 125 +++++++++++++++++++++++++------------------
 1 file changed, 72 insertions(+), 53 deletions(-)

diff --git a/samples/seccomp/bpf-helper.h b/samples/seccomp/bpf-helper.h
index 38ee70f3cd5b..1d8de9edd858 100644
--- a/samples/seccomp/bpf-helper.h
+++ b/samples/seccomp/bpf-helper.h
@@ -138,7 +138,7 @@ union arg64 {
 #define ARG_32(idx) \
 	BPF_STMT(BPF_LD+BPF_W+BPF_ABS, LO_ARG(idx))
 
-/* Loads hi into A and lo in X */
+/* Loads lo into M[0] and hi into M[1] and A */
 #define ARG_64(idx) \
 	BPF_STMT(BPF_LD+BPF_W+BPF_ABS, LO_ARG(idx)), \
 	BPF_STMT(BPF_ST, 0), /* lo -> M[0] */ \
@@ -153,88 +153,107 @@ union arg64 {
 	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (value), 1, 0), \
 	jt
 
-/* Checks the lo, then swaps to check the hi. A=lo,X=hi */
+#define JA32(value, jt) \
+	BPF_JUMP(BPF_JMP+BPF_JSET+BPF_K, (value), 0, 1), \
+	jt
+
+#define JGE32(value, jt) \
+	BPF_JUMP(BPF_JMP+BPF_JGE+BPF_K, (value), 0, 1), \
+	jt
+
+#define JGT32(value, jt) \
+	BPF_JUMP(BPF_JMP+BPF_JGT+BPF_K, (value), 0, 1), \
+	jt
+
+#define JLE32(value, jt) \
+	BPF_JUMP(BPF_JMP+BPF_JGT+BPF_K, (value), 1, 0), \
+	jt
+
+#define JLT32(value, jt) \
+	BPF_JUMP(BPF_JMP+BPF_JGE+BPF_K, (value), 1, 0), \
+	jt
+
+/*
+ * All the JXX64 checks assume lo is saved in M[0] and hi is saved in both
+ * A and M[1]. This invariant is kept by restoring A if necessary.
+ */
 #define JEQ64(lo, hi, jt) \
+	/* if (hi != arg.hi) goto NOMATCH; */ \
 	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (hi), 0, 5), \
 	BPF_STMT(BPF_LD+BPF_MEM, 0), /* swap in lo */ \
+	/* if (lo != arg.lo) goto NOMATCH; */ \
 	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (lo), 0, 2), \
-	BPF_STMT(BPF_LD+BPF_MEM, 1), /* passed: swap hi back in */ \
+	BPF_STMT(BPF_LD+BPF_MEM, 1), \
 	jt, \
-	BPF_STMT(BPF_LD+BPF_MEM, 1) /* failed: swap hi back in */
+	BPF_STMT(BPF_LD+BPF_MEM, 1)
 
 #define JNE64(lo, hi, jt) \
-	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (hi), 5, 0), \
-	BPF_STMT(BPF_LD+BPF_MEM, 0), /* swap in lo */ \
+	/* if (hi != arg.hi) goto MATCH; */ \
+	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (hi), 0, 3), \
+	BPF_STMT(BPF_LD+BPF_MEM, 0), \
+	/* if (lo != arg.lo) goto MATCH; */ \
 	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (lo), 2, 0), \
-	BPF_STMT(BPF_LD+BPF_MEM, 1), /* passed: swap hi back in */ \
+	BPF_STMT(BPF_LD+BPF_MEM, 1), \
 	jt, \
-	BPF_STMT(BPF_LD+BPF_MEM, 1) /* failed: swap hi back in */
-
-#define JA32(value, jt) \
-	BPF_JUMP(BPF_JMP+BPF_JSET+BPF_K, (value), 0, 1), \
-	jt
+	BPF_STMT(BPF_LD+BPF_MEM, 1)
 
 #define JA64(lo, hi, jt) \
+	/* if (hi & arg.hi) goto MATCH; */ \
 	BPF_JUMP(BPF_JMP+BPF_JSET+BPF_K, (hi), 3, 0), \
-	BPF_STMT(BPF_LD+BPF_MEM, 0), /* swap in lo */ \
+	BPF_STMT(BPF_LD+BPF_MEM, 0), \
+	/* if (lo & arg.lo) goto MATCH; */ \
 	BPF_JUMP(BPF_JMP+BPF_JSET+BPF_K, (lo), 0, 2), \
-	BPF_STMT(BPF_LD+BPF_MEM, 1), /* passed: swap hi back in */ \
+	BPF_STMT(BPF_LD+BPF_MEM, 1), \
 	jt, \
-	BPF_STMT(BPF_LD+BPF_MEM, 1) /* failed: swap hi back in */
+	BPF_STMT(BPF_LD+BPF_MEM, 1)
 
-#define JGE32(value, jt) \
-	BPF_JUMP(BPF_JMP+BPF_JGE+BPF_K, (value), 0, 1), \
-	jt
-
-#define JLT32(value, jt) \
-	BPF_JUMP(BPF_JMP+BPF_JGE+BPF_K, (value), 1, 0), \
-	jt
-
-/* Shortcut checking if hi > arg.hi. */
 #define JGE64(lo, hi, jt) \
+	/* if (hi > arg.hi) goto MATCH; */ \
 	BPF_JUMP(BPF_JMP+BPF_JGT+BPF_K, (hi), 4, 0), \
+	/* if (hi != arg.hi) goto NOMATCH; */ \
 	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (hi), 0, 5), \
-	BPF_STMT(BPF_LD+BPF_MEM, 0), /* swap in lo */ \
+	BPF_STMT(BPF_LD+BPF_MEM, 0), \
+	/* if (lo >= arg.lo) goto MATCH; */ \
 	BPF_JUMP(BPF_JMP+BPF_JGE+BPF_K, (lo), 0, 2), \
-	BPF_STMT(BPF_LD+BPF_MEM, 1), /* passed: swap hi back in */ \
-	jt, \
-	BPF_STMT(BPF_LD+BPF_MEM, 1) /* failed: swap hi back in */
-
-#define JLT64(lo, hi, jt) \
-	BPF_JUMP(BPF_JMP+BPF_JGE+BPF_K, (hi), 0, 4), \
-	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (hi), 0, 5), \
-	BPF_STMT(BPF_LD+BPF_MEM, 0), /* swap in lo */ \
-	BPF_JUMP(BPF_JMP+BPF_JGT+BPF_K, (lo), 2, 0), \
-	BPF_STMT(BPF_LD+BPF_MEM, 1), /* passed: swap hi back in */ \
+	BPF_STMT(BPF_LD+BPF_MEM, 1), \
 	jt, \
-	BPF_STMT(BPF_LD+BPF_MEM, 1) /* failed: swap hi back in */
+	BPF_STMT(BPF_LD+BPF_MEM, 1)
 
-#define JGT32(value, jt) \
-	BPF_JUMP(BPF_JMP+BPF_JGT+BPF_K, (value), 0, 1), \
-	jt
-
-#define JLE32(value, jt) \
-	BPF_JUMP(BPF_JMP+BPF_JGT+BPF_K, (value), 1, 0), \
-	jt
-
-/* Check hi > args.hi first, then do the GE checking */
 #define JGT64(lo, hi, jt) \
+	/* if (hi > arg.hi) goto MATCH; */ \
 	BPF_JUMP(BPF_JMP+BPF_JGT+BPF_K, (hi), 4, 0), \
+	/* if (hi != arg.hi) goto NOMATCH; */ \
 	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (hi), 0, 5), \
-	BPF_STMT(BPF_LD+BPF_MEM, 0), /* swap in lo */ \
+	BPF_STMT(BPF_LD+BPF_MEM, 0), \
+	/* if (lo > arg.lo) goto MATCH; */ \
 	BPF_JUMP(BPF_JMP+BPF_JGT+BPF_K, (lo), 0, 2), \
-	BPF_STMT(BPF_LD+BPF_MEM, 1), /* passed: swap hi back in */ \
+	BPF_STMT(BPF_LD+BPF_MEM, 1), \
 	jt, \
-	BPF_STMT(BPF_LD+BPF_MEM, 1) /* failed: swap hi back in */
+	BPF_STMT(BPF_LD+BPF_MEM, 1)
 
 #define JLE64(lo, hi, jt) \
-	BPF_JUMP(BPF_JMP+BPF_JGT+BPF_K, (hi), 6, 0), \
-	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (hi), 0, 3), \
-	BPF_STMT(BPF_LD+BPF_MEM, 0), /* swap in lo */ \
+	/* if (hi < arg.hi) goto MATCH; */ \
+	BPF_JUMP(BPF_JMP+BPF_JGE+BPF_K, (hi), 0, 4), \
+	/* if (hi != arg.hi) goto NOMATCH; */ \
+	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (hi), 0, 5), \
+	BPF_STMT(BPF_LD+BPF_MEM, 0), \
+	/* if (lo <= arg.lo) goto MATCH; */ \
 	BPF_JUMP(BPF_JMP+BPF_JGT+BPF_K, (lo), 2, 0), \
-	BPF_STMT(BPF_LD+BPF_MEM, 1), /* passed: swap hi back in */ \
+	BPF_STMT(BPF_LD+BPF_MEM, 1), \
+	jt, \
+	BPF_STMT(BPF_LD+BPF_MEM, 1)
+
+#define JLT64(lo, hi, jt) \
+	/* if (hi < arg.hi) goto MATCH; */ \
+	BPF_JUMP(BPF_JMP+BPF_JGE+BPF_K, (hi), 0, 4), \
+	/* if (hi != arg.hi) goto NOMATCH; */ \
+	BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (hi), 0, 5), \
+	BPF_STMT(BPF_LD+BPF_MEM, 0), \
+	/* if (lo < arg.lo) goto MATCH; */ \
+	BPF_JUMP(BPF_JMP+BPF_JGE+BPF_K, (lo), 2, 0), \
+	BPF_STMT(BPF_LD+BPF_MEM, 1), \
 	jt, \
-	BPF_STMT(BPF_LD+BPF_MEM, 1) /* failed: swap hi back in */
+	BPF_STMT(BPF_LD+BPF_MEM, 1)
 
 #define LOAD_SYSCALL_NR \
 	BPF_STMT(BPF_LD+BPF_W+BPF_ABS, \
-- 
2.12.0

  parent reply	other threads:[~2017-03-14 13:28 UTC|newest]

Thread overview: 63+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-03-14 13:15 [PATCH 3.12 00/60] 3.12.72-stable review Jiri Slaby
2017-03-14 13:14 ` [PATCH 3.12 01/60] md linear: fix a race between linear_add() and linear_congested() Jiri Slaby
2017-03-14 13:14 ` [PATCH 3.12 02/60] sctp: deny peeloff operation on asocs with threads sleeping on it Jiri Slaby
2017-03-14 13:14 ` [PATCH 3.12 03/60] net/sched: em_meta: Fix 'meta vlan' to correctly recognize zero VID frames Jiri Slaby
2017-03-14 13:14 ` [PATCH 3.12 04/60] perf trace: Use the syscall raw_syscalls:sys_enter timestamp Jiri Slaby
2017-03-14 13:14 ` [PATCH 3.12 05/60] MIPS: Fix special case in 64 bit IP checksumming Jiri Slaby
2017-03-14 13:14 ` [PATCH 3.12 06/60] MIPS: OCTEON: Fix copy_from_user fault handling for large buffers Jiri Slaby
2017-03-14 13:14 ` [PATCH 3.12 07/60] MIPS: Clear ISA bit correctly in get_frame_info() Jiri Slaby
2017-03-14 13:14 ` [PATCH 3.12 08/60] MIPS: Prevent unaligned accesses during stack unwinding Jiri Slaby
2017-03-14 13:15 ` [PATCH 3.12 09/60] MIPS: Fix get_frame_info() handling of microMIPS function size Jiri Slaby
2017-03-14 13:15 ` [PATCH 3.12 10/60] MIPS: Fix is_jump_ins() handling of 16b microMIPS instructions Jiri Slaby
2017-03-14 13:15 ` [PATCH 3.12 11/60] MIPS: Calculate microMIPS ra properly when unwinding the stack Jiri Slaby
2017-03-14 13:15 ` [PATCH 3.12 12/60] MIPS: Handle microMIPS jumps in the same way as MIPS32/MIPS64 jumps Jiri Slaby
2017-03-14 13:15 ` [PATCH 3.12 13/60] uvcvideo: Fix a wrong macro Jiri Slaby
2017-03-14 13:15 ` [PATCH 3.12 14/60] ALSA: hda - fix Lewisburg audio issue Jiri Slaby
2017-03-14 13:15 ` [PATCH 3.12 15/60] ALSA: timer: Reject user params with too small ticks Jiri Slaby
2017-03-14 13:15 ` [PATCH 3.12 16/60] ALSA: seq: Fix link corruption by event error handling Jiri Slaby
2017-03-14 13:15 ` [PATCH 3.12 17/60] staging: rtl: fix possible NULL pointer dereference Jiri Slaby
2017-03-14 13:15 ` [PATCH 3.12 18/60] mm: vmpressure: fix sending wrong events on underflow Jiri Slaby
2017-03-14 13:15 ` [PATCH 3.12 19/60] ipc/shm: Fix shmat mmap nil-page protection Jiri Slaby
2017-03-14 13:15 ` [PATCH 3.12 20/60] scsi: storvsc: use tagged SRB requests if supported by the device Jiri Slaby
2017-03-14 13:15 ` [PATCH 3.12 21/60] scsi: storvsc: properly handle SRB_ERROR when sense message is present Jiri Slaby
2017-03-14 13:15 ` [PATCH 3.12 22/60] scsi: storvsc: properly set residual data length on errors Jiri Slaby
2017-03-14 13:15 ` [PATCH 3.12 23/60] scsi: aacraid: Reorder Adapter status check Jiri Slaby
2017-03-14 13:15   ` Jiri Slaby
2017-03-14 13:15 ` [PATCH 3.12 24/60] sd: get disk reference in sd_check_events() Jiri Slaby
2017-03-14 13:15 ` [PATCH 3.12 25/60] jbd2: don't leak modified metadata buffers on an aborted journal Jiri Slaby
2017-03-14 13:15 ` [PATCH 3.12 26/60] ext4: trim allocation requests to group size Jiri Slaby
2017-03-14 13:15 ` [PATCH 3.12 27/60] ext4: preserve the needs_recovery flag when the journal is aborted Jiri Slaby
2017-03-14 13:15 ` [PATCH 3.12 28/60] ext4: return EROFS if device is r/o and journal replay is needed Jiri Slaby
2017-03-14 13:15 ` Jiri Slaby [this message]
2017-03-14 13:15 ` [PATCH 3.12 30/60] ath5k: drop bogus warning on drv_set_key with unsupported cipher Jiri Slaby
2017-03-14 13:15 ` [PATCH 3.12 31/60] ath9k: use correct OTP register offsets for the AR9340 and AR9550 Jiri Slaby
2017-03-14 13:15 ` [PATCH 3.12 32/60] fuse: add missing FR_FORCE Jiri Slaby
2017-03-14 13:15 ` [PATCH 3.12 33/60] can: usb_8dev: Fix memory leak of priv->cmd_msg_buffer Jiri Slaby
2017-03-14 13:15 ` [PATCH 3.12 34/60] hv: allocate synic pages for all present CPUs Jiri Slaby
2017-03-14 13:15 ` [PATCH 3.12 35/60] RDMA/core: Fix incorrect structure packing for booleans Jiri Slaby
2017-03-14 13:15 ` [PATCH 3.12 36/60] rdma_cm: fail iwarp accepts w/o connection params Jiri Slaby
2017-03-14 13:15 ` [PATCH 3.12 37/60] NFSv4: Fix memory and state leak in _nfs4_open_and_get_state Jiri Slaby
2017-03-14 13:15 ` [PATCH 3.12 38/60] NFSv4: fix getacl head length estimation Jiri Slaby
2017-03-14 13:15 ` [PATCH 3.12 39/60] NFSv4: fix getacl ERANGE for some ACL buffer sizes Jiri Slaby
2017-03-14 13:15 ` [PATCH 3.12 40/60] bcma: use (get|put)_device when probing/removing device driver Jiri Slaby
2017-03-14 13:15 ` [PATCH 3.12 41/60] powerpc/xmon: Fix data-breakpoint Jiri Slaby
2017-03-14 13:15 ` [PATCH 3.12 42/60] MIPS: IP22: Reformat inline assembler code to modern standards Jiri Slaby
2017-03-14 13:15 ` [PATCH 3.12 43/60] MIPS: IP22: Fix build error due to binutils 2.25 uselessnes Jiri Slaby
2017-03-14 13:15 ` [PATCH 3.12 44/60] scsi: lpfc: Correct WQ creation for pagesize Jiri Slaby
2017-03-14 13:15 ` [PATCH 3.12 45/60] TTY: n_hdlc, fix lockdep false positive Jiri Slaby
2017-03-14 13:15 ` [PATCH 3.12 46/60] tty: n_hdlc: get rid of racy n_hdlc.tbuf Jiri Slaby
2017-03-14 13:15 ` [PATCH 3.12 47/60] serial: 8250_pci: Add MKS Tenta SCOM-0800 and SCOM-0801 cards Jiri Slaby
2017-03-14 13:15 ` [PATCH 3.12 48/60] KVM: VMX: use correct vmcs_read/write for guest segment selector/base Jiri Slaby
2017-03-14 13:15 ` [PATCH 3.12 49/60] Bluetooth: Add another AR3012 04ca:3018 device Jiri Slaby
2017-03-14 13:15 ` [PATCH 3.12 50/60] s390/qdio: clear DSCI prior to scanning multiple input queues Jiri Slaby
2017-03-14 13:15 ` [PATCH 3.12 51/60] s390: TASK_SIZE for kernel threads Jiri Slaby
2017-03-14 13:15 ` [PATCH 3.12 52/60] IB/ipoib: Fix deadlock between rmmod and set_mode Jiri Slaby
2017-03-14 13:15 ` [PATCH 3.12 53/60] ktest: Fix child exit code processing Jiri Slaby
2017-03-14 13:15 ` [PATCH 3.12 54/60] nlm: Ensure callback code also checks that the files match Jiri Slaby
2017-03-14 13:15 ` [PATCH 3.12 55/60] xtensa: move parse_tag_fdt out of #ifdef CONFIG_BLK_DEV_INITRD Jiri Slaby
2017-03-14 13:15 ` [PATCH 3.12 56/60] mac80211: flush delayed work when entering suspend Jiri Slaby
2017-03-14 13:15 ` [PATCH 3.12 57/60] drm/ast: Fix test for VGA enabled Jiri Slaby
2017-03-14 13:15 ` [PATCH 3.12 58/60] drm/ttm: Make sure BOs being swapped out are cacheable Jiri Slaby
2017-03-14 13:15 ` [PATCH 3.12 59/60] fat: fix using uninitialized fields of fat_inode/fsinfo_inode Jiri Slaby
2017-03-14 13:15 ` [PATCH 3.12 60/60] drivers: hv: Turn off write permission on the hypercall page Jiri Slaby
2017-03-14 13:24 ` [PATCH 3.12 00/60] 3.12.72-stable review Guenter Roeck

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=cfe74e80a5d26c388267f55cbf82fd562630b993.1489497268.git.jslaby@suse.cz \
    --to=jslaby@suse.cz \
    --cc=idolf@google.com \
    --cc=james.l.morris@oracle.com \
    --cc=keescook@chromium.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.