From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Google-Smtp-Source: AH8x226RnUwe4Xq2KHTMMbk8AUPgr8yjM5nDLVVxo0q+00rUkoGv3NQWZz0ed3SXkidKW/65CjFA ARC-Seal: i=1; a=rsa-sha256; t=1517256687; cv=none; d=google.com; s=arc-20160816; b=r7eOrUfk9yWyQnhv3OWbGwICa0ljdWnwAgdy7BymQj3OVWoqVytBgOXyL/R5r+F8yv RJyCatzk5gWGUmgU3p+i7APYXHLs7UIavog0Rrpd03C3QnBDhWIq0kgh6QV1B4Lr0OaR ZNiBYUo/q5AtcaCoszp9dJggsltZ+2mRmPFGrgqvp+oRbJl4nmUES9Itq9u98wAVYUcX KEl/97nCGuG1n0krcgeATvCUR2mAg89rGJ13H/b3s84lCH8wIckHD7WFlpIS57I9zsr7 apI4LL8ycFeb+Vds9OKNIdVRJJRUwcXTvo7Zgrl/zvF8phtOeuhodpmYA0F7v91Y+ZzZ 8Zlw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=mime-version:user-agent:references:in-reply-to:message-id:date :subject:cc:to:from:arc-authentication-results; bh=n1XJ2k8EgoG/6f9zRyDvVGvVitZGyH1hNTLpJRww0Es=; b=kTXmQVQZpupq8QjPcmttfNJlY4hUvK6FEAHZIDEc/G3PMSQs8mAYyoWAQPAJ03XuX/ OZ0/Fe5j2/eRxqOEZKEhwPXyI1+2kIDwVYmDlr263JfCEvE0eTreURBltT1qojCOFM5R ytfZBhx+meboDXha8+fi1XHhtB1eTZgZTMsWkNQBHPJI+hBqkS3t4NfOepaxVcAL8AfA b8MVFxjs9D2xrrePteoEqcNvmKT7UAMtOsmfDBXmF35WQ4HY+jy1rZXaBy+0sGuWeu3Y PXRgV6m7yZaxlZ10Q2JQ3WaTXSXsm8A8jbm6+hJlj3v6/5ITUoUGPKWc7VXL3Iu/7V/B mLxw== ARC-Authentication-Results: i=1; mx.google.com; spf=softfail (google.com: domain of transitioning gregkh@linuxfoundation.org does not designate 90.92.71.90 as permitted sender) smtp.mailfrom=gregkh@linuxfoundation.org Authentication-Results: mx.google.com; spf=softfail (google.com: domain of transitioning gregkh@linuxfoundation.org does not designate 90.92.71.90 as permitted sender) smtp.mailfrom=gregkh@linuxfoundation.org From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "ast@kernel.org, stable@vger.kernel.org, Daniel Borkmann" , syzbot+93c4904c5c70348a6890@syzkaller.appspotmail.com, Alexei Starovoitov , Daniel Borkmann Subject: [PATCH 4.9 62/66] bpf: arsh is not supported in 32 bit alu thus reject it Date: Mon, 29 Jan 2018 13:57:26 +0100 Message-Id: <20180129123843.167617307@linuxfoundation.org> X-Mailer: git-send-email 2.16.1 In-Reply-To: <20180129123839.842860149@linuxfoundation.org> References: <20180129123839.842860149@linuxfoundation.org> User-Agent: quilt/0.65 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-LABELS: =?utf-8?b?IlxcU2VudCI=?= X-GMAIL-THRID: =?utf-8?q?1590958948434082982?= X-GMAIL-MSGID: =?utf-8?q?1590958948434082982?= X-Mailing-List: linux-kernel@vger.kernel.org List-ID: 4.9-stable review patch. If anyone has any objections, please let me know. ------------------ From: Daniel Borkmann [ upstream commit 7891a87efc7116590eaba57acc3c422487802c6f ] The following snippet was throwing an 'unknown opcode cc' warning in BPF interpreter: 0: (18) r0 = 0x0 2: (7b) *(u64 *)(r10 -16) = r0 3: (cc) (u32) r0 s>>= (u32) r0 4: (95) exit Although a number of JITs do support BPF_ALU | BPF_ARSH | BPF_{K,X} generation, not all of them do and interpreter does neither. We can leave existing ones and implement it later in bpf-next for the remaining ones, but reject this properly in verifier for the time being. Fixes: 17a5267067f3 ("bpf: verifier (add verifier core)") Reported-by: syzbot+93c4904c5c70348a6890@syzkaller.appspotmail.com Signed-off-by: Daniel Borkmann Signed-off-by: Alexei Starovoitov Signed-off-by: Greg Kroah-Hartman --- kernel/bpf/verifier.c | 5 +++++ 1 file changed, 5 insertions(+) --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -1843,6 +1843,11 @@ static int check_alu_op(struct bpf_verif return -EINVAL; } + if (opcode == BPF_ARSH && BPF_CLASS(insn->code) != BPF_ALU64) { + verbose("BPF_ARSH not supported for 32 bit ALU\n"); + return -EINVAL; + } + if ((opcode == BPF_LSH || opcode == BPF_RSH || opcode == BPF_ARSH) && BPF_SRC(insn->code) == BPF_K) { int size = BPF_CLASS(insn->code) == BPF_ALU64 ? 64 : 32;