From: Arnaldo Carvalho de Melo <acme@kernel.org>
To: David Miller <davem@davemloft.net>
Cc: yhs@fb.com, daniel@iogearbox.net, jolsa@redhat.com, kafai@fb.com,
alexei.starovoitov@gmail.com, netdev@vger.kernel.org
Subject: Re: Help with the BPF verifier
Date: Thu, 1 Nov 2018 16:13:10 -0300 [thread overview]
Message-ID: <20181101191310.GB20495@kernel.org> (raw)
In-Reply-To: <20181101.121039.2134340499361533233.davem@davemloft.net>
Em Thu, Nov 01, 2018 at 12:10:39PM -0700, David Miller escreveu:
> From: Arnaldo Carvalho de Melo <acme@kernel.org>
> Date: Thu, 1 Nov 2018 15:52:17 -0300
>
> > 50 unsigned int filename_arg = 6;
> ...
> > --- /wb/augmented_raw_syscalls.c.old 2018-11-01 15:43:55.000394234 -0300
> > +++ /wb/augmented_raw_syscalls.c 2018-11-01 15:44:15.102367838 -0300
> > @@ -67,7 +67,7 @@
> > augmented_args.filename.reserved = 0;
> > augmented_args.filename.size = probe_read_str(&augmented_args.filename.value,
> > sizeof(augmented_args.filename.value),
> > - (const void *)args->args[0]);
> > + (const void *)args->args[filename_arg]);
>
> args[] is sized to '6', therefore the last valid index is '5', yet you're using '6' here which
> is one entry past the end of the declared array.
Nope... this is inside an if:
if (filename_arg <= 5) {
augmented_args.filename.reserved = 0;
augmented_args.filename.size = probe_read_str(&augmented_args.filename.value,
sizeof(augmented_args.filename.value),
(const void *)args->args[filename_arg]);
if (augmented_args.filename.size < sizeof(augmented_args.filename.value)) {
len -= sizeof(augmented_args.filename.value) - augmented_args.filename.size;
len &= sizeof(augmented_args.filename.value) - 1;
}
} else {
I use 6 to mean "hey, this syscall doesn't have any string argument, don't
bother with it".
- Arnaldo
next prev parent reply other threads:[~2018-11-02 4:17 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-11-01 18:52 Help with the BPF verifier Arnaldo Carvalho de Melo
2018-11-01 19:10 ` David Miller
2018-11-01 19:13 ` Arnaldo Carvalho de Melo [this message]
2018-11-01 19:28 ` David Miller
2018-11-01 20:05 ` Edward Cree
2018-11-02 15:02 ` Arnaldo Carvalho de Melo
2018-11-02 15:42 ` Edward Cree
2018-11-02 21:27 ` Yonghong Song
2018-11-05 12:33 ` Arnaldo Carvalho de Melo
2018-11-03 11:29 ` Arnaldo Carvalho de Melo
2018-11-03 11:32 ` Arnaldo Carvalho de Melo
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20181101191310.GB20495@kernel.org \
--to=acme@kernel.org \
--cc=alexei.starovoitov@gmail.com \
--cc=daniel@iogearbox.net \
--cc=davem@davemloft.net \
--cc=jolsa@redhat.com \
--cc=kafai@fb.com \
--cc=netdev@vger.kernel.org \
--cc=yhs@fb.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.