Alexei Starovoitov says: ==================== pull-request: bpf 2019-01-02 The following pull-request contains BPF updates for your *net* tree. The main changes are: 1) prevent out of bounds speculation on pointer arithmetic, from Daniel. 2) typo fix, from Xiaozhou. ====================
Showing the changes to include/linux (2 of 6 files). Show all
Unified · Split
| @@ -148,6 +148,7 @@ struct bpf_verifier_state { · 147 unmodified lines | ||
| 148 | 148 | /* call stack tracking */ |
| 149 | 149 | struct bpf_func_state *frame[MAX_CALL_FRAMES]; |
| 150 | 150 | u32 curframe; |
| 151 | + bool speculative; | |
| 151 | 152 | }; |
| 152 | 153 | |
| 153 | 154 | #define bpf_get_spilled_reg(slot, frame) \ |
| @@ -167,15 +168,24 @@ struct bpf_verifier_state_list { · 13 unmodified lines | ||
| 167 | 168 | struct bpf_verifier_state_list *next; |
| 168 | 169 | }; |
| 169 | 170 | |
| 171 | +/* Possible states for alu_state member. */ | |
| 172 | +#define BPF_ALU_SANITIZE_SRC 1U | |
| 173 | +#define BPF_ALU_SANITIZE_DST 2U | |
| 174 | +#define BPF_ALU_NEG_VALUE (1U << 2) | |
| 175 | +#define BPF_ALU_SANITIZE (BPF_ALU_SANITIZE_SRC | \ | |
| 176 | + BPF_ALU_SANITIZE_DST) | |
| 177 | + | |
| 170 | 178 | struct bpf_insn_aux_data { |
| 171 | 179 | union { |
| 172 | 180 | enum bpf_reg_type ptr_type; /* pointer type for load/store insns */ |
| 173 | 181 | unsigned long map_state; /* pointer/poison value for maps */ |
| 174 | 182 | s32 call_imm; /* saved imm field of call insn */ |
| 183 | + u32 alu_limit; /* limit for add/sub register with pointer */ | |
| 175 | 184 | }; |
| 176 | 185 | int ctx_field_size; /* the ctx field size for load insn, maybe 0 */ |
| 177 | 186 | int sanitize_stack_off; /* stack slot to be cleared */ |
| 178 | 187 | bool seen; /* this insn was processed by the verifier */ |
| 188 | + u8 alu_state; /* used in combination with alu_limit */ | |
| 179 | 189 | }; |
| 180 | 190 | |
| 181 | 191 | #define MAX_USED_MAPS 64 /* max number of maps accessed by one eBPF program */ |
| @@ -212,6 +222,8 @@ struct bpf_subprog_info { · 30 unmodified lines | ||
| 212 | 222 | * one verifier_env per bpf_check() call |
| 213 | 223 | */ |
| 214 | 224 | struct bpf_verifier_env { |
| 225 | + u32 insn_idx; | |
| 226 | + u32 prev_insn_idx; | |
| 215 | 227 | struct bpf_prog *prog; /* eBPF program being verified */ |
| 216 | 228 | const struct bpf_verifier_ops *ops; |
| 217 | 229 | struct bpf_verifier_stack_elem *head; /* stack of verifier states to be processed */ |
| @@ -53,14 +53,10 @@ struct sock_reuseport; · 52 unmodified lines | ||
| 53 | 53 | #define BPF_REG_D BPF_REG_8 /* data, callee-saved */ |
| 54 | 54 | #define BPF_REG_H BPF_REG_9 /* hlen, callee-saved */ |
| 55 | 55 | |
| 56 | −/* Kernel hidden auxiliary/helper register for hardening step. | |
| 57 | − * Only used by eBPF JITs. It's nothing more than a temporary | |
| 58 | − * register that JITs use internally, only that here it's part | |
| 59 | − * of eBPF instructions that have been rewritten for blinding | |
| 60 | − * constants. See JIT pre-step in bpf_jit_blind_constants(). | |
| 61 | − */ | |
| 56 | +/* Kernel hidden auxiliary/helper register. */ | |
| 62 | 57 | #define BPF_REG_AX MAX_BPF_REG |
| 63 | −#define MAX_BPF_JIT_REG (MAX_BPF_REG + 1) | |
| 58 | +#define MAX_BPF_EXT_REG (MAX_BPF_REG + 1) | |
| 59 | +#define MAX_BPF_JIT_REG MAX_BPF_EXT_REG | |
| 64 | 60 | |
| 65 | 61 | /* unused opcode to mark special call to bpf_tail_call() helper */ |
| 66 | 62 | #define BPF_TAIL_CALL 0xf0 |