]> www.infradead.org Git - users/jedix/linux-maple.git/commit
bpf: Fix array bounds error with may_goto
authorJiayuan Chen <mrpre@163.com>
Fri, 14 Feb 2025 09:18:21 +0000 (17:18 +0800)
committerAlexei Starovoitov <ast@kernel.org>
Sat, 15 Feb 2025 03:55:15 +0000 (19:55 -0800)
commit6ebc5030e0c5a698f1dd9a6684cddf6ccaed64a0
tree5d78b829c244e55bd58e0f7a29ce5fa60ff52622
parenta4585442ade5ac722248137dc650bff55ebb8ca0
bpf: Fix array bounds error with may_goto

may_goto uses an additional 8 bytes on the stack, which causes the
interpreters[] array to go out of bounds when calculating index by
stack_size.

1. If a BPF program is rewritten, re-evaluate the stack size. For non-JIT
cases, reject loading directly.

2. For non-JIT cases, calculating interpreters[idx] may still cause
out-of-bounds array access, and just warn about it.

3. For jit_requested cases, the execution of bpf_func also needs to be
warned. So move the definition of function __bpf_prog_ret0_warn out of
the macro definition CONFIG_BPF_JIT_ALWAYS_ON.

Reported-by: syzbot+d2a2c639d03ac200a4f1@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/bpf/0000000000000f823606139faa5d@google.com/
Fixes: 011832b97b311 ("bpf: Introduce may_goto instruction")
Signed-off-by: Jiayuan Chen <mrpre@163.com>
Link: https://lore.kernel.org/r/20250214091823.46042-2-mrpre@163.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
kernel/bpf/core.c
kernel/bpf/verifier.c