2022-05-23 07:15:26

by Shung-Hsi Yu

[permalink] [raw]
Subject: [PATCH bpf-next 2/4] bpf: verifier: explain opcode check in check_ld_imm()

The BPF_SIZE check in the beginning of check_ld_imm() actually guard
against program with JMP instructions that goes to the second
instruction of BPF_LD_IMM64, but may be easily dismissed as an simple
opcode check that's duplicating the effort of bpf_opcode_in_insntable().

Add comment to better reflect the importance of the check.

Signed-off-by: Shung-Hsi Yu <[email protected]>
---
kernel/bpf/verifier.c | 4 ++++
1 file changed, 4 insertions(+)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 79a2695ee2e2..133929751f80 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -9921,6 +9921,10 @@ static int check_ld_imm(struct bpf_verifier_env *env, struct bpf_insn *insn)
struct bpf_map *map;
int err;

+ /* checks that this is not the second part of BPF_LD_IMM64, which is
+ * skipped over during opcode check, but a JMP with invalid offset may
+ * cause check_ld_imm() to be called upon it.
+ */
if (BPF_SIZE(insn->code) != BPF_DW) {
verbose(env, "invalid BPF_LD_IMM insn\n");
return -EINVAL;
--
2.36.1