diff options
| author | Edward Cree | 2018-11-16 13:00:07 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman | 2018-12-17 09:24:42 +0100 |
| commit | bddeb44981c1f5dd699ff45cce6ce31e59c0300c (patch) | |
| tree | c681bbdef17036d15f2fd454ac43710d139232c9 /kernel | |
| parent | IB/hfi1: Fix an out-of-bounds access in get_hw_stats (diff) | |
| download | kernel-qcow2-linux-bddeb44981c1f5dd699ff45cce6ce31e59c0300c.tar.gz kernel-qcow2-linux-bddeb44981c1f5dd699ff45cce6ce31e59c0300c.tar.xz kernel-qcow2-linux-bddeb44981c1f5dd699ff45cce6ce31e59c0300c.zip | |
bpf: fix off-by-one error in adjust_subprog_starts
commit afd594240806acc138cf696c09f2f4829d55d02f upstream.
When patching in a new sequence for the first insn of a subprog, the start
of that subprog does not change (it's the first insn of the sequence), so
adjust_subprog_starts should check start <= off (rather than < off).
Also added a test to test_verifier.c (it's essentially the syz reproducer).
Fixes: cc8b0b92a169 ("bpf: introduce function calls (function boundaries)")
Reported-by: syzbot+4fc427c7af994b0948be@syzkaller.appspotmail.com
Signed-off-by: Edward Cree <ecree@solarflare.com>
Acked-by: Yonghong Song <yhs@fb.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'kernel')
| -rw-r--r-- | kernel/bpf/verifier.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 5780876ac81a..56acfbb80104 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -5283,7 +5283,7 @@ static void adjust_subprog_starts(struct bpf_verifier_env *env, u32 off, u32 len return; /* NOTE: fake 'exit' subprog should be updated as well. */ for (i = 0; i <= env->subprog_cnt; i++) { - if (env->subprog_info[i].start < off) + if (env->subprog_info[i].start <= off) continue; env->subprog_info[i].start += len - 1; } |