• Krzesimir Nowak's avatar
    bpf: fix undefined behavior in narrow load handling · e2f7fc0a
    Krzesimir Nowak authored
    Commit 31fd8581 ("bpf: permits narrower load from bpf program
    context fields") made the verifier add AND instructions to clear the
    unwanted bits with a mask when doing a narrow load. The mask is
    computed with
    
      (1 << size * 8) - 1
    
    where "size" is the size of the narrow load. When doing a 4 byte load
    of a an 8 byte field the verifier shifts the literal 1 by 32 places to
    the left. This results in an overflow of a signed integer, which is an
    undefined behavior. Typically, the computed mask was zero, so the
    result of the narrow load ended up being zero too.
    
    Cast the literal to long long to avoid overflows. Note that narrow
    load of the 4 byte fields does not have the undefined behavior,
    because the load size can only be either 1 or 2 bytes, so shifting 1
    by 8 or 16 places will not overflow it. And reading 4 bytes would not
    be a narrow load of a 4 bytes field.
    
    Fixes: 31fd8581 ("bpf: permits narrower load from bpf program context fields")
    Reviewed-by: default avatarAlban Crequy <alban@kinvolk.io>
    Reviewed-by: default avatarIago López Galeiras <iago@kinvolk.io>
    Signed-off-by: default avatarKrzesimir Nowak <krzesimir@kinvolk.io>
    Cc: Yonghong Song <yhs@fb.com>
    Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
    e2f7fc0a
verifier.c 238 KB