diff options
| author | Woojin Ji <random6.xyz@gmail.com> | 2026-10-18 13:21:41 +0900 |
|---|---|---|
| committer | Alexei Starovoitov <ast@kernel.org> | 2026-10-18 15:28:51 +0000 |
| commit | 1c1dda9ba9f3af9cd511a197dcc86de2465d8fe5 (patch) | |
| tree | 5a7e72b543ba1c07d3b5f28641dff6321c8d8b5f /kernel/bpf | |
| parent | 8cebaa3be829c88a59957900f8de98fed09daefe (diff) | |
bpf: Zero-extend the index in inlined bpf_get_func_arg()
bpf_get_func_arg() takes a u32 index, but the inlined expansion compared
only the low 32 bits of R2 with the argument count and then shifted the
full 64-bit register to compute the context address. R2 is ARG_ANYTHING,
so nothing guarantees that its upper bits are zero: an index of
1ULL << 32 passes the bounds check as index zero while the load is
performed at ctx + (1ULL << 35).
Shift the index as a 32-bit value. When the 32-bit bounds check passes,
the low 32 bits of R2 are below R0, and R0 is at most 255: the trampoline
arm masks the argument count with 0xFF and the raw_tp arm uses the BTF
argument count minus one, which the verifier caps at MAX_BPF_FUNC_ARGS.
The 3-bit shift therefore cannot overflow and it clears the upper bits of
the register. Widening the comparison instead would reject indices whose
low 32 bits are valid. The check itself is unchanged, so this cannot
change which programs are accepted, only the address that is computed.
Fixes: f92c1e183604 ("bpf: Add get_func_[arg|ret|arg_cnt] helpers")
Signed-off-by: Woojin Ji <random6.xyz@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://patch.msgid.link/20261018-get-func-arg-v2-1-048848b3eddf@gmail.com
Diffstat (limited to 'kernel/bpf')
| -rw-r--r-- | kernel/bpf/fixups.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/kernel/bpf/fixups.c b/kernel/bpf/fixups.c index a8739fbd0349..713f14d73b06 100644 --- a/kernel/bpf/fixups.c +++ b/kernel/bpf/fixups.c @@ -2489,7 +2489,7 @@ patch_map_ops_generic: cnt = 2; } insn_buf[cnt++] = BPF_JMP32_REG(BPF_JGE, BPF_REG_2, BPF_REG_0, 6); - insn_buf[cnt++] = BPF_ALU64_IMM(BPF_LSH, BPF_REG_2, 3); + insn_buf[cnt++] = BPF_ALU32_IMM(BPF_LSH, BPF_REG_2, 3); insn_buf[cnt++] = BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_1); insn_buf[cnt++] = BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, 0); insn_buf[cnt++] = BPF_STX_MEM(BPF_DW, BPF_REG_3, BPF_REG_0, 0); |