Skip to content

Commit 0ed6ff5

Browse files
kkdwivediAlexei Starovoitov
authored and
Alexei Starovoitov
committed
bpf: Move check_ptr_off_reg before check_map_access
Some functions in next patch want to use this function, and those functions will be called by check_map_access, hence move it before check_map_access. Signed-off-by: Kumar Kartikeya Dwivedi <[email protected]> Signed-off-by: Alexei Starovoitov <[email protected]> Acked-by: Joanne Koong <[email protected]> Link: https://lore.kernel.org/bpf/[email protected]
1 parent 91af2fc commit 0ed6ff5

File tree

1 file changed

+38
-38
lines changed

1 file changed

+38
-38
lines changed

kernel/bpf/verifier.c

Lines changed: 38 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -3469,6 +3469,44 @@ static int check_mem_region_access(struct bpf_verifier_env *env, u32 regno,
34693469
return 0;
34703470
}
34713471

3472+
static int __check_ptr_off_reg(struct bpf_verifier_env *env,
3473+
const struct bpf_reg_state *reg, int regno,
3474+
bool fixed_off_ok)
3475+
{
3476+
/* Access to this pointer-typed register or passing it to a helper
3477+
* is only allowed in its original, unmodified form.
3478+
*/
3479+
3480+
if (reg->off < 0) {
3481+
verbose(env, "negative offset %s ptr R%d off=%d disallowed\n",
3482+
reg_type_str(env, reg->type), regno, reg->off);
3483+
return -EACCES;
3484+
}
3485+
3486+
if (!fixed_off_ok && reg->off) {
3487+
verbose(env, "dereference of modified %s ptr R%d off=%d disallowed\n",
3488+
reg_type_str(env, reg->type), regno, reg->off);
3489+
return -EACCES;
3490+
}
3491+
3492+
if (!tnum_is_const(reg->var_off) || reg->var_off.value) {
3493+
char tn_buf[48];
3494+
3495+
tnum_strn(tn_buf, sizeof(tn_buf), reg->var_off);
3496+
verbose(env, "variable %s access var_off=%s disallowed\n",
3497+
reg_type_str(env, reg->type), tn_buf);
3498+
return -EACCES;
3499+
}
3500+
3501+
return 0;
3502+
}
3503+
3504+
int check_ptr_off_reg(struct bpf_verifier_env *env,
3505+
const struct bpf_reg_state *reg, int regno)
3506+
{
3507+
return __check_ptr_off_reg(env, reg, regno, false);
3508+
}
3509+
34723510
/* check read/write into a map element with possible variable offset */
34733511
static int check_map_access(struct bpf_verifier_env *env, u32 regno,
34743512
int off, int size, bool zero_size_allowed)
@@ -3980,44 +4018,6 @@ static int get_callee_stack_depth(struct bpf_verifier_env *env,
39804018
}
39814019
#endif
39824020

3983-
static int __check_ptr_off_reg(struct bpf_verifier_env *env,
3984-
const struct bpf_reg_state *reg, int regno,
3985-
bool fixed_off_ok)
3986-
{
3987-
/* Access to this pointer-typed register or passing it to a helper
3988-
* is only allowed in its original, unmodified form.
3989-
*/
3990-
3991-
if (reg->off < 0) {
3992-
verbose(env, "negative offset %s ptr R%d off=%d disallowed\n",
3993-
reg_type_str(env, reg->type), regno, reg->off);
3994-
return -EACCES;
3995-
}
3996-
3997-
if (!fixed_off_ok && reg->off) {
3998-
verbose(env, "dereference of modified %s ptr R%d off=%d disallowed\n",
3999-
reg_type_str(env, reg->type), regno, reg->off);
4000-
return -EACCES;
4001-
}
4002-
4003-
if (!tnum_is_const(reg->var_off) || reg->var_off.value) {
4004-
char tn_buf[48];
4005-
4006-
tnum_strn(tn_buf, sizeof(tn_buf), reg->var_off);
4007-
verbose(env, "variable %s access var_off=%s disallowed\n",
4008-
reg_type_str(env, reg->type), tn_buf);
4009-
return -EACCES;
4010-
}
4011-
4012-
return 0;
4013-
}
4014-
4015-
int check_ptr_off_reg(struct bpf_verifier_env *env,
4016-
const struct bpf_reg_state *reg, int regno)
4017-
{
4018-
return __check_ptr_off_reg(env, reg, regno, false);
4019-
}
4020-
40214021
static int __check_buffer_access(struct bpf_verifier_env *env,
40224022
const char *buf_info,
40234023
const struct bpf_reg_state *reg,

0 commit comments

Comments
 (0)