@@ -3469,6 +3469,44 @@ static int check_mem_region_access(struct bpf_verifier_env *env, u32 regno,
3469
3469
return 0 ;
3470
3470
}
3471
3471
3472
+ static int __check_ptr_off_reg (struct bpf_verifier_env * env ,
3473
+ const struct bpf_reg_state * reg , int regno ,
3474
+ bool fixed_off_ok )
3475
+ {
3476
+ /* Access to this pointer-typed register or passing it to a helper
3477
+ * is only allowed in its original, unmodified form.
3478
+ */
3479
+
3480
+ if (reg -> off < 0 ) {
3481
+ verbose (env , "negative offset %s ptr R%d off=%d disallowed\n" ,
3482
+ reg_type_str (env , reg -> type ), regno , reg -> off );
3483
+ return - EACCES ;
3484
+ }
3485
+
3486
+ if (!fixed_off_ok && reg -> off ) {
3487
+ verbose (env , "dereference of modified %s ptr R%d off=%d disallowed\n" ,
3488
+ reg_type_str (env , reg -> type ), regno , reg -> off );
3489
+ return - EACCES ;
3490
+ }
3491
+
3492
+ if (!tnum_is_const (reg -> var_off ) || reg -> var_off .value ) {
3493
+ char tn_buf [48 ];
3494
+
3495
+ tnum_strn (tn_buf , sizeof (tn_buf ), reg -> var_off );
3496
+ verbose (env , "variable %s access var_off=%s disallowed\n" ,
3497
+ reg_type_str (env , reg -> type ), tn_buf );
3498
+ return - EACCES ;
3499
+ }
3500
+
3501
+ return 0 ;
3502
+ }
3503
+
3504
+ int check_ptr_off_reg (struct bpf_verifier_env * env ,
3505
+ const struct bpf_reg_state * reg , int regno )
3506
+ {
3507
+ return __check_ptr_off_reg (env , reg , regno , false);
3508
+ }
3509
+
3472
3510
/* check read/write into a map element with possible variable offset */
3473
3511
static int check_map_access (struct bpf_verifier_env * env , u32 regno ,
3474
3512
int off , int size , bool zero_size_allowed )
@@ -3980,44 +4018,6 @@ static int get_callee_stack_depth(struct bpf_verifier_env *env,
3980
4018
}
3981
4019
#endif
3982
4020
3983
- static int __check_ptr_off_reg (struct bpf_verifier_env * env ,
3984
- const struct bpf_reg_state * reg , int regno ,
3985
- bool fixed_off_ok )
3986
- {
3987
- /* Access to this pointer-typed register or passing it to a helper
3988
- * is only allowed in its original, unmodified form.
3989
- */
3990
-
3991
- if (reg -> off < 0 ) {
3992
- verbose (env , "negative offset %s ptr R%d off=%d disallowed\n" ,
3993
- reg_type_str (env , reg -> type ), regno , reg -> off );
3994
- return - EACCES ;
3995
- }
3996
-
3997
- if (!fixed_off_ok && reg -> off ) {
3998
- verbose (env , "dereference of modified %s ptr R%d off=%d disallowed\n" ,
3999
- reg_type_str (env , reg -> type ), regno , reg -> off );
4000
- return - EACCES ;
4001
- }
4002
-
4003
- if (!tnum_is_const (reg -> var_off ) || reg -> var_off .value ) {
4004
- char tn_buf [48 ];
4005
-
4006
- tnum_strn (tn_buf , sizeof (tn_buf ), reg -> var_off );
4007
- verbose (env , "variable %s access var_off=%s disallowed\n" ,
4008
- reg_type_str (env , reg -> type ), tn_buf );
4009
- return - EACCES ;
4010
- }
4011
-
4012
- return 0 ;
4013
- }
4014
-
4015
- int check_ptr_off_reg (struct bpf_verifier_env * env ,
4016
- const struct bpf_reg_state * reg , int regno )
4017
- {
4018
- return __check_ptr_off_reg (env , reg , regno , false);
4019
- }
4020
-
4021
4021
static int __check_buffer_access (struct bpf_verifier_env * env ,
4022
4022
const char * buf_info ,
4023
4023
const struct bpf_reg_state * reg ,
0 commit comments