Commit e3ea26ad authored by Anton Protopopov's avatar Anton Protopopov Committed by Alexei Starovoitov
Browse files

bpf: check for insn arrays in check_ptr_alignment 



Do not abuse the strict_alignment_once flag, and check if the map is
an instruction array inside the check_ptr_alignment() function.

Suggested-by: default avatarAlexei Starovoitov <ast@kernel.org>
Signed-off-by: default avatarAnton Protopopov <a.s.protopopov@gmail.com>
Link: https://lore.kernel.org/r/20251128063224.1305482-3-a.s.protopopov@gmail.com


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent 7feff23c

kernel/bpf/verifier.c

+3 −3
Original line number Diff line number Diff line
@@ -6482,6 +6482,8 @@ static int check_ptr_alignment(struct bpf_verifier_env *env, 
		break;

	case PTR_TO_MAP_VALUE:

		pointer_desc = "value ";

		if (reg->map_ptr->map_type == BPF_MAP_TYPE_INSN_ARRAY)

			strict = true;

		break;

	case PTR_TO_CTX:

		pointer_desc = "context ";
@@ -7529,8 +7531,6 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn 
{

	struct bpf_reg_state *regs = cur_regs(env);

	struct bpf_reg_state *reg = regs + regno;

	bool insn_array = reg->type == PTR_TO_MAP_VALUE &&

			  reg->map_ptr->map_type == BPF_MAP_TYPE_INSN_ARRAY;

	int size, err = 0;









	size = bpf_size_to_bytes(bpf_size);








@@ -7538,7 +7538,7 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn







		return size;

















	/* alignment checks will add in reg->off themselves */









	err = check_ptr_alignment(env, reg, off, size, strict_alignment_once || insn_array);









	err = check_ptr_alignment(env, reg, off, size, strict_alignment_once);









	if (err)









		return err;