Commit e5f635ed authored by Daniel Borkmann's avatar Daniel Borkmann Committed by Alexei Starovoitov
Browse files

bpf: Fix precedence bug in convert_bpf_ld_abs alignment check 



Fix an operator precedence issue in convert_bpf_ld_abs() where the
expression offset + ip_align % size evaluates as offset + (ip_align % size)
due to % having higher precedence than +. That latter evaluation does
not make any sense. The intended check is (offset + ip_align) % size == 0
to verify that the packet load offset is properly aligned for direct
access.

With NET_IP_ALIGN == 2, the bug causes the inline fast-path for direct
packet loads to almost never be taken on !CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
platforms. This forces nearly all cBPF BPF_LD_ABS packet loads through
the bpf_skb_load_helper slow path on the affected archs.

Fixes: e0cea7ce ("bpf: implement ld_abs/ld_ind in native bpf")
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/r/20260416122719.661033-1-daniel@iogearbox.net


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent 1cedfe17

net/core/filter.c

+1 −1
Original line number Diff line number Diff line
@@ -503,7 +503,7 @@ static bool convert_bpf_ld_abs(struct sock_filter *fp, struct bpf_insn **insnp) 
	    ((unaligned_ok && offset >= 0) ||

	     (!unaligned_ok && offset >= 0 &&

	      offset + ip_align >= 0 &&

	      offset + ip_align % size == 0))) {

	      (offset + ip_align) % size == 0))) {

		bool ldx_off_ok = offset <= S16_MAX;



		*insn++ = BPF_MOV64_REG(BPF_REG_TMP, BPF_REG_H);