Message ID | 20170628174124.1545332-1-kafai@fb.com |
---|---|
State | Accepted, archived |
Delegated to: | David Miller |
Headers | show |
From: Martin KaFai Lau <kafai@fb.com> Date: Wed, 28 Jun 2017 10:41:24 -0700 > The index is off-by-one when fp->aux->stack_depth > has already been rounded up to 32. In particular, > if stack_depth is 512, the index will be 16. > > The fix is to round_up and then takes -1 instead of round_down. ... > Fixes: b870aa901f4b ("bpf: use different interpreter depending on required stack size") > Signed-off-by: Martin KaFai Lau <kafai@fb.com> > Acked-by: Alexei Starovoitov <ast@fb.com> > Acked-by: Daniel Borkmann <daniel@iogearbox.net> Applied, thanks Martin.
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c index 774069ca18a7..ad5f55922a13 100644 --- a/kernel/bpf/core.c +++ b/kernel/bpf/core.c @@ -1297,7 +1297,9 @@ static int bpf_check_tail_call(const struct bpf_prog *fp) */ struct bpf_prog *bpf_prog_select_runtime(struct bpf_prog *fp, int *err) { - fp->bpf_func = interpreters[round_down(fp->aux->stack_depth, 32) / 32]; + u32 stack_depth = max_t(u32, fp->aux->stack_depth, 1); + + fp->bpf_func = interpreters[(round_up(stack_depth, 32) / 32) - 1]; /* eBPF JITs can rewrite the program in case constant * blinding is active. However, in case of error during