From patchwork Sat Jan 13 01:33:26 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Eric Dumazet X-Patchwork-Id: 860269 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="uY/67Fo1"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3zJMZj18cxz9s1h for ; Sat, 13 Jan 2018 12:33:33 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S965403AbeAMBdb (ORCPT ); Fri, 12 Jan 2018 20:33:31 -0500 Received: from mail-pf0-f193.google.com ([209.85.192.193]:34560 "EHLO mail-pf0-f193.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S965242AbeAMBda (ORCPT ); Fri, 12 Jan 2018 20:33:30 -0500 Received: by mail-pf0-f193.google.com with SMTP id e76so5668732pfk.1 for ; Fri, 12 Jan 2018 17:33:29 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=message-id:subject:from:to:cc:date:mime-version :content-transfer-encoding; bh=fXAUGZVxuV0oAAWyRUMWR3v51uwabmN74U8S5FgTHMs=; b=uY/67Fo13F60bE5ZNWIkIEGSseDpPB0qErmxnXwzGUBOLUFQFKwc44yVH/kidmGW/3 yoBBx5uMYeIGmIqwFAm5inT5UaSCLNsXxCFCPt1IObrXjvHltguP1c1799RRLS0DKbnk mehNwg4XCwNIgaRecnSGCkdLkTuUPmLQxb7JY+esNOIGc887bWer8iBoXNC6OAvwosWf QC9o7iGsbtIzADE+wH2tvLebMNfN5RspAMkdBMvss2MjHZ0V2vI2aMQMLFcv9746/SSI R8byRdBlpSAkz1se0HvvCHgpjwnR5LbfhiJip3zU9BIX+LyIKoV/QLEw8L45vIFo+Hr+ P/Vw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:message-id:subject:from:to:cc:date:mime-version :content-transfer-encoding; bh=fXAUGZVxuV0oAAWyRUMWR3v51uwabmN74U8S5FgTHMs=; b=VhYHSnFOXUesNbxgEWDQm2HBeDNGs66wbefNRzsefg4P9PTPxN6WJxt4d0pFkkOAol bAqzfl+fxJUXAJ7k5n2IMG7Tk0VHOCMYEBrPvf/yV+pZCIMy6+Ye0KEogqrUDKA9gapI u63m8W7wBEdLVyWZ9xd6Vh6/3jkxV7WmSHkAJNW0YkqqcE4iOmYfZWOXUC79Qanq1Xwa xqVWUoQX17YEsDwiwxodaA83PUsFViPcZ8pxnwRcUfzVGy0DHZXw7UFe8S+QQ5usOONK Is/XZled1VXQhg+42h9f3iPOpJ2ZSHFNczwpD8sKZeZjnEGEoXRtlX/R+TkSq1W+NTND I0dg== X-Gm-Message-State: AKGB3mI/rmcMpBCVgx3yB8NaPbOTROwKgYVT2htAWZkzP3ciEmYGubM/ Pp2LGVoNuUSFzzzB3GReKqoLVA== X-Google-Smtp-Source: ACJfBovI0zOaSYqirtLQvfXJc9MF2LMKonAhErTRK+TNoqbz3BfDLhplSsFYAJvW63M4T3JUkGRgdg== X-Received: by 10.98.68.74 with SMTP id r71mr25139560pfa.110.1515807209590; Fri, 12 Jan 2018 17:33:29 -0800 (PST) Received: from edumazet-glaptop3.lan (c-67-180-167-114.hsd1.ca.comcast.net. [67.180.167.114]) by smtp.googlemail.com with ESMTPSA id s14sm2747443pgc.36.2018.01.12.17.33.27 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Fri, 12 Jan 2018 17:33:28 -0800 (PST) Message-ID: <1515807206.3606.4.camel@gmail.com> Subject: [PATCH] bpf: fix divides by zero From: Eric Dumazet To: Alexei Starovoitov , Daniel Borkmann Cc: netdev , edumazet@google.com Date: Fri, 12 Jan 2018 17:33:26 -0800 X-Mailer: Evolution 3.22.6-1+deb9u1 Mime-Version: 1.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org From: Eric Dumazet Divides by zero are not nice, lets avoid them if possible. Also do_div() seems not needed when dealing with 32bit operands, but this seems a minor detail. Fixes: bd4cf0ed331a ("net: filter: rework/optimize internal BPF interpreter's instruction set") Signed-off-by: Eric Dumazet Reported-by: syzbot Acked-by: Alexei Starovoitov ---  kernel/bpf/core.c |    4 ++--  1 file changed, 2 insertions(+), 2 deletions(-)   DST = do_div(tmp, (u32) SRC); @@ -975,7 +975,7 @@ static unsigned int ___bpf_prog_run(u64 *regs, const struct bpf_insn *insn,   DST = div64_u64(DST, SRC);   CONT;   ALU_DIV_X: - if (unlikely(SRC == 0)) + if (unlikely((u32)SRC == 0))   return 0;   tmp = (u32) DST;   do_div(tmp, (u32) SRC); diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c index 51ec2dda7f08c6c90af084589bb6d80662c77d12..7949e8b8f94e9cc196e0449214493 ccce61b0903 100644 --- a/kernel/bpf/core.c +++ b/kernel/bpf/core.c @@ -956,7 +956,7 @@ static unsigned int ___bpf_prog_run(u64 *regs, const struct bpf_insn *insn,   DST = tmp;   CONT;   ALU_MOD_X: - if (unlikely(SRC == 0)) + if (unlikely((u32)SRC == 0))   return 0;   tmp = (u32) DST;