From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755584AbdKBLGd (ORCPT ); Thu, 2 Nov 2017 07:06:33 -0400 Received: from mout.kundenserver.de ([212.227.126.134]:62654 "EHLO mout.kundenserver.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933207AbdKBLGb (ORCPT ); Thu, 2 Nov 2017 07:06:31 -0400 From: Arnd Bergmann To: Alexei Starovoitov , Daniel Borkmann Cc: Arnd Bergmann , "David S. Miller" , Edward Cree , John Fastabend , Jakub Kicinski , netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH 2/2] [net-next] bpf: fix out-of-bounds access warning in bpf_check Date: Thu, 2 Nov 2017 12:05:52 +0100 Message-Id: <20171102110558.2746221-2-arnd@arndb.de> X-Mailer: git-send-email 2.9.0 In-Reply-To: <20171102110558.2746221-1-arnd@arndb.de> References: <20171102110558.2746221-1-arnd@arndb.de> X-Provags-ID: V03:K0:Cy6kUwfelhs2OndXjG11KT9FUP/hGSYJOJ0G++sVhKJ5orVLvb1 0e8YwGaRvS+CBHJdoN86QGzV3pEU90SkCViLOkKuIeocZVDtjFhWk3anT5UNhFVDzZGHLxQ gVdEQOHScGGH2PBZDnaWCLRBYX3vu/qAN4OET2xcq9MXxLXOMMtQcpd08/PJUREHK69MDna tQUnv1iBrxA3/mEMFHyAA== X-UI-Out-Filterresults: notjunk:1;V01:K0:PGC/pb3SDxo=:tBt/45dkh8QWBPb0pW9TZv nSlxPq66En/hlMFjhtSzYrEKSMJ7eKb1xbqzICRscbuM8kR7x0ITfIb+AuR6capan1t+UTOiA wsQaaL6+qRwGI1AsL8PwzCZY/xmJ2KRB5UGl7Ip3wF58HXvFTcC3vGufbcyYCcAfo/nrXETxS w0XTcJw6lPk8ciodFNn5VN6osV4qa6Jc/RkJ7Hudr1iEGyIArCy5bs8sje2y4fdzuAuMKcXd4 9ixgdr4y70she+kpnXPlkHIBAL8l4RVmTci1YuSnw2cbvnSv5XqE7GhYBm7Y1VZexh+sRsFkO 9/RVJDP/sgsHp7A+0HgFGreqjXRd9A6TJh1OgeLwheuFDsbDRno1l+xZe5EW4yJ7LHk0v87Si 0u/VsF9nnWXI4MjciCURQcD+Yx/5wUq7fhuNxfGt5Xs4TXe06xyv8Na6gShigQ54Nrl0CgrIz GsScGTmKg0x6LXOv8qtEJyqr4TkMpa5KFsZjzFMM3VJfOyAacWbGCFUXvD1c4G9z6xSUcCcLH w7uHfw2p9VzmCFrbpuf+wSejSbayg1AwkQ+K1rUmfyu2ZFW9F4OO6zO4+mATyJmos7boYuF5t f6up6+2co2ED1aLlOEEnmuqBno608lbXocTXBxkfkVJ9wue3nIv5QS57NGBrnE65X6D2bxD/8 03ocogHgoCurjqPEpUlv4ntUMIWTjVzwW7b1JI3Sf2euZhbvMRdqx4MZ9AyfFp/eQWTE0K87O 2EiHX2TyzXFnzQ7APEaDSgVKYKEAm61DEutPIw== Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org The bpf_verifer_ops array is generated dynamically and may be empty depending on configuration, which then causes an out of bounds access: kernel/bpf/verifier.c: In function 'bpf_check': kernel/bpf/verifier.c:4320:29: error: array subscript is above array bounds [-Werror=array-bounds] This adds a check to the start of the function as a workaround. I would assume that the function is never called in that configuration, so the warning is probably harmless. Fixes: 00176a34d9e2 ("bpf: remove the verifier ops from program structure") Signed-off-by: Arnd Bergmann --- Since there hasn't been a linux-next release in two weeks, I'm not entirely sure this is still needed, but from looking of the net-next contents it seems it is. I did not check any other trees that might have a fix already. --- kernel/bpf/verifier.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 750aff880ecb..debb60ad08ee 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -4447,6 +4447,10 @@ int bpf_check(struct bpf_prog **prog, union bpf_attr *attr) struct bpf_verifer_log *log; int ret = -EINVAL; + /* no program is valid */ + if (ARRAY_SIZE(bpf_verifier_ops) == 0) + return -EINVAL; + /* 'struct bpf_verifier_env' can be global, but since it's not small, * allocate/free it every time bpf_check() is called */ -- 2.9.0