Commit 6ebc5030 authored by Jiayuan Chen's avatar Jiayuan Chen Committed by Alexei Starovoitov
Browse files

bpf: Fix array bounds error with may_goto



may_goto uses an additional 8 bytes on the stack, which causes the
interpreters[] array to go out of bounds when calculating index by
stack_size.

1. If a BPF program is rewritten, re-evaluate the stack size. For non-JIT
cases, reject loading directly.

2. For non-JIT cases, calculating interpreters[idx] may still cause
out-of-bounds array access, and just warn about it.

3. For jit_requested cases, the execution of bpf_func also needs to be
warned. So move the definition of function __bpf_prog_ret0_warn out of
the macro definition CONFIG_BPF_JIT_ALWAYS_ON.

Reported-by: default avatar <syzbot+d2a2c639d03ac200a4f1@syzkaller.appspotmail.com>
Closes: https://lore.kernel.org/bpf/0000000000000f823606139faa5d@google.com/


Fixes: 011832b9 ("bpf: Introduce may_goto instruction")
Signed-off-by: default avatarJiayuan Chen <mrpre@163.com>
Link: https://lore.kernel.org/r/20250214091823.46042-2-mrpre@163.com


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent a4585442
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment