bpf: fix pattern matches for direct packet access
authorDaniel Borkmann <daniel@iogearbox.net>
Sat, 21 Oct 2017 00:34:22 +0000 (02:34 +0200)
committerDavid S. Miller <davem@davemloft.net>
Sat, 21 Oct 2017 23:56:09 +0000 (00:56 +0100)
commit0fd4759c5515b7f2297d7fee5c45e5d9dd733001
tree33442aa1596c023e31f59befc35527b46eb74640
parentfb2a311a31d3457fe8c3ee16f5609877e2ead9f7
bpf: fix pattern matches for direct packet access

Alexander had a test program with direct packet access, where
the access test was in the form of data + X > data_end. In an
unrelated change to the program LLVM decided to swap the branches
and emitted code for the test in form of data + X <= data_end.
We hadn't seen these being generated previously, thus verifier
would reject the program. Therefore, fix up the verifier to
detect all test cases, so we don't run into such issues in the
future.

Fixes: b4e432f1000a ("bpf: enable BPF_J{LT, LE, SLT, SLE} opcodes in verifier")
Reported-by: Alexander Alemayhu <alexander@alemayhu.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
kernel/bpf/verifier.c