Yazhou Tang 3bce44b344 bpf: Reject negative offsets for ALU ops ... [ Upstream commit 55c0ced59fe17dee34e9dfd5f7be63cbab207758 ] When verifying BPF programs, the check_alu_op() function validates instructions with ALU operations. The 'offset' field in these instructions is a signed 16-bit integer. The existing check 'insn->off > 1' was intended to ensure the offset is either 0, or 1 for BPF_MOD/BPF_DIV. However, because 'insn->off' is signed, this check incorrectly accepts all negative values (e.g., -1). This commit tightens the validation by changing the condition to '(insn->off != 0 && insn->off != 1)'. This ensures that any value other than the explicitly permitted 0 and 1 is rejected, hardening the verifier against malformed BPF programs. Co-developed-by: Shenghao Yuan <shenghaoyuan0928@163.com> Signed-off-by: Shenghao Yuan <shenghaoyuan0928@163.com> Co-developed-by: Tianci Cao <ziye@zju.edu.cn> Signed-off-by: Tianci Cao <ziye@zju.edu.cn> Signed-off-by: Yazhou Tang <tangyazhou518@outlook.com> Acked-by: Yonghong Song <yonghong.song@linux.dev> Fixes: ec0e2da95f ("bpf: Support new signed div/mod instructions.") Link: https://lore.kernel.org/r/tencent_70D024BAE70A0A309A4781694C7B764B0608@qq.com Signed-off-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2025-10-15 11:58:07 +02:00
..
preload	bpf/preload: Don't select USERMODE_DRIVER	2025-08-15 12:08:51 +02:00
arraymap.c	bpf: Check percpu map value size first	2024-10-17 15:24:15 +02:00
bloom_filter.c
bpf_cgrp_storage.c	bpf: Only fails the busy counter check in bpf_cgrp_storage_get if it creates storage	2025-05-02 07:50:53 +02:00
bpf_inode_storage.c
bpf_iter.c
bpf_local_storage.c	bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT	2025-02-08 09:52:06 +01:00
bpf_lru_list.c	bpf: Adjust free target to avoid global starvation of LRU map	2025-07-17 18:35:21 +02:00
bpf_lru_list.h	bpf: Adjust free target to avoid global starvation of LRU map	2025-07-17 18:35:21 +02:00
bpf_lsm.c
bpf_struct_ops_types.h
bpf_struct_ops.c
bpf_task_storage.c
btf.c	bpf: Check size for BTF-based ctx access of pointer members	2024-12-19 18:11:25 +01:00
cgroup_iter.c
cgroup.c	bpf: Allow pre-ordering for bpf cgroup progs	2025-06-04 14:41:58 +02:00
core.c	bpf: Enforce expected_attach_type for tailcall compatibility	2025-10-15 11:57:54 +02:00
cpumap.c
cpumask.c
devmap.c	bpf: fix OOB devmap writes when deleting elements	2024-12-14 19:59:56 +01:00
disasm.c
disasm.h
dispatcher.c
hashtab.c	bpf: fix possible endless loop in BPF map iteration	2025-06-04 14:41:53 +02:00
helpers.c	bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init()	2025-09-19 16:32:02 +02:00
inode.c
Kconfig
link_iter.c
local_storage.c
log.c
lpm_trie.c	bpf: Fix exact match conditions in trie_get_next_key()	2024-12-14 19:59:51 +01:00
Makefile
map_in_map.c
map_in_map.h
map_iter.c
memalloc.c
mmap_unlock_work.h
mprog.c
net_namespace.c
offload.c
percpu_freelist.c
percpu_freelist.h
prog_iter.c
queue_stack_maps.c
reuseport_array.c
ringbuf.c	bpf: Use raw_spinlock_t in ringbuf	2025-03-22 12:50:37 -07:00
stackmap.c
syscall.c	bpf: Move bpf map owner out of common struct	2025-09-09 18:56:18 +02:00
sysfs_btf.c
task_iter.c	bpf: Fix iter/task tid filtering	2024-11-01 01:58:25 +01:00
tcx.c
tnum.c
trampoline.c
verifier.c	bpf: Reject negative offsets for ALU ops	2025-10-15 11:58:07 +02:00