Yazhou Tang 5017c302ca bpf: Reject negative offsets for ALU ops ... [ Upstream commit 55c0ced59fe17dee34e9dfd5f7be63cbab207758 ] When verifying BPF programs, the check_alu_op() function validates instructions with ALU operations. The 'offset' field in these instructions is a signed 16-bit integer. The existing check 'insn->off > 1' was intended to ensure the offset is either 0, or 1 for BPF_MOD/BPF_DIV. However, because 'insn->off' is signed, this check incorrectly accepts all negative values (e.g., -1). This commit tightens the validation by changing the condition to '(insn->off != 0 && insn->off != 1)'. This ensures that any value other than the explicitly permitted 0 and 1 is rejected, hardening the verifier against malformed BPF programs. Co-developed-by: Shenghao Yuan <shenghaoyuan0928@163.com> Signed-off-by: Shenghao Yuan <shenghaoyuan0928@163.com> Co-developed-by: Tianci Cao <ziye@zju.edu.cn> Signed-off-by: Tianci Cao <ziye@zju.edu.cn> Signed-off-by: Yazhou Tang <tangyazhou518@outlook.com> Acked-by: Yonghong Song <yonghong.song@linux.dev> Fixes: ec0e2da95f ("bpf: Support new signed div/mod instructions.") Link: https://lore.kernel.org/r/tencent_70D024BAE70A0A309A4781694C7B764B0608@qq.com Signed-off-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2025-10-15 12:00:20 +02:00
..
bpf	bpf: Reject negative offsets for ALU ops	2025-10-15 12:00:20 +02:00
cgroup	cgroup: split cgroup_destroy_wq into 3 workqueues	2025-09-25 11:13:42 +02:00
configs	tinyconfig: remove unnecessary 'is not set' for choice blocks	2024-09-01 20:34:38 +09:00
debug	move asm/unaligned.h to linux/unaligned.h	2024-10-02 17:23:23 -04:00
dma	dma-debug: fix physical address calculation for struct dma_debug_entry	2025-09-19 16:35:42 +02:00
entry
events	uprobes: uprobe_warn should use passed task	2025-10-15 11:59:54 +02:00
futex	futex: Prevent use-after-free during requeue-PI	2025-10-02 13:44:11 +02:00
gcov
irq	genirq/irq_sim: Initialize work context pointers properly	2025-07-10 16:05:07 +02:00
kcsan	kcsan: test: Initialize dummy variable	2025-08-15 12:13:46 +02:00
livepatch
locking	locking/lockdep: Decrease nr_unused_locks if lock unused in zap_class()	2025-04-20 10:15:45 +02:00
module	module: Prevent silent truncation of module name in delete_module(2)	2025-08-20 18:30:46 +02:00
power	PM: sleep: console: Fix the black screen issue	2025-08-20 18:30:25 +02:00
printk	printk: nbcon: Allow reacquire during panic	2025-08-20 18:30:47 +02:00
rcu	rcu: Fix racy re-initialization of irq_work causing hangs	2025-08-20 18:30:58 +02:00
sched	sched: Fix sched_numa_find_nth_cpu() if mask offline	2025-09-09 18:58:16 +02:00
time	hrtimers: Unconditionally update target CPU base after offline timer migration	2025-09-19 16:35:47 +02:00
trace	bpf: Remove migrate_disable in kprobe_multi_link_prog_run	2025-10-15 11:59:56 +02:00
.gitignore
acct.c	acct: block access to kernel internal filesystems	2025-02-27 04:30:23 -08:00
async.c
audit_fsnotify.c
audit_tree.c
audit_watch.c
audit.c	audit: Make use of str_enabled_disabled() helper	2024-09-03 16:35:16 -04:00
audit.h	audit,module: restore audit logging in load failure case	2025-08-15 12:13:31 +02:00
auditfilter.c	audit: use task_tgid_nr() instead of task_pid_nr()	2024-08-28 16:48:28 -04:00
auditsc.c	audit,module: restore audit logging in load failure case	2025-08-15 12:13:31 +02:00
backtracetest.c
bounds.c
capability.c
cfi.c
compat.c
configs.c
context_tracking.c
cpu_pm.c
cpu.c	watchdog/hardlockup/perf: Fix perf_event memory leak	2025-04-10 14:39:11 +02:00
crash_core.c	Document/kexec: generalize crash hotplug description	2024-09-01 20:43:37 -07:00
crash_reserve.c	crash: fix crash memory reserve exceed system memory bug	2024-09-01 20:43:30 -07:00
cred.c
delayacct.c
dma.c
elfcorehdr.c
exec_domain.c
exit.c	perf: Fix sample vs do_exit()	2025-06-27 11:11:45 +01:00
exit.h
extable.c
fail_function.c
fork.c	kernel/fork: only call untrack_pfn_clear() on VMAs duplicated for fork()	2025-05-29 11:03:14 +02:00
freezer.c	sched,freezer: Remove unnecessary warning in __thaw_task	2025-07-24 08:56:37 +02:00
gen_kheaders.sh	kheaders: Ignore silly-rename files	2025-01-23 17:22:55 +01:00
groups.c
hung_task.c
iomem.c
irq_work.c
jump_label.c	jump_label: Fix static_key_slow_dec() yet again	2024-09-10 11:57:27 +02:00
kallsyms_internal.h
kallsyms_selftest.c
kallsyms_selftest.h
kallsyms.c
kcmp.c
Kconfig.freezer
Kconfig.hz
Kconfig.kexec	crash, powerpc: default to CRASH_DUMP=n on PPC_BOOK3S_32	2024-11-14 22:43:48 -08:00
Kconfig.locks
Kconfig.preempt
kcov.c	kcov: mark in_softirq_really() as __always_inline	2025-01-09 13:33:49 +01:00
kexec_core.c
kexec_elf.c	kexec: initialize ELF lowest address to ULONG_MAX	2025-04-10 14:39:24 +02:00
kexec_file.c	kexec_file: fix elfcorehdr digest exclusion when CONFIG_CRASH_HOTPLUG=y	2024-09-01 17:59:01 -07:00
kexec_internal.h	kexec: use atomic_try_cmpxchg_acquire() in kexec_trylock()	2024-09-01 20:43:23 -07:00
kexec.c
kheaders.c
kprobes.c
ksyms_common.c
ksysfs.c
kthread.c	kthread: unpark only parked kthread	2024-10-09 12:47:19 -07:00
latencytop.c
Makefile	mm: move kernel/numa.c to mm/	2024-09-03 21:15:26 -07:00
module_signature.c
notifier.c
nsproxy.c
padata.c	padata: do not leak refcount in reorder_work	2025-05-29 11:03:19 +02:00
panic.c	objtool, panic: Disable SMAP in __stack_chk_fail()	2025-05-02 07:59:19 +02:00
params.c	module: ensure that kobject_put() is safe for module type kobjects	2025-05-18 08:24:54 +02:00
pid_namespace.c
pid_sysctl.h
pid.c
profile.c
ptrace.c
range.c
reboot.c	Flush console log from kernel_power_off()	2025-04-20 10:15:12 +02:00
regset.c
relay.c	[tree-wide] finally take no_llseek out	2024-09-27 08:18:43 -07:00
resource_kunit.c	resource, kunit: fix user-after-free in resource_test_region_intersects()	2024-10-09 12:47:19 -07:00
resource.c	resource: fix false warning in __request_region()	2025-08-01 09:48:44 +01:00
rseq.c	rseq: Fix segfault on registration when rseq_cs is non-zero	2025-07-17 18:37:24 +02:00
scftorture.c
scs.c
seccomp.c	seccomp: Fix a race with WAIT_KILLABLE_RECV if the tracer replies too fast	2025-10-15 11:59:54 +02:00
signal.c	pidfs: improve multi-threaded exec and premature thread-group leader exit polling	2025-05-29 11:02:09 +02:00
smp.c	smp: Fix up and expand the smp_call_function_many() kerneldoc	2025-10-15 12:00:02 +02:00
smpboot.c
smpboot.h
softirq.c	lockdep: Fix wait context check on softirq for PREEMPT_RT	2025-05-29 11:02:08 +02:00
stackleak.c
stacktrace.c
static_call_inline.c	x86/static-call: provide a way to do very early static-call updates	2024-12-19 18:13:23 +01:00
static_call.c
stop_machine.c	sched/core: Fix migrate_swap() vs. hotplug	2025-07-17 18:37:03 +02:00
sys_ni.c
sys.c	struct fd layout change (and conversion to accessor helpers)	2024-09-23 09:35:36 -07:00
sysctl-test.c
sysctl.c
task_work.c	sched/core: Disable page allocation in task_tick_mm_cid()	2024-10-11 10:49:32 +02:00
taskstats.c
torture.c
tracepoint.c	tracepoint: Support iterating tracepoints in a loading module	2024-09-25 23:23:44 +09:00
tsacct.c
ucount.c	ucount: fix atomic_long_inc_below() argument type	2025-08-15 12:13:59 +02:00
uid16.c
uid16.h
umh.c
up.c
user_namespace.c	user_namespace: use kmemdup_array() instead of kmemdup() for multiple allocation	2024-09-09 16:47:42 -07:00
user-return-notifier.c
user.c	uidgid: make sure we fit into one cacheline	2024-09-12 12:16:09 +02:00
usermode_driver.c
utsname_sysctl.c
utsname.c
vhost_task.c	vhost: Take a reference on the task in struct vhost_task.	2025-10-02 13:44:10 +02:00
vmcore_info.c	mm: support only one page_type per page	2024-09-03 21:15:43 -07:00
watch_queue.c	watch_queue: fix pipe accounting mismatch	2025-04-10 14:39:10 +02:00
watchdog_buddy.c
watchdog_perf.c	watchdog/hardlockup/perf: Fix perf_event memory leak	2025-04-10 14:39:11 +02:00
watchdog.c	watchdog: fix watchdog may detect false positive of softlockup	2025-06-27 11:11:22 +01:00
workqueue_internal.h
workqueue.c	workqueue: Initialize wq_isolated_cpumask in workqueue_init_early()	2025-06-27 11:11:42 +01:00