Yazhou Tang 5017c302ca bpf: Reject negative offsets for ALU ops ... [ Upstream commit 55c0ced59fe17dee34e9dfd5f7be63cbab207758 ] When verifying BPF programs, the check_alu_op() function validates instructions with ALU operations. The 'offset' field in these instructions is a signed 16-bit integer. The existing check 'insn->off > 1' was intended to ensure the offset is either 0, or 1 for BPF_MOD/BPF_DIV. However, because 'insn->off' is signed, this check incorrectly accepts all negative values (e.g., -1). This commit tightens the validation by changing the condition to '(insn->off != 0 && insn->off != 1)'. This ensures that any value other than the explicitly permitted 0 and 1 is rejected, hardening the verifier against malformed BPF programs. Co-developed-by: Shenghao Yuan <shenghaoyuan0928@163.com> Signed-off-by: Shenghao Yuan <shenghaoyuan0928@163.com> Co-developed-by: Tianci Cao <ziye@zju.edu.cn> Signed-off-by: Tianci Cao <ziye@zju.edu.cn> Signed-off-by: Yazhou Tang <tangyazhou518@outlook.com> Acked-by: Yonghong Song <yonghong.song@linux.dev> Fixes: ec0e2da95f ("bpf: Support new signed div/mod instructions.") Link: https://lore.kernel.org/r/tencent_70D024BAE70A0A309A4781694C7B764B0608@qq.com Signed-off-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>		2025-10-15 12:00:20 +02:00
..
preload	bpf/preload: Don't select USERMODE_DRIVER	2025-08-15 12:13:48 +02:00
arena.c	bpf: Fix softlockup in arena_map_free on 64k page kernel	2025-02-27 04:30:19 -08:00
arraymap.c
bloom_filter.c
bpf_cgrp_storage.c	bpf: Only fails the busy counter check in bpf_cgrp_storage_get if it creates storage	2025-05-02 07:59:16 +02:00
bpf_inode_storage.c
bpf_iter.c
bpf_local_storage.c	bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT	2025-02-08 09:57:29 +01:00
bpf_lru_list.c	bpf: Adjust free target to avoid global starvation of LRU map	2025-07-17 18:37:22 +02:00
bpf_lru_list.h	bpf: Adjust free target to avoid global starvation of LRU map	2025-07-17 18:37:22 +02:00
bpf_lsm.c
bpf_struct_ops.c	bpf: Pass the same orig_call value to trampoline functions	2025-06-27 11:11:31 +01:00
bpf_task_storage.c
btf_iter.c
btf_relocate.c
btf.c	bpf: Use proper type to calculate bpf_raw_tp_null_args.mask index	2025-06-27 11:11:33 +01:00
cgroup_iter.c
cgroup.c	bpf: Allow pre-ordering for bpf cgroup progs	2025-05-29 11:02:17 +02:00
core.c	bpf: Enforce expected_attach_type for tailcall compatibility	2025-10-15 12:00:04 +02:00
cpumap.c
cpumask.c
crypto.c	bpf: Fix out-of-bounds dynptr write in bpf_crypto_crypt	2025-09-19 16:35:44 +02:00
devmap.c
disasm.c
disasm.h
dispatcher.c
hashtab.c	bpf: fix possible endless loop in BPF map iteration	2025-05-29 11:02:01 +02:00
helpers.c	bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init()	2025-09-19 16:35:44 +02:00
inode.c
Kconfig
link_iter.c
local_storage.c
log.c
lpm_trie.c
Makefile
map_in_map.c
map_in_map.h
map_iter.c
memalloc.c
mmap_unlock_work.h
mprog.c
net_namespace.c
offload.c
percpu_freelist.c
percpu_freelist.h
prog_iter.c
queue_stack_maps.c
relo_core.c
reuseport_array.c
ringbuf.c	bpf: unify VM_WRITE vs VM_MAYWRITE use in BPF map mmaping logic	2025-02-27 04:30:18 -08:00
stackmap.c
syscall.c	bpf: Move bpf map owner out of common struct	2025-09-09 18:58:01 +02:00
sysfs_btf.c
task_iter.c
tcx.c
tnum.c
token.c
trampoline.c
verifier.c	bpf: Reject negative offsets for ALU ops	2025-10-15 12:00:20 +02:00