1 files changed, 40 insertions, 15 deletions

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 48c2705db22c..90493a66dddd 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -1637,21 +1637,42 @@ static int check_alu_op(struct verifier_env *env, struct bpf_insn *insn)
         return 0;
 }
 
-static void find_good_pkt_pointers(struct verifier_env *env,
-                                   struct reg_state *dst_reg)
+static void find_good_pkt_pointers(struct verifier_state *state,
+                                   const struct reg_state *dst_reg)
 {
-        struct verifier_state *state = &env->cur_state;
         struct reg_state *regs = state->regs, *reg;
         int i;
-        /* r2 = r3;
-         * r2 += 8
-         * if (r2 > pkt_end) goto somewhere
-         * r2 == dst_reg, pkt_end == src_reg,
-         * r2=pkt(id=n,off=8,r=0)
-         * r3=pkt(id=n,off=0,r=0)
-         * find register r3 and mark its range as r3=pkt(id=n,off=0,r=8)
-         * so that range of bytes [r3, r3 + 8) is safe to access
+
+        /* LLVM can generate two kind of checks:
+         *
+         * Type 1:
+         *
+         *   r2 = r3;
+         *   r2 += 8;
+         *   if (r2 > pkt_end) goto <handle exception>
+         *   <access okay>
+         *
+         *   Where:
+         *     r2 == dst_reg, pkt_end == src_reg
+         *     r2=pkt(id=n,off=8,r=0)
+         *     r3=pkt(id=n,off=0,r=0)
+         *
+         * Type 2:
+         *
+         *   r2 = r3;
+         *   r2 += 8;
+         *   if (pkt_end >= r2) goto <access okay>
+         *   <handle exception>
+         *
+         *   Where:
+         *     pkt_end == dst_reg, r2 == src_reg
+         *     r2=pkt(id=n,off=8,r=0)
+         *     r3=pkt(id=n,off=0,r=0)
+         *
+         * Find register r3 and mark its range as r3=pkt(id=n,off=0,r=8)
+         * so that range of bytes [r3, r3 + 8) is safe to access.
          */
+
         for (i = 0; i < MAX_BPF_REG; i++)
                 if (regs[i].type == PTR_TO_PACKET && regs[i].id == dst_reg->id)
                         regs[i].range = dst_reg->off;
@@ -1668,8 +1689,8 @@ static void find_good_pkt_pointers(struct verifier_env *env,
 static int check_cond_jmp_op(struct verifier_env *env,
                              struct bpf_insn *insn, int *insn_idx)
 {
-        struct reg_state *regs = env->cur_state.regs, *dst_reg;
-        struct verifier_state *other_branch;
+        struct verifier_state *other_branch, *this_branch = &env->cur_state;
+        struct reg_state *regs = this_branch->regs, *dst_reg;
         u8 opcode = BPF_OP(insn->code);
         int err;
 
@@ -1750,13 +1771,17 @@ static int check_cond_jmp_op(struct verifier_env *env,
         } else if (BPF_SRC(insn->code) == BPF_X && opcode == BPF_JGT &&
                    dst_reg->type == PTR_TO_PACKET &&
                    regs[insn->src_reg].type == PTR_TO_PACKET_END) {
-                find_good_pkt_pointers(env, dst_reg);
+                find_good_pkt_pointers(this_branch, dst_reg);
+        } else if (BPF_SRC(insn->code) == BPF_X && opcode == BPF_JGE &&
+                   dst_reg->type == PTR_TO_PACKET_END &&
+                   regs[insn->src_reg].type == PTR_TO_PACKET) {
+                find_good_pkt_pointers(other_branch, &regs[insn->src_reg]);
         } else if (is_pointer_value(env, insn->dst_reg)) {
                 verbose("R%d pointer comparison prohibited\n", insn->dst_reg);
                 return -EACCES;
         }
         if (log_level)
-                print_verifier_state(&env->cur_state);
+                print_verifier_state(this_branch);
         return 0;
 }