diff options
Diffstat (limited to 'kernel')
| -rw-r--r-- | kernel/bpf/verifier.c | 12 |
1 files changed, 4 insertions, 8 deletions
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index a08d66215245..d54e34874579 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c | |||
| @@ -683,15 +683,11 @@ static int check_packet_access(struct verifier_env *env, u32 regno, int off, | |||
| 683 | { | 683 | { |
| 684 | struct reg_state *regs = env->cur_state.regs; | 684 | struct reg_state *regs = env->cur_state.regs; |
| 685 | struct reg_state *reg = ®s[regno]; | 685 | struct reg_state *reg = ®s[regno]; |
| 686 | int linear_size = (int) reg->range - (int) reg->off; | ||
| 687 | 686 | ||
| 688 | if (linear_size < 0 || linear_size >= MAX_PACKET_OFF) { | 687 | off += reg->off; |
| 689 | verbose("verifier bug\n"); | 688 | if (off < 0 || off + size > reg->range) { |
| 690 | return -EFAULT; | 689 | verbose("invalid access to packet, off=%d size=%d, R%d(id=%d,off=%d,r=%d)\n", |
| 691 | } | 690 | off, size, regno, reg->id, reg->off, reg->range); |
| 692 | if (off < 0 || off + size > linear_size) { | ||
| 693 | verbose("invalid access to packet, off=%d size=%d, allowed=%d\n", | ||
| 694 | off, size, linear_size); | ||
| 695 | return -EACCES; | 691 | return -EACCES; |
| 696 | } | 692 | } |
| 697 | return 0; | 693 | return 0; |
