2 files changed, 20 insertions, 2 deletions

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 8b8d6ba39e23..20f3889c006e 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -1116,7 +1116,12 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
                 /* ctx accesses must be at a fixed offset, so that we can
                  * determine what type of data were returned.
                  */
-                if (!tnum_is_const(reg->var_off)) {
+                if (reg->off) {
+                        verbose("dereference of modified ctx ptr R%d off=%d+%d, ctx+const is allowed, ctx+const+const is not\n",
+                                regno, reg->off, off - reg->off);
+                        return -EACCES;
+                }
+                if (!tnum_is_const(reg->var_off) || reg->var_off.value) {
                         char tn_buf[48];
 
                         tnum_strn(tn_buf, sizeof(tn_buf), reg->var_off);
@@ -1124,7 +1129,6 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
                                 tn_buf, off, size);
                         return -EACCES;
                 }
-                off += reg->var_off.value;
                 err = check_ctx_access(env, insn_idx, off, size, t, &reg_type);
                 if (!err && t == BPF_READ && value_regno >= 0) {
                         /* ctx access returns either a scalar, or a
diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c
index 26f3250bdcd2..3c7d3a45a3c5 100644
--- a/tools/testing/selftests/bpf/test_verifier.c
+++ b/tools/testing/selftests/bpf/test_verifier.c
@@ -6645,6 +6645,20 @@ static struct bpf_test tests[] = {
                 .errstr = "BPF_END uses reserved fields",
                 .result = REJECT,
         },
+        {
+                "arithmetic ops make PTR_TO_CTX unusable",
+                .insns = {
+                        BPF_ALU64_IMM(BPF_ADD, BPF_REG_1,
+                                      offsetof(struct __sk_buff, data) -
+                                      offsetof(struct __sk_buff, mark)),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                                    offsetof(struct __sk_buff, mark)),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "dereference of modified ctx ptr R1 off=68+8, ctx+const is allowed, ctx+const+const is not",
+                .result = REJECT,
+                .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+        },
 };
 
 static int probe_filter_length(const struct bpf_insn *fp)