1 files changed, 8 insertions, 1 deletions

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 9ac205d1b8b7..eebbc03e5af2 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -3081,8 +3081,8 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env,
             smin_ptr = ptr_reg->smin_value, smax_ptr = ptr_reg->smax_value;
         u64 umin_val = off_reg->umin_value, umax_val = off_reg->umax_value,
             umin_ptr = ptr_reg->umin_value, umax_ptr = ptr_reg->umax_value;
+        u32 dst = insn->dst_reg, src = insn->src_reg;
         u8 opcode = BPF_OP(insn->code);
-        u32 dst = insn->dst_reg;
 
         dst_reg = &regs[dst];
 
@@ -3115,6 +3115,13 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env,
                 verbose(env, "R%d pointer arithmetic on %s prohibited\n",
                         dst, reg_type_str[ptr_reg->type]);
                 return -EACCES;
+        case PTR_TO_MAP_VALUE:
+                if (!env->allow_ptr_leaks && !known && (smin_val < 0) != (smax_val < 0)) {
+                        verbose(env, "R%d has unknown scalar with mixed signed bounds, pointer arithmetic with it prohibited for !root\n",
+                                off_reg == dst_reg ? dst : src);
+                        return -EACCES;
+                }
+                /* fall-through */
         default:
                 break;
         }