1 files changed, 75 insertions, 25 deletions

diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index ba03ec39efb3..6ef6746a7871 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -218,47 +218,84 @@ int bpf_prog_calc_tag(struct bpf_prog *fp)
         return 0;
 }
 
-static void bpf_adj_branches(struct bpf_prog *prog, u32 pos, u32 delta)
+static int bpf_adj_delta_to_imm(struct bpf_insn *insn, u32 pos, u32 delta,
+                                u32 curr, const bool probe_pass)
 {
+        const s64 imm_min = S32_MIN, imm_max = S32_MAX;
+        s64 imm = insn->imm;
+
+        if (curr < pos && curr + imm + 1 > pos)
+                imm += delta;
+        else if (curr > pos + delta && curr + imm + 1 <= pos + delta)
+                imm -= delta;
+        if (imm < imm_min || imm > imm_max)
+                return -ERANGE;
+        if (!probe_pass)
+                insn->imm = imm;
+        return 0;
+}
+
+static int bpf_adj_delta_to_off(struct bpf_insn *insn, u32 pos, u32 delta,
+                                u32 curr, const bool probe_pass)
+{
+        const s32 off_min = S16_MIN, off_max = S16_MAX;
+        s32 off = insn->off;
+
+        if (curr < pos && curr + off + 1 > pos)
+                off += delta;
+        else if (curr > pos + delta && curr + off + 1 <= pos + delta)
+                off -= delta;
+        if (off < off_min || off > off_max)
+                return -ERANGE;
+        if (!probe_pass)
+                insn->off = off;
+        return 0;
+}
+
+static int bpf_adj_branches(struct bpf_prog *prog, u32 pos, u32 delta,
+                            const bool probe_pass)
+{
+        u32 i, insn_cnt = prog->len + (probe_pass ? delta : 0);
         struct bpf_insn *insn = prog->insnsi;
-        u32 i, insn_cnt = prog->len;
-        bool pseudo_call;
-        u8 code;
-        int off;
+        int ret = 0;
 
         for (i = 0; i < insn_cnt; i++, insn++) {
+                u8 code;
+
+                /* In the probing pass we still operate on the original,
+                 * unpatched image in order to check overflows before we
+                 * do any other adjustments. Therefore skip the patchlet.
+                 */
+                if (probe_pass && i == pos) {
+                        i += delta + 1;
+                        insn++;
+                }
                 code = insn->code;
-                if (BPF_CLASS(code) != BPF_JMP)
-                        continue;
-                if (BPF_OP(code) == BPF_EXIT)
+                if (BPF_CLASS(code) != BPF_JMP ||
+                    BPF_OP(code) == BPF_EXIT)
                         continue;
+                /* Adjust offset of jmps if we cross patch boundaries. */
                 if (BPF_OP(code) == BPF_CALL) {
-                        if (insn->src_reg == BPF_PSEUDO_CALL)
-                                pseudo_call = true;
-                        else
+                        if (insn->src_reg != BPF_PSEUDO_CALL)
                                 continue;
+                        ret = bpf_adj_delta_to_imm(insn, pos, delta, i,
+                                                   probe_pass);
                 } else {
-                        pseudo_call = false;
+                        ret = bpf_adj_delta_to_off(insn, pos, delta, i,
+                                                   probe_pass);
                 }
-                off = pseudo_call ? insn->imm : insn->off;
-
-                /* Adjust offset of jmps if we cross boundaries. */
-                if (i < pos && i + off + 1 > pos)
-                        off += delta;
-                else if (i > pos + delta && i + off + 1 <= pos + delta)
-                        off -= delta;
-
-                if (pseudo_call)
-                        insn->imm = off;
-                else
-                        insn->off = off;
+                if (ret)
+                        break;
         }
+
+        return ret;
 }
 
 struct bpf_prog *bpf_patch_insn_single(struct bpf_prog *prog, u32 off,
                                        const struct bpf_insn *patch, u32 len)
 {
         u32 insn_adj_cnt, insn_rest, insn_delta = len - 1;
+        const u32 cnt_max = S16_MAX;
         struct bpf_prog *prog_adj;
 
         /* Since our patchlet doesn't expand the image, we're done. */
@@ -269,6 +306,15 @@ struct bpf_prog *bpf_patch_insn_single(struct bpf_prog *prog, u32 off,
 
         insn_adj_cnt = prog->len + insn_delta;
 
+        /* Reject anything that would potentially let the insn->off
+         * target overflow when we have excessive program expansions.
+         * We need to probe here before we do any reallocation where
+         * we afterwards may not fail anymore.
+         */
+        if (insn_adj_cnt > cnt_max &&
+            bpf_adj_branches(prog, off, insn_delta, true))
+                return NULL;
+
         /* Several new instructions need to be inserted. Make room
          * for them. Likely, there's no need for a new allocation as
          * last page could have large enough tailroom.
@@ -294,7 +340,11 @@ struct bpf_prog *bpf_patch_insn_single(struct bpf_prog *prog, u32 off,
                 sizeof(*patch) * insn_rest);
         memcpy(prog_adj->insnsi + off, patch, sizeof(*patch) * len);
 
-        bpf_adj_branches(prog_adj, off, insn_delta);
+        /* We are guaranteed to not fail at this point, otherwise
+         * the ship has sailed to reverse to the original state. An
+         * overflow cannot happen at this point.
+         */
+        BUG_ON(bpf_adj_branches(prog_adj, off, insn_delta, false));
 
         return prog_adj;
 }