diff options
| author | Quentin Monnet <quentin.monnet@netronome.com> | 2018-01-17 02:51:50 +0300 |
|---|---|---|
| committer | Daniel Borkmann <daniel@iogearbox.net> | 2018-01-17 03:15:06 +0300 |
| commit | 74801e50d5b89329e6c02b8bd924a41234f76316 (patch) | |
| tree | effbbab7241a7b203f123449f858517ba09bdb22 /drivers/net/ethernet/netronome/nfp/bpf/verifier.c | |
| parent | 7dfa4d87cfc48f3d4171f4a1b886bbbe4faf5c07 (diff) | |
| download | linux-74801e50d5b89329e6c02b8bd924a41234f76316.tar.xz | |
nfp: bpf: reject program on instructions unknown to the JIT compiler
If an eBPF instruction is unknown to the driver JIT compiler, we can
reject the program at verification time.
Signed-off-by: Quentin Monnet <quentin.monnet@netronome.com>
Reviewed-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Reviewed-by: Jiong Wang <jiong.wang@netronome.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Diffstat (limited to 'drivers/net/ethernet/netronome/nfp/bpf/verifier.c')
| -rw-r--r-- | drivers/net/ethernet/netronome/nfp/bpf/verifier.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/net/ethernet/netronome/nfp/bpf/verifier.c b/drivers/net/ethernet/netronome/nfp/bpf/verifier.c index 81dab462456c..479f602887e9 100644 --- a/drivers/net/ethernet/netronome/nfp/bpf/verifier.c +++ b/drivers/net/ethernet/netronome/nfp/bpf/verifier.c @@ -290,6 +290,12 @@ nfp_verify_insn(struct bpf_verifier_env *env, int insn_idx, int prev_insn_idx) meta = nfp_bpf_goto_meta(nfp_prog, meta, insn_idx, env->prog->len); nfp_prog->verifier_meta = meta; + if (!nfp_bpf_supported_opcode(meta->insn.code)) { + pr_vlog(env, "instruction %#02x not supported\n", + meta->insn.code); + return -EINVAL; + } + if (meta->insn.src_reg >= MAX_BPF_REG || meta->insn.dst_reg >= MAX_BPF_REG) { pr_vlog(env, "program uses extended registers - jit hardening?\n"); |