linux-mips
[Top] [All Lists]

RE: [PATCH 14/17] MIPS: bpf: Prevent kernel fall over for >=32bit shifts

To: 'Markos Chandras' <markos.chandras@imgtec.com>, "linux-mips@linux-mips.org" <linux-mips@linux-mips.org>
Subject: RE: [PATCH 14/17] MIPS: bpf: Prevent kernel fall over for >=32bit shifts
From: David Laight <David.Laight@ACULAB.COM>
Date: Mon, 23 Jun 2014 09:44:31 +0000
Accept-language: en-GB, en-US
Cc: "David S. Miller" <davem@davemloft.net>, Daniel Borkmann <dborkman@redhat.com>, Alexei Starovoitov <ast@plumgrid.com>, "netdev@vger.kernel.org" <netdev@vger.kernel.org>
In-reply-to: <1403516340-22997-15-git-send-email-markos.chandras@imgtec.com>
List-archive: <http://www.linux-mips.org/archives/linux-mips/>
List-help: <mailto:ecartis@linux-mips.org?Subject=help>
List-id: linux-mips <linux-mips.eddie.linux-mips.org>
List-owner: <mailto:ralf@linux-mips.org>
List-post: <mailto:linux-mips@linux-mips.org>
List-software: Ecartis version 1.0.0
List-subscribe: <mailto:ecartis@linux-mips.org?subject=subscribe%20linux-mips>
List-unsubscribe: <mailto:ecartis@linux-mips.org?subject=unsubscribe%20linux-mips>
Original-recipient: rfc822;linux-mips@linux-mips.org
References: <1403516340-22997-1-git-send-email-markos.chandras@imgtec.com> <1403516340-22997-15-git-send-email-markos.chandras@imgtec.com>
Sender: linux-mips-bounce@linux-mips.org
Thread-index: AQHPjscu5VlynnjrkEO/YocR+d49Wpt+cUag
Thread-topic: [PATCH 14/17] MIPS: bpf: Prevent kernel fall over for >=32bit shifts
From: Markos Chandras
> Remove BUG_ON() if the shift immediate is >=32 to avoid
> kernel crashes due to malicious user input. Since the micro-assembler
> will not allow an immediate greater or equal to 32, we will use the
> maximum value which is 31. This will do the correct thing on either 32-
> or 64-bit cores since no 64-bit instructions are being used in JIT.

I'm not sure that bounding the shift to 31 bits 'is the correct thing'.
I'd have thought that emulating the large shift or masking the shift
to 5 bits are equally 'correct'.

...
>  {
>       /* sa is 5-bits long */
> -     BUG_ON(sa >= BIT(5));
> +     if (sa >= BIT(5))
> +             sa = BIT(5) - 1;
>       emit_instr(ctx, sll, dst, src, sa);
...

        David




<Prev in Thread] Current Thread [Next in Thread>