The interpreter shifted by the raw immediate or register value, which
is undefined behavior in C when the count is >= the operand width and
trips UBSan. RFC 9669 masks shift counts (0x3f for 64-bit, 0x1f for
32-bit); mask the count in the LSH/RSH/ARSH cases.
Fixes: 94972f35a02e ("bpf: add BPF loading and execution framework")
Cc: [email protected]
Signed-off-by: Stephen Hemminger <[email protected]>
---
lib/bpf/bpf_exec.c | 31 +++++++++++++++++++++----------
1 file changed, 21 insertions(+), 10 deletions(-)
diff --git a/lib/bpf/bpf_exec.c b/lib/bpf/bpf_exec.c
index d423ef28f5..bb03c9cc2c 100644
--- a/lib/bpf/bpf_exec.c
+++ b/lib/bpf/bpf_exec.c
@@ -4,6 +4,7 @@
#include <stdio.h>
#include <stdint.h>
+#include <limits.h>
#include <eal_export.h>
#include <rte_common.h>
@@ -43,6 +44,16 @@
((reg)[(ins)->dst_reg] = \
(type)(reg)[(ins)->dst_reg] op (type)(ins)->imm)
+#define BPF_OP_SHIFT_IMM(reg, ins, op, type) \
+ ((reg)[(ins)->dst_reg] = \
+ (type)(reg)[(ins)->dst_reg] op \
+ ((ins)->imm & (sizeof(type) * CHAR_BIT - 1)))
+
+#define BPF_OP_SHIFT_REG(reg, ins, op, type) \
+ ((reg)[(ins)->dst_reg] = \
+ (type)(reg)[(ins)->dst_reg] op \
+ ((reg)[(ins)->src_reg] & (sizeof(type) * CHAR_BIT - 1)))
+
#define BPF_DIV_ZERO_CHECK(bpf, reg, ins, type) do { \
if ((type)(reg)[(ins)->src_reg] == 0) { \
RTE_BPF_LOG_LINE(ERR, \
@@ -183,10 +194,10 @@ bpf_exec(const struct rte_bpf *bpf, uint64_t
reg[EBPF_REG_NUM])
BPF_OP_ALU_IMM(reg, ins, |, uint32_t);
break;
case (BPF_ALU | BPF_LSH | BPF_K):
- BPF_OP_ALU_IMM(reg, ins, <<, uint32_t);
+ BPF_OP_SHIFT_IMM(reg, ins, <<, uint32_t);
break;
case (BPF_ALU | BPF_RSH | BPF_K):
- BPF_OP_ALU_IMM(reg, ins, >>, uint32_t);
+ BPF_OP_SHIFT_IMM(reg, ins, >>, uint32_t);
break;
case (BPF_ALU | BPF_XOR | BPF_K):
BPF_OP_ALU_IMM(reg, ins, ^, uint32_t);
@@ -217,10 +228,10 @@ bpf_exec(const struct rte_bpf *bpf, uint64_t
reg[EBPF_REG_NUM])
BPF_OP_ALU_REG(reg, ins, |, uint32_t);
break;
case (BPF_ALU | BPF_LSH | BPF_X):
- BPF_OP_ALU_REG(reg, ins, <<, uint32_t);
+ BPF_OP_SHIFT_REG(reg, ins, <<, uint32_t);
break;
case (BPF_ALU | BPF_RSH | BPF_X):
- BPF_OP_ALU_REG(reg, ins, >>, uint32_t);
+ BPF_OP_SHIFT_REG(reg, ins, >>, uint32_t);
break;
case (BPF_ALU | BPF_XOR | BPF_X):
BPF_OP_ALU_REG(reg, ins, ^, uint32_t);
@@ -262,13 +273,13 @@ bpf_exec(const struct rte_bpf *bpf, uint64_t
reg[EBPF_REG_NUM])
BPF_OP_ALU_IMM(reg, ins, |, uint64_t);
break;
case (EBPF_ALU64 | BPF_LSH | BPF_K):
- BPF_OP_ALU_IMM(reg, ins, <<, uint64_t);
+ BPF_OP_SHIFT_IMM(reg, ins, <<, uint64_t);
break;
case (EBPF_ALU64 | BPF_RSH | BPF_K):
- BPF_OP_ALU_IMM(reg, ins, >>, uint64_t);
+ BPF_OP_SHIFT_IMM(reg, ins, >>, uint64_t);
break;
case (EBPF_ALU64 | EBPF_ARSH | BPF_K):
- BPF_OP_ALU_IMM(reg, ins, >>, int64_t);
+ BPF_OP_SHIFT_IMM(reg, ins, >>, int64_t);
break;
case (EBPF_ALU64 | BPF_XOR | BPF_K):
BPF_OP_ALU_IMM(reg, ins, ^, uint64_t);
@@ -299,13 +310,13 @@ bpf_exec(const struct rte_bpf *bpf, uint64_t
reg[EBPF_REG_NUM])
BPF_OP_ALU_REG(reg, ins, |, uint64_t);
break;
case (EBPF_ALU64 | BPF_LSH | BPF_X):
- BPF_OP_ALU_REG(reg, ins, <<, uint64_t);
+ BPF_OP_SHIFT_REG(reg, ins, <<, uint64_t);
break;
case (EBPF_ALU64 | BPF_RSH | BPF_X):
- BPF_OP_ALU_REG(reg, ins, >>, uint64_t);
+ BPF_OP_SHIFT_REG(reg, ins, >>, uint64_t);
break;
case (EBPF_ALU64 | EBPF_ARSH | BPF_X):
- BPF_OP_ALU_REG(reg, ins, >>, int64_t);
+ BPF_OP_SHIFT_REG(reg, ins, >>, int64_t);
break;
case (EBPF_ALU64 | BPF_XOR | BPF_X):
BPF_OP_ALU_REG(reg, ins, ^, uint64_t);
--
2.53.0
