netdev - Re: [PATCH bpf] nfp: bpf: fix static check error through tightening shift amount adjustment

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Thu, 9 May 2019 16:02:56 -0700
From:   Alexei Starovoitov <alexei.starovoitov@...il.com>
To:     Jiong Wang <jiong.wang@...ronome.com>
Cc:     Daniel Borkmann <daniel@...earbox.net>,
        Oleksandr Natalenko <oleksandr@...alenko.name>,
        bpf <bpf@...r.kernel.org>,
        Network Development <netdev@...r.kernel.org>,
        oss-drivers@...ronome.com
Subject: Re: [PATCH bpf] nfp: bpf: fix static check error through tightening
 shift amount adjustment

On Tue, May 7, 2019 at 9:42 AM Jiong Wang <jiong.wang@...ronome.com> wrote:
>
> NFP shift instruction has something special. If shift direction is left
> then shift amount of 1 to 31 is specified as 32 minus the amount to shift.
>
> But no need to do this for indirect shift which has shift amount be 0. Even
> after we do this subtraction, shift amount 0 will be turned into 32 which
> will eventually be encoded the same as 0 because only low 5 bits are
> encoded, but shift amount be 32 will fail the FIELD_PREP check done later
> on shift mask (0x1f), due to 32 is out of mask range. Such error has been
> observed when compiling nfp/bpf/jit.c using gcc 8.3 + O3.
>
> This issue has started when indirect shift support added after which the
> incoming shift amount to __emit_shf could be 0, therefore it is at that
> time shift amount adjustment inside __emit_shf should have been tightened.
>
> Fixes: 991f5b3651f6 ("nfp: bpf: support logic indirect shifts (BPF_[L|R]SH | BPF_X)")
> Reported-by: Oleksandr Natalenko <oleksandr@...alenko.name>
> Reported-by: Pablo Cascón <pablo.cascon@...ronome.com
> Reviewed-by: Quentin Monnet <quentin.monnet@...ronome.com>
> Reviewed-by: Jakub Kicinski <jakub.kicinski@...ronome.com>
> Signed-off-by: Jiong Wang <jiong.wang@...ronome.com>

Applied. Thanks