@@ -3469,6 +3469,44 @@ static int check_mem_region_access(struct bpf_verifier_env *env, u32 regno,
34693469 return 0 ;
34703470}
34713471
3472+ static int __check_ptr_off_reg (struct bpf_verifier_env * env ,
3473+ const struct bpf_reg_state * reg , int regno ,
3474+ bool fixed_off_ok )
3475+ {
3476+ /* Access to this pointer-typed register or passing it to a helper
3477+ * is only allowed in its original, unmodified form.
3478+ */
3479+
3480+ if (reg -> off < 0 ) {
3481+ verbose (env , "negative offset %s ptr R%d off=%d disallowed\n" ,
3482+ reg_type_str (env , reg -> type ), regno , reg -> off );
3483+ return - EACCES ;
3484+ }
3485+
3486+ if (!fixed_off_ok && reg -> off ) {
3487+ verbose (env , "dereference of modified %s ptr R%d off=%d disallowed\n" ,
3488+ reg_type_str (env , reg -> type ), regno , reg -> off );
3489+ return - EACCES ;
3490+ }
3491+
3492+ if (!tnum_is_const (reg -> var_off ) || reg -> var_off .value ) {
3493+ char tn_buf [48 ];
3494+
3495+ tnum_strn (tn_buf , sizeof (tn_buf ), reg -> var_off );
3496+ verbose (env , "variable %s access var_off=%s disallowed\n" ,
3497+ reg_type_str (env , reg -> type ), tn_buf );
3498+ return - EACCES ;
3499+ }
3500+
3501+ return 0 ;
3502+ }
3503+
3504+ int check_ptr_off_reg (struct bpf_verifier_env * env ,
3505+ const struct bpf_reg_state * reg , int regno )
3506+ {
3507+ return __check_ptr_off_reg (env , reg , regno , false);
3508+ }
3509+
34723510/* check read/write into a map element with possible variable offset */
34733511static int check_map_access (struct bpf_verifier_env * env , u32 regno ,
34743512 int off , int size , bool zero_size_allowed )
@@ -3980,44 +4018,6 @@ static int get_callee_stack_depth(struct bpf_verifier_env *env,
39804018}
39814019#endif
39824020
3983- static int __check_ptr_off_reg (struct bpf_verifier_env * env ,
3984- const struct bpf_reg_state * reg , int regno ,
3985- bool fixed_off_ok )
3986- {
3987- /* Access to this pointer-typed register or passing it to a helper
3988- * is only allowed in its original, unmodified form.
3989- */
3990-
3991- if (reg -> off < 0 ) {
3992- verbose (env , "negative offset %s ptr R%d off=%d disallowed\n" ,
3993- reg_type_str (env , reg -> type ), regno , reg -> off );
3994- return - EACCES ;
3995- }
3996-
3997- if (!fixed_off_ok && reg -> off ) {
3998- verbose (env , "dereference of modified %s ptr R%d off=%d disallowed\n" ,
3999- reg_type_str (env , reg -> type ), regno , reg -> off );
4000- return - EACCES ;
4001- }
4002-
4003- if (!tnum_is_const (reg -> var_off ) || reg -> var_off .value ) {
4004- char tn_buf [48 ];
4005-
4006- tnum_strn (tn_buf , sizeof (tn_buf ), reg -> var_off );
4007- verbose (env , "variable %s access var_off=%s disallowed\n" ,
4008- reg_type_str (env , reg -> type ), tn_buf );
4009- return - EACCES ;
4010- }
4011-
4012- return 0 ;
4013- }
4014-
4015- int check_ptr_off_reg (struct bpf_verifier_env * env ,
4016- const struct bpf_reg_state * reg , int regno )
4017- {
4018- return __check_ptr_off_reg (env , reg , regno , false);
4019- }
4020-
40214021static int __check_buffer_access (struct bpf_verifier_env * env ,
40224022 const char * buf_info ,
40234023 const struct bpf_reg_state * reg ,
0 commit comments