Commit 60b0166f authored by yonghong-song's avatar yonghong-song Committed by GitHub

fix verifier errors in http_filter example (#2039)

Fix issue #2035.

For code like
    int i;
    int j = 0;
    const int last_index = payload_offset + 7;
    for (i = payload_offset ; i < last_index ; i++) {
               p[j] = load_byte(skb , i);

Here, the payload_offset is unknown. llvm 7.0 and trunk
compiler seems generating code like
   p[0] = load_byte(skb, payload_offset)
   if (payload_offset + 1 < last_index) {
      p[1] = ...
      ...
      p[6] = ...
   } else {
      /* do nothing */
   }
   /* accessing p[0], p[1], ..., p[6] */

The compiler did the above transformation because the potential
overflow for last_index and/or payload_offset + 1 in which case
compiler preserved both branches.

This caused a problem for verifier as in the else branch
p[1] is not assigned and the verifier will reject the program.

Changing the loop to simply iterate from 0 to 6 fixed the problem.
Signed-off-by: default avatarYonghong Song <yhs@fb.com>
parent 726c60f6
......@@ -99,11 +99,8 @@ int http_filter(struct __sk_buff *skb) {
//direct access to skb not allowed
unsigned long p[7];
int i = 0;
int j = 0;
const int last_index = payload_offset + 7;
for (i = payload_offset ; i < last_index ; i++) {
p[j] = load_byte(skb , i);
j++;
for (i = 0; i < 7; i++) {
p[i] = load_byte(skb , payload_offset + i);
}
//find a match with an HTTP message
......
......@@ -70,11 +70,8 @@ int http_filter(struct __sk_buff *skb) {
//direct access to skb not allowed
unsigned long p[7];
int i = 0;
int j = 0;
const int last_index = payload_offset + 7;
for (i = payload_offset ; i < last_index ; i++) {
p[j] = load_byte(skb , i);
j++;
for (i = 0; i < 7; i++) {
p[i] = load_byte(skb , payload_offset + i);
}
//find a match with an HTTP message
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment