Files
linux/kernel
Daniel Borkmann 2b3cc41d50 bpf: Fix mask direction swap upon off reg sign change
commit bb01a1bba5 upstream.

Masking direction as indicated via mask_to_left is considered to be
calculated once and then used to derive pointer limits. Thus, this
needs to be placed into bpf_sanitize_info instead so we can pass it
to sanitize_ptr_alu() call after the pointer move. Piotr noticed a
corner case where the off reg causes masking direction change which
then results in an incorrect final aux->alu_limit.

Fixes: 7fedb63a83 ("bpf: Tighten speculative pointer arithmetic mask")
Reported-by: Piotr Krysiuk <piotras@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Piotr Krysiuk <piotras@gmail.com>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-05-28 13:10:26 +02:00
..
2021-04-14 08:24:10 +02:00
2019-05-28 17:46:43 -04:00
2020-01-17 19:48:42 +01:00
2019-05-24 20:16:01 +02:00
2021-02-07 15:35:49 +01:00
2021-02-07 15:35:49 +01:00
2020-01-09 10:19:54 +01:00