Ben Hutchings 37435f7e80 bpf/verifier: Fix states_equal() comparison of pointer and UNKNOWN ...

An UNKNOWN_VALUE is not supposed to be derived from a pointer, unless
pointer leaks are allowed.  Therefore, states_equal() must not treat
a state with a pointer in a register as "equal" to a state with an
UNKNOWN_VALUE in that register.

This was fixed differently upstream, but the code around here was
largely rewritten in 4.14 by commit f1174f77b5 "bpf/verifier: rework
value tracking".  The bug can be detected by the bpf/verifier sub-test
"pointer/scalar confusion in state equality check (way 1)".

Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Edward Cree <ecree@solarflare.com>
Cc: Jann Horn <jannh@google.com>
Cc: Alexei Starovoitov <ast@kernel.org>
Cc: Daniel Borkmann <daniel@iogearbox.net>

2017-12-29 17:43:00 +01:00

..

arraymap.c

bpf: don't trigger OOM killer under pressure with map alloc

2017-07-05 14:40:21 +02:00

core.c

bpf: clean up put_cpu_var usage

2016-09-27 22:09:17 -04:00

hashtab.c

bpf: don't trigger OOM killer under pressure with map alloc

2017-07-05 14:40:21 +02:00

helpers.c

bpf: direct packet write and access for helpers for clsact progs

2016-09-20 23:32:11 -04:00

inode.c

fs: Replace CURRENT_TIME with current_time() for inode timestamps

2016-09-27 21:06:21 -04:00

Makefile

bpf: introduce percpu_freelist

2016-03-08 15:28:31 -05:00

percpu_freelist.c

bpf: fix lockdep splat

2017-12-14 09:28:23 +01:00

percpu_freelist.h

bpf: introduce percpu_freelist

2016-03-08 15:28:31 -05:00

stackmap.c

bpf: don't trigger OOM killer under pressure with map alloc

2017-07-05 14:40:21 +02:00

syscall.c

bpf: don't trigger OOM killer under pressure with map alloc

2017-07-05 14:40:21 +02:00

verifier.c

bpf/verifier: Fix states_equal() comparison of pointer and UNKNOWN

2017-12-29 17:43:00 +01:00