Daniel Borkmann 0e2dfdc74a bpf: Fix masking negation logic upon negative dst register ...

commit b9b34ddbe2 upstream.

The negation logic for the case where the off_reg is sitting in the
dst register is not correct given then we cannot just invert the add
to a sub or vice versa. As a fix, perform the final bitwise and-op
unconditionally into AX from the off_reg, then move the pointer from
the src to dst and finally use AX as the source for the original
pointer arithmetic operation such that the inversion yields a correct
result. The single non-AX mov in between is possible given constant
blinding is retaining it as it's not an immediate based operation.

Fixes: 979d63d50c ("bpf: prevent out of bounds speculation on pointer arithmetic")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Tested-by: Piotr Krysiuk <piotras@gmail.com>
Reviewed-by: Piotr Krysiuk <piotras@gmail.com>
Reviewed-by: John Fastabend <john.fastabend@gmail.com>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2021-05-07 10:49:25 +02:00

..

arraymap.c

bpf: decouple btf from seq bpf fs dump and enable more maps

2018-08-13 00:52:45 +02:00

bpf_lru_list.c

bpf_lru_list: Read double-checked variable once without lock

2021-03-04 09:39:35 +01:00

bpf_lru_list.h

bpf: Only set node->ref = 1 if it has not been set

2017-09-01 09:57:39 -07:00

btf.c

bpf: Explicitly memset some bpf info structures declared on the stack

2020-04-02 15:28:23 +02:00

cgroup.c

bpf: introduce update_effective_progs()

2018-08-07 14:29:55 +02:00

core.c

bpf: fix bpf_jit_limit knob for PAGE_SIZE >= 64K

2019-07-10 09:53:47 +02:00

cpumap.c

cpumap: Avoid warning when CONFIG_DEBUG_PER_CPU_MAPS is enabled

2020-05-02 17:25:53 +02:00

devmap.c

bpf: devmap: fix wrong interface selection in notifier_call

2019-12-01 09:17:01 +01:00

disasm.c

bpf: Remove struct bpf_verifier_env argument from print_bpf_insn

2018-03-23 17:38:57 +01:00

disasm.h

bpf: Remove struct bpf_verifier_env argument from print_bpf_insn

2018-03-23 17:38:57 +01:00

hashtab.c

bpf: Remove recursion prevention from rcu free callback

2020-10-01 13:14:34 +02:00

helpers.c

bpf: introduce the bpf_get_local_storage() helper function

2018-08-03 00:47:32 +02:00

inode.c

bpf: Fix a rcu warning for bpffs map pretty-print

2020-10-01 13:14:52 +02:00

local_storage.c

bpf: allocate local storage buffers using GFP_ATOMIC

2018-12-17 09:24:33 +01:00

lpm_trie.c

bpf: lpm_trie: check left child of last leftmost node for NULL

2019-07-03 13:14:48 +02:00

Makefile

bpf: silence warning messages in core

2019-07-26 09:14:06 +02:00

map_in_map.c

bpf: fix inner map masking to prevent oob under speculation

2019-01-31 08:14:41 +01:00

map_in_map.h

bpf: Add syscall lookup support for fd array and htab

2017-06-29 13:13:25 -04:00

offload.c

bpf, offload: Replace bitwise AND by logical AND in bpf_prog_offload_info_fill

2020-02-28 16:38:59 +01:00

percpu_freelist.c

bpf: fix lockdep false positive in percpu_freelist

2019-03-13 14:02:36 -07:00

percpu_freelist.h

bpf: fix lockdep false positive in percpu_freelist

2019-03-13 14:02:36 -07:00

reuseport_array.c

bpf: Introduce BPF_MAP_TYPE_REUSEPORT_SOCKARRAY

2018-08-11 01:58:46 +02:00

sockmap.c

bpf: sockmap, fix transition through disconnect without close

2018-09-22 02:46:41 +02:00

stackmap.c

bpf: Check for integer overflow when using roundup_pow_of_two()

2021-02-23 15:00:57 +01:00

syscall.c

bpf: Check correct cred for CAP_SYSLOG in bpf_dump_raw_ok()

2020-07-16 08:17:27 +02:00

tnum.c

bpf: Fix incorrect verifier simulation of ARSH under ALU32

2020-01-23 08:21:32 +01:00

verifier.c

bpf: Fix masking negation logic upon negative dst register

2021-05-07 10:49:25 +02:00

xskmap.c

xsk: do not call synchronize_net() under RCU read lock

2018-10-11 10:19:01 +02:00