Files
linux/kernel
Daniel Borkmann bb01a1bba5 bpf: Fix mask direction swap upon off reg sign change
Masking direction as indicated via mask_to_left is considered to be
calculated once and then used to derive pointer limits. Thus, this
needs to be placed into bpf_sanitize_info instead so we can pass it
to sanitize_ptr_alu() call after the pointer move. Piotr noticed a
corner case where the off reg causes masking direction change which
then results in an incorrect final aux->alu_limit.

Fixes: 7fedb63a83 ("bpf: Tighten speculative pointer arithmetic mask")
Reported-by: Piotr Krysiuk <piotras@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Piotr Krysiuk <piotras@gmail.com>
Acked-by: Alexei Starovoitov <ast@kernel.org>
2021-05-25 22:08:53 +02:00
..
2021-04-22 14:36:03 +02:00
2021-04-08 19:37:21 +02:00
2021-03-24 12:11:48 -04:00
2021-04-08 16:04:20 -07:00
2021-05-06 19:24:11 -07:00
2021-05-06 19:24:13 -07:00
2021-05-07 00:26:33 -07:00
2020-11-14 11:26:04 -08:00
2020-12-01 10:30:28 +00:00
2021-01-22 15:09:42 +01:00
2021-05-07 00:26:34 -07:00
2021-02-09 12:27:29 -05:00
2021-05-07 00:26:34 -07:00
2021-05-07 00:26:34 -07:00