Daniel Borkmann d3bd7413e0 bpf: fix sanitation of alu op with pointer / scalar type from different paths ... While 979d63d50c ("bpf: prevent out of bounds speculation on pointer arithmetic") took care of rejecting alu op on pointer when e.g. pointer came from two different map values with different map properties such as value size, Jann reported that a case was not covered yet when a given alu op is used in both "ptr_reg += reg" and "numeric_reg += reg" from different branches where we would incorrectly try to sanitize based on the pointer's limit. Catch this corner case and reject the program instead. Fixes: 979d63d50c ("bpf: prevent out of bounds speculation on pointer arithmetic") Reported-by: Jann Horn <jannh@google.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: Alexei Starovoitov <ast@kernel.org>		2019-01-05 21:32:38 -08:00
..
bpf	bpf: fix sanitation of alu op with pointer / scalar type from different paths	2019-01-05 21:32:38 -08:00
cgroup	Merge branch 'for-4.21' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup	2018-12-29 10:57:20 -08:00
configs	kvm_config: add CONFIG_VIRTIO_MENU	2018-10-24 20:55:56 -04:00
debug	kdb: use bool for binary state indicators	2018-12-30 08:31:52 +00:00
dma	DMA mapping updates for Linux 4.21	2018-12-28 14:12:21 -08:00
events	Remove 'type' argument from access_ok() function	2019-01-03 18:57:57 -08:00
gcov	gcov: remove CONFIG_GCOV_FORMAT_AUTODETECT	2018-06-08 18:56:02 +09:00
irq	genirq/affinity: Add is_managed to struct irq_affinity_desc	2018-12-19 11:32:08 +01:00
livepatch	livepatch: Replace synchronize_sched() with synchronize_rcu()	2018-12-01 12:38:50 -08:00
locking	Merge branch 'locking-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2018-12-26 14:25:52 -08:00
power	mm: convert totalram_pages and totalhigh_pages variables to atomic	2018-12-28 12:11:47 -08:00
printk	Remove 'type' argument from access_ok() function	2019-01-03 18:57:57 -08:00
rcu	rcutorture: Don't do busted forward-progress testing	2018-12-01 12:45:42 -08:00
sched	Remove 'type' argument from access_ok() function	2019-01-03 18:57:57 -08:00
time	y2038: more syscalls and cleanups	2018-12-28 12:45:04 -08:00
trace	Remove 'type' argument from access_ok() function	2019-01-03 18:57:57 -08:00
.gitignore
acct.c
async.c
audit_fsnotify.c	audit: minimize our use of audit_log_format()	2018-11-26 18:40:00 -05:00
audit_tree.c	audit: minimize our use of audit_log_format()	2018-11-26 18:40:00 -05:00
audit_watch.c	audit: minimize our use of audit_log_format()	2018-11-26 18:40:00 -05:00
audit.c	audit: remove duplicated include from audit.c	2018-12-14 12:09:30 -05:00
audit.h	audit: use current whenever possible	2018-11-26 18:41:21 -05:00
auditfilter.c	audit: rename FILTER_TYPE to FILTER_EXCLUDE	2018-06-19 10:39:54 -04:00
auditsc.c	audit: use current whenever possible	2018-11-26 18:41:21 -05:00
backtracetest.c
bounds.c	kbuild: fix kernel/bounds.c 'W=1' warning	2018-10-31 08:54:14 -07:00
capability.c
compat.c	Remove 'type' argument from access_ok() function	2019-01-03 18:57:57 -08:00
configs.c
context_tracking.c
cpu_pm.c
cpu.c	x86/speculation: Rework SMT state change	2018-11-28 11:57:07 +01:00
crash_core.c	kernel/crash_core.c: print timestamp using time64_t	2018-08-22 10:52:47 -07:00
crash_dump.c
cred.c	cred: export get_task_cred().	2018-12-19 13:52:44 -05:00
delayacct.c	delayacct: track delays from thrashing cache pages	2018-10-26 16:26:32 -07:00
dma.c
elfcore.c
exec_domain.c
exit.c	Remove 'type' argument from access_ok() function	2019-01-03 18:57:57 -08:00
extable.c
fail_function.c	kernel/fail_function.c: remove meaningless null pointer check before debugfs_remove_recursive	2018-10-31 08:54:12 -07:00
fork.c	kernel/fork.c: mark 'stack_vm_area' with __maybe_unused	2018-12-28 12:11:52 -08:00
freezer.c	PM / reboot: Eliminate race between reboot and suspend	2018-08-06 12:35:20 +02:00
futex.c	Remove 'type' argument from access_ok() function	2019-01-03 18:57:57 -08:00
groups.c
hung_task.c	kernel: hung_task.c: disable on suspend	2018-10-25 18:45:08 +02:00
iomem.c
irq_work.c
jump_label.c	Merge branch 'x86/build' into locking/core, to pick up dependent patches and unify jump-label work	2018-10-16 17:30:11 +02:00
kallsyms.c	kallsyms: reduce size a little on 64-bit	2018-09-10 22:54:33 +09:00
kcmp.c
Kconfig.freezer
Kconfig.hz
Kconfig.locks
Kconfig.preempt	kconfig: warn no new line at end of file	2018-12-15 17:44:35 +09:00
kcov.c	kernel/kcov.c: mark funcs in __sanitizer_cov_trace_pc() as notrace	2018-11-30 14:56:14 -08:00
kexec_core.c	mm: convert totalram_pages and totalhigh_pages variables to atomic	2018-12-28 12:11:47 -08:00
kexec_file.c	kexec_file: kexec_walk_memblock() only walks a dedicated region at kdump	2018-12-06 14:38:50 +00:00
kexec_internal.h
kexec.c	kexec: add call to LSM hook in original kexec_load syscall	2018-07-16 12:31:57 -07:00
kmod.c
kprobes.c	Merge branch 'perf-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2018-12-26 14:45:18 -08:00
ksysfs.c
kthread.c	Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2018-08-13 11:25:07 -07:00
latencytop.c
Makefile	y2038: more syscalls and cleanups	2018-12-28 12:45:04 -08:00
memremap.c	mm/hmm: fix memremap.h, move dev_page_fault_t callback to hmm	2018-12-28 12:11:52 -08:00
module_signing.c	modsign: use all trusted keys to verify module signature	2018-11-07 14:41:41 +01:00
module-internal.h	modsign: log module name in the event of an error	2018-07-02 11:36:17 +02:00
module.c	Driver core patches for 4.21-rc1	2018-12-28 20:44:29 -08:00
notifier.c
nsproxy.c
padata.c	padata: clean an indentation issue, remove extraneous space	2018-11-16 14:11:04 +08:00
panic.c	Printk changes for 4.21	2018-12-27 11:24:43 -08:00
params.c
pid_namespace.c	signal: Use group_send_sig_info to kill all processes in a pid namespace	2018-09-16 16:08:25 +02:00
pid.c	Fix failure path in alloc_pid()	2018-12-28 12:42:30 -08:00
profile.c	mm: remove include/linux/bootmem.h	2018-10-31 08:54:16 -07:00
ptrace.c	Remove 'type' argument from access_ok() function	2019-01-03 18:57:57 -08:00
range.c
reboot.c	kernel/reboot.c: export pm_power_off_prepare	2018-09-11 16:13:24 +01:00
relay.c	kernel/relay.c: change return type to vm_fault_t	2018-06-15 07:55:24 +09:00
resource.c	kernel, resource: check for IORESOURCE_SYSRAM in release_mem_region_adjustable	2018-12-28 12:11:49 -08:00
rseq.c	Remove 'type' argument from access_ok() function	2019-01-03 18:57:57 -08:00
seccomp.c	seccomp: fix poor type promotion	2018-12-13 16:49:01 -08:00
signal.c	Remove 'type' argument from access_ok() function	2019-01-03 18:57:57 -08:00
smp.c	smp,cpumask: introduce on_each_cpu_cond_mask	2018-10-09 16:51:11 +02:00
smpboot.c	smpboot: Remove cpumask from the API	2018-07-03 09:20:44 +02:00
smpboot.h
softirq.c	Merge branch 'irq-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2018-10-25 11:43:47 -07:00
stackleak.c	stackleak: Mark stackleak_track_stack() as notrace	2018-12-05 19:31:44 -08:00
stacktrace.c
stop_machine.c	Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2018-08-13 11:25:07 -07:00
sys_ni.c	y2038: socket: Add compat_sys_recvmmsg_time64	2018-12-18 16:13:04 +01:00
sys.c	Remove 'type' argument from access_ok() function	2019-01-03 18:57:57 -08:00
sysctl_binary.c
sysctl.c	mm: reclaim small amounts of memory when an external fragmentation event occurs	2018-12-28 12:11:48 -08:00
task_work.c
taskstats.c
test_kprobes.c	kprobes: Remove jprobe API implementation	2018-06-21 12:33:05 +02:00
torture.c	torture: Remove unnecessary "ret" variables	2018-12-01 12:45:35 -08:00
tracepoint.c	tracing: Replace synchronize_sched() and call_rcu_sched()	2018-11-27 09:21:41 -08:00
tsacct.c
ucount.c
uid16.c
uid16.h
umh.c	umh: Add command line to user mode helpers	2018-10-22 19:37:36 -07:00
up.c	smp,cpumask: introduce on_each_cpu_cond_mask	2018-10-09 16:51:11 +02:00
user_namespace.c	userns: also map extents in the reverse map to kernel IDs	2018-11-07 23:51:16 -06:00
user-return-notifier.c
user.c	userns: use irqsave variant of refcount_dec_and_lock()	2018-08-22 10:52:47 -07:00
utsname_sysctl.c	sys: don't hold uts_sem while accessing userspace memory	2018-08-11 02:05:53 -05:00
utsname.c
watchdog_hld.c	watchdog: Mark watchdog touch functions as notrace	2018-08-30 12:56:40 +02:00
watchdog.c	watchdog: Mark watchdog touch functions as notrace	2018-08-30 12:56:40 +02:00
workqueue_internal.h
workqueue.c	workqueue: Replace call_rcu_sched() with call_rcu()	2018-11-27 09:21:44 -08:00