• Jann Horn's avatar
    bpf: 32-bit RSH verification must truncate input before the ALU op · 10fdfea7
    Jann Horn authored
    commit b799207e1e1816b09e7a5920fbb2d5fcf6edd681 upstream.
    
    When I wrote commit 468f6eafa6c4 ("bpf: fix 32-bit ALU op verification"), I
    assumed that, in order to emulate 64-bit arithmetic with 32-bit logic, it
    is sufficient to just truncate the output to 32 bits; and so I just moved
    the register size coercion that used to be at the start of the function to
    the end of the function.
    
    That assumption is true for almost every op, but not for 32-bit right
    shifts, because those can propagate information towards the least
    significant bit. Fix it by always truncating inputs for 32-bit ops to 32
    bits.
    
    Also get rid of the coerce_reg_to_size() after the ALU op, since that has
    no effect.
    
    Fixes: 468f6eafa6c4 ("bpf: fix 32-bit ALU op verification")
    Acked-by: 's avatarDaniel Borkmann <daniel@iogearbox.net>
    Signed-off-by: 's avatarJann Horn <jannh@google.com>
    Signed-off-by: 's avatarDaniel Borkmann <daniel@iogearbox.net>
    Signed-off-by: 's avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    10fdfea7
Name
Last commit
Last update
..
Makefile Loading commit data...
arraymap.c Loading commit data...
bpf_lru_list.c Loading commit data...
bpf_lru_list.h Loading commit data...
cgroup.c Loading commit data...
core.c Loading commit data...
devmap.c Loading commit data...
hashtab.c Loading commit data...
helpers.c Loading commit data...
inode.c Loading commit data...
lpm_trie.c Loading commit data...
map_in_map.c Loading commit data...
map_in_map.h Loading commit data...
percpu_freelist.c Loading commit data...
percpu_freelist.h Loading commit data...
sockmap.c Loading commit data...
stackmap.c Loading commit data...
syscall.c Loading commit data...
tnum.c Loading commit data...
verifier.c Loading commit data...