bpf: fix sanitation of alu op with pointer / scalar type from different paths
authorDaniel Borkmann <daniel@iogearbox.net>
Wed, 3 Apr 2019 18:39:13 +0000 (18:39 +0000)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 20 Apr 2019 07:15:09 +0000 (09:15 +0200)
commit6588a490bfe1b879f11b5e74724ef53a33b68641
treec0d8984a781c2e4a1e259853251b538ed9447b7e
parentae03b6b1c880a03d4771257336dc3bca156dd51b
bpf: fix sanitation of alu op with pointer / scalar type from different paths

commit d3bd7413e0ca40b60cf60d4003246d067cafdeda upstream.

While 979d63d50c0c ("bpf: prevent out of bounds speculation on pointer
arithmetic") took care of rejecting alu op on pointer when e.g. pointer
came from two different map values with different map properties such as
value size, Jann reported that a case was not covered yet when a given
alu op is used in both "ptr_reg += reg" and "numeric_reg += reg" from
different branches where we would incorrectly try to sanitize based
on the pointer's limit. Catch this corner case and reject the program
instead.

Fixes: 979d63d50c0c ("bpf: prevent out of bounds speculation on pointer arithmetic")
Reported-by: Jann Horn <jannh@google.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Vallish Vaidyeshwara <vallish@amazon.com>
Signed-off-by: Balbir Singh <sblbir@amzn.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
include/linux/bpf_verifier.h
kernel/bpf/verifier.c