Daniel Borkmann 342332fb0b bpf: Don't promote bogus looking registers after null check. ...

[ Upstream commit e60b0d12a9 ]

If we ever get to a point again where we convert a bogus looking <ptr>_or_null
typed register containing a non-zero fixed or variable offset, then lets not
reset these bounds to zero since they are not and also don't promote the register
to a <ptr> type, but instead leave it as <ptr>_or_null. Converting to a unknown
register could be an avenue as well, but then if we run into this case it would
allow to leak a kernel pointer this way.

Fixes: f1174f77b5 ("bpf/verifier: rework value tracking")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2022-01-27 10:54:00 +01:00

..

preload

bpf: Fix umd memory leak in copy_process()

2021-03-30 14:32:03 +02:00

arraymap.c

bpf: Fix potential race in tail call compatibility check

2021-11-02 19:48:21 +01:00

bpf_inode_storage.c

bpf: Change inode_storage's lookup_elem return value from NULL to -EBADF

2021-03-30 14:31:56 +02:00

bpf_iter.c

bpf: Fix an unitialized value in bpf_iter

2021-03-04 11:37:33 +01:00

bpf_local_storage.c

…

bpf_lru_list.c

…

bpf_lru_list.h

…

bpf_lsm.c

…

bpf_struct_ops_types.h

…

bpf_struct_ops.c

bpf: Handle return value of BPF_PROG_TYPE_STRUCT_OPS prog

2021-10-06 15:55:50 +02:00

btf.c

bpf: Disallow BPF_LOG_KERNEL log level for bpf(BPF_BTF_LOAD)

2022-01-27 10:53:54 +01:00

cgroup.c

…

core.c

bpf: Prevent increasing bpf_jit_limit above max

2021-11-18 14:03:42 +01:00

cpumap.c

…

devmap.c

bpf: Fix integer overflow in argument calculation for bpf_map_area_alloc

2021-12-17 10:14:41 +01:00

disasm.c

bpf: Introduce BPF nospec instruction for mitigating Spectre v4

2021-08-04 12:46:44 +02:00

disasm.h

…

dispatcher.c

…

hashtab.c

bpf: Fix integer overflow involving bucket_size

2021-08-18 08:59:10 +02:00

helpers.c

bpf: Fix potentially incorrect results with bpf_get_local_storage()

2021-09-03 10:09:31 +02:00

inode.c

bpf: link: Refuse non-O_RDWR flags in BPF_OBJ_GET

2021-04-14 08:42:00 +02:00

local_storage.c

bpf: Fix NULL pointer dereference in bpf_get_local_storage() helper

2021-09-03 10:09:21 +02:00

lpm_trie.c

…

Makefile

…

map_in_map.c

…

map_in_map.h

…

map_iter.c

…

net_namespace.c

…

offload.c

…

percpu_freelist.c

…

percpu_freelist.h

…

prog_iter.c

…

queue_stack_maps.c

…

reuseport_array.c

…

ringbuf.c

bpf: Fix false positive kmemleak report in bpf_ringbuf_area_alloc()

2021-07-19 09:44:54 +02:00

stackmap.c

bpf: Fix integer overflow in prealloc_elems_and_freelist()

2021-10-13 10:04:26 +02:00

syscall.c

bpf: Add kconfig knob for disabling unpriv bpf by default

2022-01-05 12:40:34 +01:00

sysfs_btf.c

…

task_iter.c

…

tnum.c

…

trampoline.c

bpf: Fix fexit trampoline.

2021-04-07 15:00:03 +02:00

verifier.c

bpf: Don't promote bogus looking registers after null check.

2022-01-27 10:54:00 +01:00