* [PATCH bpf] bpf/verifier: disallow pointer subtraction
@ 2018-09-12 21:06 Alexei Starovoitov
2018-09-12 21:48 ` Daniel Borkmann
0 siblings, 1 reply; 2+ messages in thread
From: Alexei Starovoitov @ 2018-09-12 21:06 UTC (permalink / raw)
To: David S . Miller; +Cc: daniel, netdev, kernel-team
Subtraction of pointers was accidentally allowed for unpriv programs
by commit 82abbf8d2fc4. Revert that part of commit.
Fixes: 82abbf8d2fc4 ("bpf: do not allow root to mangle valid pointers")
Reported-by: Jann Horn <jannh@google.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
---
kernel/bpf/verifier.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 92246117d2b0..bb07e74b34a2 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -3163,7 +3163,7 @@ static int adjust_reg_min_max_vals(struct bpf_verifier_env *env,
* an arbitrary scalar. Disallow all math except
* pointer subtraction
*/
- if (opcode == BPF_SUB){
+ if (opcode == BPF_SUB && env->allow_ptr_leaks) {
mark_reg_unknown(env, regs, insn->dst_reg);
return 0;
}
--
2.17.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH bpf] bpf/verifier: disallow pointer subtraction
2018-09-12 21:06 [PATCH bpf] bpf/verifier: disallow pointer subtraction Alexei Starovoitov
@ 2018-09-12 21:48 ` Daniel Borkmann
0 siblings, 0 replies; 2+ messages in thread
From: Daniel Borkmann @ 2018-09-12 21:48 UTC (permalink / raw)
To: Alexei Starovoitov, David S . Miller; +Cc: netdev, kernel-team
On 09/12/2018 11:06 PM, Alexei Starovoitov wrote:
> Subtraction of pointers was accidentally allowed for unpriv programs
> by commit 82abbf8d2fc4. Revert that part of commit.
>
> Fixes: 82abbf8d2fc4 ("bpf: do not allow root to mangle valid pointers")
> Reported-by: Jann Horn <jannh@google.com>
> Acked-by: Daniel Borkmann <daniel@iogearbox.net>
> Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Applied to bpf, thanks Alexei!
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2018-09-13 2:55 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2018-09-12 21:06 [PATCH bpf] bpf/verifier: disallow pointer subtraction Alexei Starovoitov
2018-09-12 21:48 ` Daniel Borkmann
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.