From: Greg KH <gregkh@linuxfoundation.org>
To: Daniel Borkmann <daniel@iogearbox.net>
Cc: ast@kernel.org, jannh@google.com, stable@vger.kernel.org
Subject: Re: [PATCH stable 4.14,4.18] bpf: 32-bit RSH verification must truncate input before the ALU op
Date: Mon, 8 Oct 2018 15:27:56 +0200 [thread overview]
Message-ID: <20181008132756.GE20703@kroah.com> (raw)
In-Reply-To: <85cc332c0d20db55f7619e681f459bdbb6aa4a7e.1538988801.git.daniel@iogearbox.net>
On Mon, Oct 08, 2018 at 10:59:33AM +0200, Daniel Borkmann wrote:
> From: Jann Horn <jannh@google.com>
>
> [ upstream commit b799207e1e1816b09e7a5920fbb2d5fcf6edd681 ]
>
> When I wrote commit 468f6eafa6c4 ("bpf: fix 32-bit ALU op verification"), I
> assumed that, in order to emulate 64-bit arithmetic with 32-bit logic, it
> is sufficient to just truncate the output to 32 bits; and so I just moved
> the register size coercion that used to be at the start of the function to
> the end of the function.
>
> That assumption is true for almost every op, but not for 32-bit right
> shifts, because those can propagate information towards the least
> significant bit. Fix it by always truncating inputs for 32-bit ops to 32
> bits.
>
> Also get rid of the coerce_reg_to_size() after the ALU op, since that has
> no effect.
Applied, thanks.
greg k-h
prev parent reply other threads:[~2018-10-08 21:13 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-10-08 8:59 [PATCH stable 4.14,4.18] bpf: 32-bit RSH verification must truncate input before the ALU op Daniel Borkmann
2018-10-08 13:27 ` Greg KH [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20181008132756.GE20703@kroah.com \
--to=gregkh@linuxfoundation.org \
--cc=ast@kernel.org \
--cc=daniel@iogearbox.net \
--cc=jannh@google.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.