* [PATCH stable 4.18] bpf/verifier: disallow pointer subtraction
@ 2018-09-25 13:25 Daniel Borkmann
2018-09-26 11:57 ` Greg KH
0 siblings, 1 reply; 2+ messages in thread
From: Daniel Borkmann @ 2018-09-25 13:25 UTC (permalink / raw)
To: gregkh; +Cc: ast, jannh, stable, Daniel Borkmann
From: Alexei Starovoitov <ast@kernel.org>
commit dd066823db2ac4e22f721ec85190817b58059a54 upstream.
Subtraction of pointers was accidentally allowed for unpriv programs
by commit 82abbf8d2fc4. Revert that part of commit.
Fixes: 82abbf8d2fc4 ("bpf: do not allow root to mangle valid pointers")
Reported-by: Jann Horn <jannh@google.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
---
kernel/bpf/verifier.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 63aaac5..adbe21c 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -3132,7 +3132,7 @@ static int adjust_reg_min_max_vals(struct bpf_verifier_env *env,
* an arbitrary scalar. Disallow all math except
* pointer subtraction
*/
- if (opcode == BPF_SUB){
+ if (opcode == BPF_SUB && env->allow_ptr_leaks) {
mark_reg_unknown(env, regs, insn->dst_reg);
return 0;
}
--
2.9.5
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH stable 4.18] bpf/verifier: disallow pointer subtraction
2018-09-25 13:25 [PATCH stable 4.18] bpf/verifier: disallow pointer subtraction Daniel Borkmann
@ 2018-09-26 11:57 ` Greg KH
0 siblings, 0 replies; 2+ messages in thread
From: Greg KH @ 2018-09-26 11:57 UTC (permalink / raw)
To: Daniel Borkmann; +Cc: ast, jannh, stable
On Tue, Sep 25, 2018 at 03:25:18PM +0200, Daniel Borkmann wrote:
> From: Alexei Starovoitov <ast@kernel.org>
>
> commit dd066823db2ac4e22f721ec85190817b58059a54 upstream.
>
> Subtraction of pointers was accidentally allowed for unpriv programs
> by commit 82abbf8d2fc4. Revert that part of commit.
>
> Fixes: 82abbf8d2fc4 ("bpf: do not allow root to mangle valid pointers")
> Reported-by: Jann Horn <jannh@google.com>
> Acked-by: Daniel Borkmann <daniel@iogearbox.net>
> Signed-off-by: Alexei Starovoitov <ast@kernel.org>
> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
> ---
> kernel/bpf/verifier.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
Now queued up, thanks.
greg k-h
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2018-09-26 18:10 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2018-09-25 13:25 [PATCH stable 4.18] bpf/verifier: disallow pointer subtraction Daniel Borkmann
2018-09-26 11:57 ` Greg KH
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).