| commit | 0c986c1fc3a1fd447645c96681d802689fac8868 | [log] [tgz] |
|---|---|---|
| author | Daniel Borkmann <[email protected]> | Wed Apr 03 18:39:16 2019 |
| committer | ChromeOS Commit Bot <[email protected]> | Mon Apr 29 22:38:29 2019 |
| tree | 6aded308acd4a1c781f4a8096690c12dfbd03c4d | |
| parent | 6fc10a85d8e0fbcfa30bf1df91d9d2578f6d27da [diff] |
UPSTREAM: bpf: fix sanitation rewrite in case of non-pointers
commit 3612af783cf52c74a031a2f11b82247b2599d3cd upstream.
Marek reported that he saw an issue with the below snippet in that
timing measurements where off when loaded as unpriv while results
were reasonable when loaded as privileged:
[...]
uint64_t a = bpf_ktime_get_ns();
uint64_t b = bpf_ktime_get_ns();
uint64_t delta = b - a;
if ((int64_t)delta > 0) {
[...]
Turns out there is a bug where a corner case is missing in the fix
d3bd7413e0ca ("bpf: fix sanitation of alu op with pointer / scalar
type from different paths"), namely fixup_bpf_calls() only checks
whether aux has a non-zero alu_state, but it also needs to test for
the case of BPF_ALU_NON_POINTER since in both occasions we need to
skip the masking rewrite (as there is nothing to mask).
Fixes: d3bd7413e0ca ("bpf: fix sanitation of alu op with pointer / scalar type from different paths")
Reported-by: Marek Majkowski <[email protected]>
Reported-by: Arthur Fabre <[email protected]>
Signed-off-by: Daniel Borkmann <[email protected]>
Link: https://lore.kernel.org/netdev/CAJPywTJqP34cK20iLM5YmUMz9KXQOdu1-+BZrGMAGgLuBWz7fg@mail.gmail.com/T/
Acked-by: Song Liu <[email protected]>
Signed-off-by: Alexei Starovoitov <[email protected]>
Signed-off-by: Balbir Singh <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
(cherry picked from commit a042c21a2341979614a2b48d1ec46de5301d3f78)
Signed-off-by: Xuewei Zhang <[email protected]>
BUG=b:131266440
TEST=None
Change-Id: I671803685ac90978e61719d14191c69f2dfe961c
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/1585214
Reviewed-by: Guenter Roeck <[email protected]>
Commit-Queue: Xuewei Zhang <[email protected]>
Tested-by: Xuewei Zhang <[email protected]>