Daniel Borkmann a042c21a23 bpf: fix sanitation rewrite in case of non-pointers ... commit 3612af783c upstream. Marek reported that he saw an issue with the below snippet in that timing measurements where off when loaded as unpriv while results were reasonable when loaded as privileged: [...] uint64_t a = bpf_ktime_get_ns(); uint64_t b = bpf_ktime_get_ns(); uint64_t delta = b - a; if ((int64_t)delta > 0) { [...] Turns out there is a bug where a corner case is missing in the fix d3bd7413e0 ("bpf: fix sanitation of alu op with pointer / scalar type from different paths"), namely fixup_bpf_calls() only checks whether aux has a non-zero alu_state, but it also needs to test for the case of BPF_ALU_NON_POINTER since in both occasions we need to skip the masking rewrite (as there is nothing to mask). Fixes: d3bd7413e0 ("bpf: fix sanitation of alu op with pointer / scalar type from different paths") Reported-by: Marek Majkowski <marek@cloudflare.com> Reported-by: Arthur Fabre <afabre@cloudflare.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Link: https://lore.kernel.org/netdev/CAJPywTJqP34cK20iLM5YmUMz9KXQOdu1-+BZrGMAGgLuBWz7fg@mail.gmail.com/T/ Acked-by: Song Liu <songliubraving@fb.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: Balbir Singh <sblbir@amzn.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2019-04-20 09:15:09 +02:00
..
bpf	bpf: fix sanitation rewrite in case of non-pointers	2019-04-20 09:15:09 +02:00
cgroup	cgroup/pids: turn cgroup_subsys->free() into cgroup_subsys->release() to fix the accounting	2019-04-05 22:31:37 +02:00
configs	ANDROID: binder: add hwbinder,vndbinder to BINDER_DEVICES.	2017-08-22 18:43:23 -07:00
debug	kdb: Don't back trace on a cpu that didn't round up	2019-02-12 19:46:09 +01:00
events	perf/core: Restore mmap record type correctly	2019-04-20 09:14:59 +02:00
gcov	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
irq	genirq: Initialize request_mutex if CONFIG_SPARSE_IRQ=n	2019-04-17 08:37:53 +02:00
livepatch	livepatch: Validate module/old func name length	2018-09-09 19:55:58 +02:00
locking	locking/lockdep: Add debug_locks check in __lock_downgrade()	2019-03-27 14:13:54 +09:00
power	PM / sleep: wakeup: Fix build error caused by missing SRCU support	2018-09-09 19:55:58 +02:00
printk	printk: Wake klogd when passing console_lock owner	2018-12-17 09:28:55 +01:00
rcu	rcu: Do RCU GP kthread self-wakeup from softirq and interrupt	2019-03-23 14:35:30 +01:00
sched	sched/fair: Do not re-read ->h_load_next during hierarchical load calculation	2019-04-17 08:37:54 +02:00
time	alarmtimer: Return correct remaining time	2019-04-17 08:37:52 +02:00
trace	tracing: kdb: Fix ftdump to not sleep	2019-04-05 22:31:25 +02:00
.gitignore	…
Kconfig.freezer	…
Kconfig.hz	…
Kconfig.locks	…
Kconfig.preempt	…
Makefile	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
acct.c	kernel/acct.c: fix the acct->needcheck check in check_free_space()	2018-01-10 09:31:17 +01:00
async.c	kernel/async.c: revert "async: simplify lowest_in_progress()"	2018-02-16 20:23:05 +01:00
audit.c	audit: return on memory error to avoid null pointer dereference	2018-05-30 07:52:39 +02:00
audit.h	ipc: mqueue: Replace timespec with timespec64	2017-09-03 20:21:24 -04:00
audit_fsnotify.c	…
audit_tree.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
audit_watch.c	audit: fix use-after-free in audit_add_watch	2018-09-26 08:38:09 +02:00
auditfilter.c	audit: allow not equal op for audit by executable	2018-08-03 07:50:39 +02:00
auditsc.c	audit: fix potential null dereference 'context->module.name'	2018-08-06 16:20:49 +02:00
backtracetest.c	…
bounds.c	kbuild: fix kernel/bounds.c 'W=1' warning	2018-11-13 11:15:08 -08:00
capability.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
compat.c	compat: fix 4-byte infoleak via uninitialized struct field	2018-05-16 10:10:26 +02:00
configs.c	…
context_tracking.c	…
cpu.c	cpu/hotplug: Mute hotplug lockdep during init	2019-04-05 22:31:38 +02:00
cpu_pm.c	PM / CPU: replace raw_notifier with atomic_notifier	2017-07-31 13:09:49 +02:00
crash_core.c	kdump: write correct address of mem_section into vmcoreinfo	2018-01-17 09:45:27 +01:00
crash_dump.c	…
cred.c	…
delayacct.c	delayacct: Use raw_spinlocks	2018-08-03 07:50:38 +02:00
dma.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
elfcore.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
exec_domain.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
exit.c	cgroup/pids: turn cgroup_subsys->free() into cgroup_subsys->release() to fix the accounting	2019-04-05 22:31:37 +02:00
extable.c	extable: Enable RCU if it is not watching in kernel_text_address()	2017-09-23 16:50:20 -04:00
fork.c	fork: record start_time late	2019-01-13 10:01:02 +01:00
freezer.c	…
futex.c	futex: Ensure that futex address is aligned in handle_futex_death()	2019-03-27 14:13:52 +09:00
futex_compat.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
groups.c	kernel: make groups_sort calling a responsibility group_info allocators	2017-12-20 10:10:18 +01:00
hung_task.c	kernel: hung_task.c: disable on suspend	2019-04-20 09:15:05 +02:00
irq_work.c	…
jump_label.c	sched/core: Fix cpu.max vs. cpuhotplug deadlock	2018-12-05 19:41:17 +01:00
kallsyms.c	kernel/kallsyms.c: replace all_var with IS_ENABLED(CONFIG_KALLSYMS_ALL)	2017-07-10 16:32:34 -07:00
kcmp.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
kcov.c	kcov: ensure irq code sees a valid area	2018-08-03 07:50:22 +02:00
kexec.c	kdump: protect vmcoreinfo data under the crash memory	2017-07-12 16:26:00 -07:00
kexec_core.c	x86/mm, kexec: Allow kexec to be used with SME	2017-07-18 11:38:04 +02:00
kexec_file.c	kexec_file: adjust declaration of kexec_purgatory	2017-07-12 16:26:02 -07:00
kexec_internal.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
kmod.c	kmod: move #ifdef CONFIG_MODULES wrapper to Makefile	2017-09-08 18:26:51 -07:00
kprobes.c	kprobes: Return error if we fail to reuse kprobe instead of BUG_ON()	2018-11-13 11:14:55 -08:00
ksysfs.c	kexec: move vmcoreinfo out of the kernel's .bss section	2017-07-12 16:25:59 -07:00
kthread.c	kthread, tracing: Don't expose half-written comm when creating kthreads	2018-08-03 07:50:21 +02:00
latencytop.c	…
memremap.c	mm, devm_memremap_pages: kill mapping "System RAM" support	2019-01-13 10:01:02 +01:00
module-internal.h	…
module.c	kobject: return error code if writing /sys/.../uevent fails	2019-02-12 19:46:02 +01:00
module_signing.c	…
notifier.c	…
nsproxy.c	…
padata.c	…
panic.c	panic: avoid deadlocks in re-entrant console drivers	2018-12-29 13:39:10 +01:00
params.c	kernel/params.c: improve STANDARD_PARAM_DEF readability	2017-10-03 17:54:26 -07:00
pid.c	pids: make task_tgid_nr_ns() safe	2017-08-21 12:47:31 -07:00
pid_namespace.c	userns,pidns: Verify the userns for new pid namespaces	2017-07-20 07:43:58 -05:00
profile.c	…
ptrace.c	ptrace: Remove unused ptrace_may_access_sched() and MODE_IBRS	2018-12-05 19:41:21 +01:00
range.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
reboot.c	…
relay.c	relay: check return of create_buf_file() properly	2019-03-13 14:03:20 -07:00
resource.c	resource: fix integer overflow at reallocation	2018-04-24 09:36:22 +02:00
seccomp.c	seccomp: Move speculation migitation control to arch code	2018-05-22 18:54:04 +02:00
signal.c	signal: Restore the stop PTRACE_EVENT_EXIT	2019-02-20 10:20:54 +01:00
smp.c	cpu/hotplug: Fix "SMT disabled by BIOS" detection for KVM	2019-02-12 19:46:13 +01:00
smpboot.c	watchdog/core, powerpc: Lock cpus across reconfiguration	2017-10-04 10:53:54 +02:00
smpboot.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
softirq.c	Mark HI and TASKLET softirq synchronous	2018-08-15 18:12:47 +02:00
stacktrace.c	…
stop_machine.c	stop_machine: Atomically queue and wake stopper threads	2018-09-05 09:26:36 +02:00
sys.c	sys: don't hold uts_sem while accessing userspace memory	2018-09-09 19:56:00 +02:00
sys_ni.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
sysctl.c	sysctl: handle overflow for file-max	2019-04-05 22:31:26 +02:00
sysctl_binary.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
task_work.c	locking/barriers: Convert users of lockless_dereference() to READ_ONCE()	2017-12-25 14:26:21 +01:00
taskstats.c	…
test_kprobes.c	…
torture.c	torture: Fix typo suppressing CPU-hotplug statistics	2017-07-25 13:04:45 -07:00
tracepoint.c	tracepoint: Do not warn on ENOMEM	2018-05-09 09:51:50 +02:00
tsacct.c	…
ucount.c	…
uid16.c	kernel: make groups_sort calling a responsibility group_info allocators	2017-12-20 10:10:18 +01:00
umh.c	kmod: split out umh code into its own file	2017-09-08 18:26:50 -07:00
up.c	smp: Avoid using two cache lines for struct call_single_data	2017-08-29 15:14:38 +02:00
user-return-notifier.c	…
user.c	…
user_namespace.c	userns: move user access out of the mutex	2018-09-09 19:56:00 +02:00
utsname.c	…
utsname_sysctl.c	sys: don't hold uts_sem while accessing userspace memory	2018-09-09 19:56:00 +02:00
watchdog.c	watchdog: Mark watchdog touch functions as notrace	2018-09-05 09:26:42 +02:00
watchdog_hld.c	watchdog: Mark watchdog touch functions as notrace	2018-09-05 09:26:42 +02:00
workqueue.c	watchdog: Mark watchdog touch functions as notrace	2018-09-05 09:26:42 +02:00
workqueue_internal.h	Merge branch 'for-4.14-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq	2017-11-06 12:26:49 -08:00