Files
kernel/include/linux
Alexei Starovoitov bb7f0f989c bpf: fix integer overflows
There were various issues related to the limited size of integers used in
the verifier:
 - `off + size` overflow in __check_map_access()
 - `off + reg->off` overflow in check_mem_access()
 - `off + reg->var_off.value` overflow or 32-bit truncation of
   `reg->var_off.value` in check_mem_access()
 - 32-bit truncation in check_stack_boundary()

Make sure that any integer math cannot overflow by not allowing
pointer math with large values.

Also reduce the scope of "scalar op scalar" tracking.

Fixes: f1174f77b5 ("bpf/verifier: rework value tracking")
Reported-by: Jann Horn <jannh@google.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2017-12-21 02:15:41 +01:00
..
2017-11-13 01:34:49 +01:00
2017-12-21 02:15:41 +01:00
2017-11-22 21:40:54 +01:00
2017-11-15 18:21:04 -08:00
2017-12-12 13:22:10 +01:00
2017-11-05 16:42:02 -08:00
2017-11-13 01:41:20 +01:00
2017-11-15 18:21:06 -08:00
2017-11-17 16:10:04 -08:00
2017-11-15 18:21:05 -08:00
2017-11-15 18:21:01 -08:00
2017-11-17 16:10:04 -08:00
2017-10-12 15:41:05 +02:00
2017-11-15 18:21:01 -08:00
2017-12-01 13:09:40 -08:00
2017-10-19 10:08:56 +02:00
2017-10-07 10:45:02 -06:00
2017-11-15 18:21:04 -08:00
2017-11-29 18:40:42 -08:00
2017-11-15 18:21:04 -08:00
2017-11-17 16:10:00 -08:00
2017-10-20 09:37:32 +02:00
2017-12-14 16:00:49 -08:00
2017-11-15 18:21:03 -08:00
2017-11-15 18:21:06 -08:00
2017-11-09 10:23:28 +01:00
2017-11-17 16:10:04 -08:00
2017-11-17 16:10:04 -08:00
2017-11-13 01:33:48 +01:00
2017-12-11 10:52:23 -05:00
2017-11-15 18:21:04 -08:00
2017-11-07 12:22:21 +01:00
2017-11-15 18:21:01 -08:00
2017-11-15 18:21:06 -08:00
2017-11-15 18:21:01 -08:00
2017-10-11 22:36:54 -04:00
2017-10-04 10:29:22 +02:00