Daniel Borkmann e60b0d12a9 bpf: Don't promote bogus looking registers after null check. ...

If we ever get to a point again where we convert a bogus looking <ptr>_or_null
typed register containing a non-zero fixed or variable offset, then lets not
reset these bounds to zero since they are not and also don't promote the register
to a <ptr> type, but instead leave it as <ptr>_or_null. Converting to a unknown
register could be an avenue as well, but then if we run into this case it would
allow to leak a kernel pointer this way.

Fixes: f1174f77b5 ("bpf/verifier: rework value tracking")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

2022-01-05 12:00:19 -08:00

..

preload

bpf/preload: Clean up .gitignore and "clean-files" target

2021-10-20 10:39:04 -07:00

arraymap.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2021-10-28 10:43:58 -07:00

bloom_filter.c

bpf: Add missing map_get_next_key method to bloom filter map.

2021-12-29 09:38:31 -08:00

bpf_inode_storage.c

bpf: Allow bpf_local_storage to be used by sleepable programs

2021-12-29 17:54:40 -08:00

bpf_iter.c

bpf: Add bpf_loop helper

2021-11-30 10:56:28 -08:00

bpf_local_storage.c

bpf: Allow bpf_local_storage to be used by sleepable programs

2021-12-29 17:54:40 -08:00

bpf_lru_list.c

bpf_lru_list: Read double-checked variable once without lock

2021-02-10 15:54:26 -08:00

bpf_lru_list.h

bpf: Fix a typo "inacitve" -> "inactive"

2020-04-06 21:54:10 +02:00

bpf_lsm.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next

2021-06-17 11:54:56 -07:00

bpf_struct_ops_types.h

bpf: Add dummy BPF STRUCT_OPS for test purpose

2021-11-01 14:10:00 -07:00

bpf_struct_ops.c

bpf: Rename btf_member accessors.

2021-12-02 11:18:34 -08:00

bpf_task_storage.c

bpf: Allow bpf_local_storage to be used by sleepable programs

2021-12-29 17:54:40 -08:00

btf.c

bpf: Extend kfunc with PTR_TO_CTX, PTR_TO_MEM argument support

2021-12-18 18:11:47 -08:00

cgroup.c

bpf: Add MEM_RDONLY for helper args that are pointers to rdonly mem.

2021-12-18 13:27:41 -08:00

core.c

bpf, docs: Prune all references to "internal BPF"

2021-11-30 10:52:11 -08:00

cpumap.c

bpf: Let bpf_warn_invalid_xdp_action() report more info

2021-12-13 22:28:27 +01:00

devmap.c

bpf: Let bpf_warn_invalid_xdp_action() report more info

2021-12-13 22:28:27 +01:00

disasm.c

bpf: Relicense disassembler as GPL-2.0-only OR BSD-2-Clause

2021-09-02 14:49:23 +02:00

disasm.h

bpf: Relicense disassembler as GPL-2.0-only OR BSD-2-Clause

2021-09-02 14:49:23 +02:00

dispatcher.c

bpf: Remove bpf_image tree

2020-03-13 12:49:52 -07:00

hashtab.c

bpf: Replace callers of BPF_CAST_CALL with proper function typedef

2021-09-28 16:27:18 -07:00

helpers.c

bpf: Add MEM_RDONLY for helper args that are pointers to rdonly mem.

2021-12-18 13:27:41 -08:00

inode.c

bpf: Fix regression on BPF_OBJ_GET with non-O_RDWR flags

2021-06-22 14:57:43 +02:00

Kconfig

bpf: Disallow unprivileged bpf by default

2021-11-01 17:06:47 +01:00

local_storage.c

bpf: Use struct_size() helper

2021-12-21 15:35:48 -08:00

lpm_trie.c

bpf: Fix typo in a comment in bpf lpm_trie.

2021-12-30 18:42:34 -08:00

Makefile

bpf: Prepare relo_core.c for kernel duty.

2021-12-02 11:18:34 -08:00

map_in_map.c

bpf: Remember BTF of inner maps.

2021-07-15 22:31:10 +02:00

map_in_map.h

bpf: Add map_meta_equal map ops

2020-08-28 15:41:30 +02:00

map_iter.c

bpf: Introduce MEM_RDONLY flag

2021-12-18 13:27:41 -08:00

mmap_unlock_work.h

bpf: Introduce helper bpf_find_vma

2021-11-07 11:54:51 -08:00

net_namespace.c

net: Add includes masked by netdevice.h including uapi/bpf.h

2021-12-29 20:03:05 -08:00

offload.c

bpf, offload: Replace bitwise AND by logical AND in bpf_prog_offload_info_fill

2020-02-17 16:53:49 +01:00

percpu_freelist.c

bpf: Use raw_spin_trylock() for pcpu_freelist_push/pop in NMI

2020-10-06 00:04:11 +02:00

percpu_freelist.h

bpf: Use raw_spin_trylock() for pcpu_freelist_push/pop in NMI

2020-10-06 00:04:11 +02:00

prog_iter.c

bpf: Refactor bpf_iter_reg to have separate seq_info member

2020-07-25 20:16:32 -07:00

queue_stack_maps.c

bpf: Eliminate rlimit-based memory accounting for queue_stack_maps maps

2020-12-02 18:32:46 -08:00

reuseport_array.c

bpf: Use struct_size() helper

2021-12-21 15:35:48 -08:00

ringbuf.c

bpf: Add MEM_RDONLY for helper args that are pointers to rdonly mem.

2021-12-18 13:27:41 -08:00

stackmap.c

bpf: Introduce btf_tracing_ids

2021-11-12 10:19:09 -08:00

syscall.c

bpf: Add MEM_RDONLY for helper args that are pointers to rdonly mem.

2021-12-18 13:27:41 -08:00

sysfs_btf.c

bpf: Load and verify kernel module BTFs

2020-11-10 15:25:53 -08:00

task_iter.c

bpf: Introduce btf_tracing_ids

2021-11-12 10:19:09 -08:00

tnum.c

bpf, tnums: Provably sound, faster, and more precise algorithm for tnum_mul

2021-06-01 13:34:15 +02:00

trampoline.c

bpf: Add get_func_[arg|ret|arg_cnt] helpers

2021-12-13 09:25:59 -08:00

verifier.c

bpf: Don't promote bogus looking registers after null check.

2022-01-05 12:00:19 -08:00