Alexei Starovoitov c3de6317d7 bpf: fix verifier memory corruption ...

Due to missing bounds check the DAG pass of the BPF verifier can corrupt
the memory which can cause random crashes during program loading:

[8.449451] BUG: unable to handle kernel paging request at ffffffffffffffff
[8.451293] IP: [<ffffffff811de33d>] kmem_cache_alloc_trace+0x8d/0x2f0
[8.452329] Oops: 0000 [#1] SMP
[8.452329] Call Trace:
[8.452329]  [<ffffffff8116cc82>] bpf_check+0x852/0x2000
[8.452329]  [<ffffffff8116b7e4>] bpf_prog_load+0x1e4/0x310
[8.452329]  [<ffffffff811b190f>] ? might_fault+0x5f/0xb0
[8.452329]  [<ffffffff8116c206>] SyS_bpf+0x806/0xa30

Fixes: f1bca824da ("bpf: add search pruning optimization to verifier")
Signed-off-by: Alexei Starovoitov <ast@plumgrid.com>
Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

2015-04-16 12:06:11 -04:00

..

bpf

bpf: fix verifier memory corruption

2015-04-16 12:06:11 -04:00

configs

x86: Add "make tinyconfig" to configure the tiniest possible kernel

2014-08-08 16:30:24 -07:00

debug

debug: prevent entering debug mode on panic/exception.

2015-02-19 12:39:03 -06:00

events

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next

2015-04-15 09:00:47 -07:00

gcov

kbuild,gcov: simplify kernel/gcov/Makefile more

2015-01-09 17:25:44 +01:00

irq

Merge tag 'irqchip-core-4.1-3' of git://git.infradead.org/users/jcooper/linux into irq/core

2015-04-11 11:17:28 +02:00

livepatch

Merge branch 'for-4.1/core-noarch' into for-linus

2015-04-13 23:57:20 +02:00

locking

Merge branch 'locking-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2015-04-13 10:27:28 -07:00

power

Merge back earlier suspend/hibernate material for v4.1.

2015-04-10 12:01:59 +02:00

printk

Merge branch 'iocb' into for-next

2015-04-11 22:24:41 -04:00

rcu

Merge branches 'doc.2015.02.26a', 'earlycb.2015.03.03a', 'fixes.2015.03.03a', 'gpexp.2015.02.26a', 'hotplug.2015.03.20a', 'sysidle.2015.02.26b' and 'tiny.2015.02.26a' into HEAD

2015-03-20 08:31:01 -07:00

sched

Merge branch 'timers-nohz-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2015-04-14 13:58:48 -07:00

time

timers/PM: Drop unnecessary braces from tick_freeze()

2015-04-03 15:15:52 +02:00

trace

Merge branch 'perf-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2015-04-14 14:37:47 -07:00

.gitignore

…

acct.c

new fs_pin killing logics

2015-01-25 23:17:28 -05:00

async.c

kernel/async.c: switch to pr_foo()

2014-10-09 22:26:04 -04:00

audit_tree.c

fsnotify: unify inode and mount marks handling

2014-12-13 12:42:53 -08:00

audit_watch.c

audit: invalid op= values for rules

2014-09-23 16:37:53 -04:00

audit.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2014-12-30 10:45:47 -08:00

audit.h

audit: replace getname()/putname() hacks with reference counters

2015-01-23 00:23:58 -05:00

auditfilter.c

Merge branch 'upstream' of git://git.infradead.org/users/pcmoore/audit

2015-02-11 20:07:47 -08:00

auditsc.c

Merge branch 'getname2' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2015-02-17 15:27:47 -08:00

backtracetest.c

…

bounds.c

page-cgroup: get rid of NR_PCG_FLAGS

2014-08-08 15:57:18 -07:00

capability.c

CAPABILITIES: remove undefined caps from all processes

2014-07-24 21:53:47 +10:00

cgroup_freezer.c

cgroup: rename cgroup_subsys->base_cftypes to ->legacy_cftypes

2014-07-15 11:05:09 -04:00

cgroup.c

cgroup: Use kvfree in pidlist_free()

2015-03-03 08:47:25 -05:00

compat.c

all arches, signal: move restart_block to struct task_struct

2015-02-12 18:54:12 -08:00

configs.c

…

context_tracking.c

context_tracking: Export context_tracking_user_enter/exit

2015-03-09 15:43:00 +01:00

cpu_pm.c

…

cpu.c

Merge branch 'core-rcu-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2015-04-14 13:36:04 -07:00

cpuset.c

kernel, cpuset: remove exception for __GFP_THISNODE

2015-04-14 16:49:03 -07:00

crash_dump.c

crash_dump: Make is_kdump_kernel() accessible from modules

2014-08-25 15:42:19 -07:00

cred.c

…

delayacct.c

delayacct: Remove braindamaged type conversions

2014-07-23 10:18:06 -07:00

dma.c

…

elfcore.c

…

exec_domain.c

…

exit.c

oom, PM: make OOM detection in the freezer path raceless

2015-02-11 17:06:03 -08:00

extable.c

ftrace/x86/extable: Add is_ftrace_trampoline() function

2014-11-19 15:25:26 -05:00

fork.c

mm: do not use mm->nr_pmds on !MMU configurations

2015-02-12 18:54:10 -08:00

freezer.c

freezer: remove obsolete comments in __thaw_task()

2014-10-21 23:44:20 +02:00

futex_compat.c

…

futex.c

Merge tag 'v4.0-rc1' into locking/core, to refresh the tree before merging new changes

2015-02-24 08:41:07 +01:00

groups.c

userns: Don't allow setgroups until a gid mapping has been setablished

2014-12-09 16:58:40 -06:00

hung_task.c

…

irq_work.c

percpu: Convert remaining __get_cpu_var uses in 3.18-rcX

2014-10-29 11:18:18 -04:00

jump_label.c

…

kallsyms.c

kernel/kallsyms.c: use __seq_open_private()

2014-10-14 02:18:16 +02:00

kcmp.c

kcmp: fix standard comparison bug

2014-09-10 15:42:12 -07:00

Kconfig.freezer

…

Kconfig.hz

…

Kconfig.locks

locking/mcs: Better differentiate between MCS variants

2015-01-14 15:07:32 +01:00

Kconfig.preempt

…

kexec.c

kexec: simplify conditional

2015-02-17 14:34:51 -08:00

kmod.c

usermodehelper: kill the kmod_thread_locker logic

2014-12-10 17:41:17 -08:00

kprobes.c

kprobes: makes kprobes/enabled works correctly for optimized kprobes.

2015-02-13 21:21:42 -08:00

ksysfs.c

…

kthread.c

kernel/kthread.c: partial revert of 81c98869fa ("kthread: ensure locality of task_struct allocations")

2014-10-09 22:25:51 -04:00

latencytop.c

…

Makefile

Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security

2015-02-11 20:25:11 -08:00

module_signing.c

…

module-internal.h

…

module.c

Merge tag 'trace-v4.1' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace

2015-04-14 10:49:03 -07:00

notifier.c

rcu: Make SRCU optional by using CONFIG_SRCU

2015-01-06 11:04:29 -08:00

nsproxy.c

bury struct proc_ns in fs/proc

2014-12-04 14:34:54 -05:00

padata.c

padata: use %*pb[l] to print bitmaps including cpumasks and nodemasks

2015-02-13 21:21:38 -08:00

panic.c

livepatch: kernel: add TAINT_LIVEPATCH

2014-12-22 15:40:48 +01:00

params.c

param: fix uninitialized read with CONFIG_DEBUG_LOCK_ALLOC

2015-01-20 11:38:31 +10:30

pid_namespace.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2014-12-16 15:53:03 -08:00

pid.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

2014-12-16 15:53:03 -08:00

profile.c

profile: use %*pb[l] to print bitmaps including cpumasks and nodemasks

2015-02-13 21:21:38 -08:00

ptrace.c

ptrace: remove linux/compat.h inclusion under CONFIG_COMPAT

2015-02-17 14:34:51 -08:00

range.c

kernel: avoid overflow in cmp_range

2015-01-17 10:02:23 +13:00

reboot.c

kernel: add support for kernel restart handler call chain

2014-09-26 00:00:06 -07:00

relay.c

…

resource.c

resources: Move struct resource_list_entry from ACPI into resource core

2015-02-05 15:09:25 +01:00

seccomp.c

seccomp: cap SECCOMP_RET_ERRNO data to MAX_ERRNO

2015-02-17 14:34:55 -08:00

signal.c

signal: use current->state helpers

2015-02-17 14:34:51 -08:00

smp.c

Merge branch 'for-3.18-consistent-ops' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu

2014-10-15 07:48:18 +02:00

smpboot.c

smpboot: Add common code for notification from dying CPU

2015-03-11 13:20:25 -07:00

smpboot.h

…

softirq.c

Merge branch 'locking-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2015-02-09 15:24:03 -08:00

stacktrace.c

stacktrace: introduce snprint_stack_trace for buffer output

2014-12-13 12:42:48 -08:00

stop_machine.c

…

sys_ni.c

syscalls: implement execveat() system call

2014-12-13 12:42:51 -08:00

sys.c

kernel/sys.c: fix UNAME26 for 4.0

2015-02-28 09:57:51 -08:00

sysctl_binary.c

kernel: add panic_on_warn

2014-12-10 17:41:10 -08:00

sysctl.c

Merge branch 'akpm' (patches from Andrew)

2015-04-14 16:49:17 -07:00

system_certificates.S

…

system_keyring.c

KEYS: validate certificate trust only with builtin keys

2014-07-17 09:35:17 -04:00

task_work.c

…

taskstats.c

netlink: make nlmsg_end() and genlmsg_end() void

2015-01-18 01:03:45 -05:00

test_kprobes.c

kernel/test_kprobes.c: use current logging functions

2014-08-08 15:57:18 -07:00

torture.c

torture: Address race in module cleanup

2014-09-16 13:41:06 -07:00

tracepoint.c

tracing: syscall_regfunc() should not skip kernel threads

2014-06-21 00:15:26 -04:00

tsacct.c

sched: Make task->start_time nanoseconds based

2014-07-23 10:18:05 -07:00

uid16.c

groups: Consolidate the setgroups permission checks

2014-12-05 17:19:27 -06:00

up.c

…

user_namespace.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace

2014-12-17 12:31:40 -08:00

user-return-notifier.c

scheduler: Replace __get_cpu_var with this_cpu_ptr

2014-08-26 13:45:45 -04:00

user.c

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace

2014-12-17 12:31:40 -08:00

utsname_sysctl.c

sysctl: convert use of typedef ctl_table to struct ctl_table

2014-06-06 16:08:16 -07:00

utsname.c

copy address of proc_ns_ops into ns_common

2014-12-04 14:34:47 -05:00

watchdog.c

Merge branch 'akpm' (patches from Andrew)

2015-04-14 16:49:17 -07:00

workqueue_internal.h

…

workqueue.c

workqueue: Reorder sysfs code

2015-04-06 11:16:04 -04:00