Files
linux/kernel
Daniel Borkmann b9b34ddbe2 bpf: Fix masking negation logic upon negative dst register
The negation logic for the case where the off_reg is sitting in the
dst register is not correct given then we cannot just invert the add
to a sub or vice versa. As a fix, perform the final bitwise and-op
unconditionally into AX from the off_reg, then move the pointer from
the src to dst and finally use AX as the source for the original
pointer arithmetic operation such that the inversion yields a correct
result. The single non-AX mov in between is possible given constant
blinding is retaining it as it's not an immediate based operation.

Fixes: 979d63d50c ("bpf: prevent out of bounds speculation on pointer arithmetic")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Tested-by: Piotr Krysiuk <piotras@gmail.com>
Reviewed-by: Piotr Krysiuk <piotras@gmail.com>
Reviewed-by: John Fastabend <john.fastabend@gmail.com>
Acked-by: Alexei Starovoitov <ast@kernel.org>
2021-05-03 11:56:16 +02:00
..
2021-04-22 14:36:03 +02:00
2021-04-08 19:37:21 +02:00
2021-03-24 12:11:48 -04:00
2021-04-08 16:04:20 -07:00
2021-04-08 16:04:20 -07:00
2021-04-08 16:04:20 -07:00
2020-11-14 11:26:04 -08:00
2020-07-27 14:31:12 -04:00
2020-12-01 10:30:28 +00:00
2021-01-22 15:09:42 +01:00
2021-03-17 15:51:17 +01:00
2021-02-09 12:27:29 -05:00
2020-08-19 14:14:12 +02:00
2020-08-19 14:13:20 +02:00