Josef Bacik e2d2afe15e bpf: fix states equal logic for varlen access ... If we have a branch that looks something like this int foo = map->value; if (condition) { foo += blah; } else { foo = bar; } map->array[foo] = baz; We will incorrectly assume that the !condition branch is equal to the condition branch as the register for foo will be UNKNOWN_VALUE in both cases. We need to adjust this logic to only do this if we didn't do a varlen access after we processed the !condition branch, otherwise we have different ranges and need to check the other branch as well. Fixes: 484611357c ("bpf: allow access into map value arrays") Reported-by: Jann Horn <jannh@google.com> Signed-off-by: Josef Bacik <jbacik@fb.com> Acked-by: Alexei Starovoitov <ast@kernel.org> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: David S. Miller <davem@davemloft.net>		2016-11-30 14:50:52 -05:00
..
arraymap.c
core.c
hashtab.c
helpers.c
inode.c
Makefile
percpu_freelist.c
percpu_freelist.h
stackmap.c
syscall.c
verifier.c	bpf: fix states equal logic for varlen access	2016-11-30 14:50:52 -05:00