Jann Horn b799207e1e bpf: 32-bit RSH verification must truncate input before the ALU op ... When I wrote commit 468f6eafa6 ("bpf: fix 32-bit ALU op verification"), I assumed that, in order to emulate 64-bit arithmetic with 32-bit logic, it is sufficient to just truncate the output to 32 bits; and so I just moved the register size coercion that used to be at the start of the function to the end of the function. That assumption is true for almost every op, but not for 32-bit right shifts, because those can propagate information towards the least significant bit. Fix it by always truncating inputs for 32-bit ops to 32 bits. Also get rid of the coerce_reg_to_size() after the ALU op, since that has no effect. Fixes: 468f6eafa6 ("bpf: fix 32-bit ALU op verification") Acked-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: Jann Horn <jannh@google.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>		2018-10-05 18:41:45 +02:00
..
arraymap.c
bpf_lru_list.c
bpf_lru_list.h
btf.c	bpf: btf: Fix end boundary calculation for type section	2018-09-12 22:00:23 +02:00
cgroup.c
core.c
cpumap.c	bpf: fix redirect to map under tail calls	2018-08-17 15:56:23 -07:00
devmap.c	bpf: fix redirect to map under tail calls	2018-08-17 15:56:23 -07:00
disasm.c
disasm.h
hashtab.c	bpf: use per htab salt for bucket hash	2018-08-23 18:45:47 +02:00
helpers.c
inode.c
local_storage.c	bpf: don't accept cgroup local storage with zero value size	2018-10-02 14:42:23 +02:00
lpm_trie.c
Makefile
map_in_map.c
map_in_map.h
offload.c
percpu_freelist.c
percpu_freelist.h
reuseport_array.c
sockmap.c	bpf: sockmap, fix transition through disconnect without close	2018-09-22 02:46:41 +02:00
stackmap.c
syscall.c
tnum.c
verifier.c	bpf: 32-bit RSH verification must truncate input before the ALU op	2018-10-05 18:41:45 +02:00
xskmap.c	bpf: fix redirect to map under tail calls	2018-08-17 15:56:23 -07:00