Andrey Ignatov
f2bcd05ec7
bpf: Reject indirect var_off stack access in raw mode
...
It's hard to guarantee that whole memory is marked as initialized on
helper return if uninitialized stack is accessed with variable offset
since specific bounds are unknown to verifier. This may cause
uninitialized stack leaking.
Reject such an access in check_stack_boundary to prevent possible
leaking.
There are no known use-cases for indirect uninitialized stack access
with variable offset so it shouldn't break anything.
Fixes: 2011fccfb6 ("bpf: Support variable offset stack access from helpers")
Reported-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Andrey Ignatov <rdna@fb.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2019-04-05 16:50:07 +02:00
..
arraymap.c
bpf: introduce BPF_F_LOCK flag
2019-02-01 20:55:39 +01:00
bpf_lru_list.c
bpf_lru_list.h
btf.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2019-02-08 15:00:17 -08:00
cgroup.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2019-02-08 15:00:17 -08:00
core.c
bpf: verbose jump offset overflow check
2019-04-04 01:27:38 +02:00
cpumap.c
bpf/cpumap: make sure frame_size for build_skb is aligned if headroom isn't
2018-12-20 23:19:12 +01:00
devmap.c
bpf: devmap: fix wrong interface selection in notifier_call
2018-10-26 00:32:21 +02:00
disasm.c
bpf: disassembler support JMP32
2019-01-26 13:33:01 -08:00
disasm.h
hashtab.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2019-02-08 15:00:17 -08:00
helpers.c
bpf: introduce BPF_F_LOCK flag
2019-02-01 20:55:39 +01:00
inode.c
bpf: decouple btf from seq bpf fs dump and enable more maps
2018-08-13 00:52:45 +02:00
local_storage.c
bpf: introduce BPF_F_LOCK flag
2019-02-01 20:55:39 +01:00
lpm_trie.c
bpf, lpm: fix lookup bug in map_delete_elem
2019-02-22 16:17:53 +01:00
Makefile
bpf: add queue and stack maps
2018-10-19 13:24:31 -07:00
map_in_map.c
bpf: set inner_map_meta->spin_lock_off correctly
2019-02-27 17:03:13 -08:00
map_in_map.h
offload.c
bpf: offload: add priv field for drivers
2019-02-12 17:07:09 +01:00
percpu_freelist.c
bpf: fix lockdep false positive in percpu_freelist
2019-01-31 23:18:21 +01:00
percpu_freelist.h
bpf: fix lockdep false positive in percpu_freelist
2019-01-31 23:18:21 +01:00
queue_stack_maps.c
bpf: fix integer overflow in queue_stack_map
2018-11-22 21:29:40 +01:00
reuseport_array.c
bpf: Introduce BPF_MAP_TYPE_REUSEPORT_SOCKARRAY
2018-08-11 01:58:46 +02:00
stackmap.c
bpf: fix lockdep false positive in stackmap
2019-02-11 16:36:24 +01:00
syscall.c
bpf: increase complexity limit and maximum program size
2019-04-04 01:27:38 +02:00
tnum.c
bpf/verifier: improve register value range tracking with ARSH
2018-04-29 08:45:53 -07:00
verifier.c
bpf: Reject indirect var_off stack access in raw mode
2019-04-05 16:50:07 +02:00
xskmap.c
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
2018-10-19 11:03:06 -07:00