Gianluca Borello fd05e57bb3 bpf: fix stacksafe exploration when comparing states ... Commit cc2b14d510 ("bpf: teach verifier to recognize zero initialized stack") introduced a very relaxed check when comparing stacks of different states, effectively returning a positive result in many cases where it shouldn't. This can create problems in cases such as this following C pseudocode: long var; long *x = bpf_map_lookup(...); if (!x) return; if (*x != 0xbeef) var = 0; else var = 1; /* This is the key part, calling a helper causes an explored state * to be saved with the information that "var" is on the stack as * STACK_ZERO, since the helper is first met by the verifier after * the "var = 0" assignment. This state will however be wrongly used * also for the "var = 1" case, so the verifier assumes "var" is always * 0 and will replace the NULL assignment with nops, because the * search pruning prevents it from exploring the faulty branch. */ bpf_ktime_get_ns(); if (var) *(long *)0 = 0xbeef; Fix the issue by making sure that the stack is fully explored before returning a positive comparison result. Also attach a couple tests that highlight the bad behavior. In the first test, without this fix instructions 16 and 17 are replaced with nops instead of being rejected by the verifier. The second test, instead, allows a program to make a potentially illegal read from the stack. Fixes: cc2b14d510 ("bpf: teach verifier to recognize zero initialized stack") Signed-off-by: Gianluca Borello <g.borello@gmail.com> Acked-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: Alexei Starovoitov <ast@kernel.org>		2017-12-23 11:04:58 -08:00
..
fault-injection	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
ktest	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
nvdimm	libnvdimm for 4.15	2017-11-17 09:51:57 -08:00
radix-tree	mm, truncate: do not check mapping for every page being truncated	2017-11-15 18:21:06 -08:00
scatterlist	tools/testing/scatterlist: Test new __sg_alloc_table_from_pages	2017-09-07 10:54:40 +01:00
selftests	bpf: fix stacksafe exploration when comparing states	2017-12-23 11:04:58 -08:00
vsock	VSOCK: add tools/testing/vsock/vsock_diag_test	2017-10-05 18:44:17 -07:00