Re: [PATCH 4.9] bpf/verifier: Fix states_equal() comparison of pointer and UNKNOWN
flat view
From: Alexei Starovoitov <hidden>
Date: 2017-12-23 03:51:42
Also in:
stable
On Sat, Dec 23, 2017 at 02:26:17AM +0000, Ben Hutchings wrote:
An UNKNOWN_VALUE is not supposed to be derived from a pointer, unless pointer leaks are allowed. Therefore, states_equal() must not treat a state with a pointer in a register as "equal" to a state with an UNKNOWN_VALUE in that register. This was fixed differently upstream, but the code around here was largely rewritten in 4.14 by commit f1174f77b50c "bpf/verifier: rework value tracking". The bug can be detected by the bpf/verifier sub-test "pointer/scalar confusion in state equality check (way 1)". Signed-off-by: Ben Hutchings <redacted> Cc: Edward Cree <redacted> Cc: Jann Horn <jannh@google.com> Cc: Alexei Starovoitov <ast@kernel.org>
Acked-by: Alexei Starovoitov <ast@kernel.org>