Daniel Borkmann bb01a1bba5 bpf: Fix mask direction swap upon off reg sign change
Masking direction as indicated via mask_to_left is considered to be
calculated once and then used to derive pointer limits. Thus, this
needs to be placed into bpf_sanitize_info instead so we can pass it
to sanitize_ptr_alu() call after the pointer move. Piotr noticed a
corner case where the off reg causes masking direction change which
then results in an incorrect final aux->alu_limit.

Fixes: 7fedb63a8307 ("bpf: Tighten speculative pointer arithmetic mask")
Reported-by: Piotr Krysiuk <piotras@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Piotr Krysiuk <piotras@gmail.com>
Acked-by: Alexei Starovoitov <ast@kernel.org>
2021-05-25 22:08:53 +02:00
..
2021-04-27 18:09:44 -07:00
2021-04-26 09:41:15 -07:00
2021-05-01 10:14:08 -07:00
2021-05-05 12:39:29 -07:00
2021-04-22 14:36:03 +02:00
2021-04-27 18:14:38 -07:00
2021-04-08 19:37:21 +02:00
2021-05-01 10:14:08 -07:00
2021-03-24 12:11:48 -04:00
2021-04-27 13:50:58 -07:00
2021-04-08 16:04:20 -07:00
2021-05-06 19:24:11 -07:00
2021-05-06 19:24:13 -07:00
2021-03-29 15:56:48 +02:00
2021-05-07 00:26:33 -07:00
2020-12-14 16:40:27 -08:00
2020-11-14 11:26:04 -08:00
2020-12-17 13:01:31 -08:00
2020-12-14 16:40:27 -08:00
2021-04-20 10:13:58 +02:00
2020-12-01 10:30:28 +00:00
2021-04-28 13:33:57 -07:00
2021-01-22 15:09:42 +01:00
2021-04-28 12:00:13 -07:00
2021-05-07 00:26:34 -07:00
2021-02-09 12:27:29 -05:00
2021-05-07 00:26:34 -07:00
2021-05-07 00:26:34 -07:00
2021-04-27 10:16:46 -07:00