Daniel Borkmann 0962590e55 bpf: fix partial copy of map_ptr when dst is scalar
ALU operations on pointers such as scalar_reg += map_value_ptr are
handled in adjust_ptr_min_max_vals(). Problem is however that map_ptr
and range in the register state share a union, so transferring state
through dst_reg->range = ptr_reg->range is just buggy as any new
map_ptr in the dst_reg is then truncated (or null) for subsequent
checks. Fix this by adding a raw member and use it for copying state
over to dst_reg.

Fixes: f1174f77b50c ("bpf/verifier: rework value tracking")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Cc: Edward Cree <ecree@solarflare.com>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2018-10-31 16:53:17 -07:00
..
2018-10-26 16:26:32 -07:00
2018-10-26 16:26:32 -07:00
2018-10-22 17:46:08 +01:00
\n
2018-08-17 09:41:28 -07:00
2018-08-15 10:46:54 -07:00
2018-01-05 18:43:00 +11:00
2018-09-20 22:01:11 +02:00
2018-10-09 17:25:58 +02:00
2018-07-03 09:20:44 +02:00
2018-09-20 22:01:11 +02:00