linux/kernel/bpf
Alexei Starovoitov c131187db2 bpf: fix branch pruning logic
when the verifier detects that register contains a runtime constant
and it's compared with another constant it will prune exploration
of the branch that is guaranteed not to be taken at runtime.
This is all correct, but malicious program may be constructed
in such a way that it always has a constant comparison and
the other branch is never taken under any conditions.
In this case such path through the program will not be explored
by the verifier. It won't be taken at run-time either, but since
all instructions are JITed the malicious program may cause JITs
to complain about using reserved fields, etc.
To fix the issue we have to track the instructions explored by
the verifier and sanitize instructions that are dead at run time
with NOPs. We cannot reject such dead code, since llvm generates
it for valid C code, since it doesn't do as much data flow
analysis as the verifier does.

Fixes: 17a5267067 ("bpf: verifier (add verifier core)")
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2017-11-23 10:56:35 +01:00
..
Makefile bpf: offload: add infrastructure for loading programs for a specific netdev 2017-11-05 22:26:18 +09:00
arraymap.c perf/bpf: Extend the perf_event_read_local() interface, a.k.a. "bpf: perf event change needed for subsequent bpf helpers" 2017-10-27 10:31:56 +02:00
bpf_lru_list.c bpf: lru: Lower the PERCPU_NR_SCANS from 16 to 4 2017-04-17 13:55:52 -04:00
bpf_lru_list.h bpf: Only set node->ref = 1 if it has not been set 2017-09-01 09:57:39 -07:00
cgroup.c bpf, cgroup: implement eBPF-based device controller for cgroup v2 2017-11-05 23:26:51 +09:00
core.c Merge branch 'akpm' (patches from Andrew) 2017-11-15 19:42:40 -08:00
cpumap.c bpf: cpumap micro-optimization in cpu_map_enqueue 2017-11-02 16:13:14 +09:00
devmap.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2017-10-22 13:39:14 +01:00
disasm.c bpf: move instruction printing into a separate file 2017-10-10 12:30:16 -07:00
disasm.h bpf: move instruction printing into a separate file 2017-10-10 12:30:16 -07:00
hashtab.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2017-10-22 13:39:14 +01:00
helpers.c bpf: rename ARG_PTR_TO_STACK 2017-01-09 16:56:27 -05:00
inode.c bpf: Add file mode configuration into bpf maps 2017-10-20 13:32:59 +01:00
lpm_trie.c bpf: Add file mode configuration into bpf maps 2017-10-20 13:32:59 +01:00
map_in_map.c bpf: Add syscall lookup support for fd array and htab 2017-06-29 13:13:25 -04:00
map_in_map.h bpf: Add syscall lookup support for fd array and htab 2017-06-29 13:13:25 -04:00
offload.c bpf: revert report offload info to user space 2017-11-21 00:37:35 +01:00
percpu_freelist.c bpf: fix lockdep splat 2017-11-15 19:46:32 +09:00
percpu_freelist.h bpf: introduce percpu_freelist 2016-03-08 15:28:31 -05:00
sockmap.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2017-11-02 15:23:39 +09:00
stackmap.c bpf: Add file mode configuration into bpf maps 2017-10-20 13:32:59 +01:00
syscall.c bpf: revert report offload info to user space 2017-11-21 00:37:35 +01:00
tnum.c bpf/verifier: track signed and unsigned min/max values 2017-08-08 17:51:34 -07:00
verifier.c bpf: fix branch pruning logic 2017-11-23 10:56:35 +01:00