Messages in this thread | | | Subject | Re: [PATCH] bpf: 32-bit RSH verification must truncate input before the ALU op | From | Daniel Borkmann <> | Date | Fri, 5 Oct 2018 19:47:58 +0200 |
| |
On 10/05/2018 06:17 PM, Jann Horn wrote: > When I wrote commit 468f6eafa6c4 ("bpf: fix 32-bit ALU op verification"), I > assumed that, in order to emulate 64-bit arithmetic with 32-bit logic, it > is sufficient to just truncate the output to 32 bits; and so I just moved > the register size coercion that used to be at the start of the function to > the end of the function. > > That assumption is true for almost every op, but not for 32-bit right > shifts, because those can propagate information towards the least > significant bit. Fix it by always truncating inputs for 32-bit ops to 32 > bits. > > Also get rid of the coerce_reg_to_size() after the ALU op, since that has > no effect. > > Fixes: 468f6eafa6c4 ("bpf: fix 32-bit ALU op verification") > Acked-by: Daniel Borkmann <daniel@iogearbox.net> > Signed-off-by: Jann Horn <jannh@google.com>
Applied to bpf, thanks Jann!
| |