diff options
| author | Alexei Starovoitov <ast@kernel.org> | 2019-01-02 16:01:25 -0800 |
|---|---|---|
| committer | Alexei Starovoitov <ast@kernel.org> | 2019-01-02 16:01:25 -0800 |
| commit | a67825f5195145f840939d0f85fc40b6b1077329 (patch) | |
| tree | 0aec20aa0c87f1cef2241c726cbbc404f5317155 /include/linux/filter.h | |
| parent | 8b6b25cf93b73e8e399adc55b0ffb9db32b881e0 (diff) | |
| parent | 80c9b2fae87bb5c5698940da1a981f14f89518d1 (diff) | |
| download | linux-next-a67825f5195145f840939d0f85fc40b6b1077329.tar.gz linux-next-a67825f5195145f840939d0f85fc40b6b1077329.zip | |
Merge branch 'prevent-oob-under-speculation'
Daniel Borkmann says:
====================
This set fixes an out of bounds case under speculative execution
by implementing masking of pointer alu into the verifier. For
details please see the individual patches.
Thanks!
v2 -> v3:
- 8/9: change states_equal condition into old->speculative &&
!cur->speculative, thanks Jakub!
- 8/9: remove incorrect speculative state test in
propagate_liveness(), thanks Jakub!
v1 -> v2:
- Typo fixes in commit msg and a comment, thanks David!
====================
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Diffstat (limited to 'include/linux/filter.h')
| -rw-r--r-- | include/linux/filter.h | 10 |
1 files changed, 3 insertions, 7 deletions
diff --git a/include/linux/filter.h b/include/linux/filter.h index 8c8544b375eb..ad106d845b22 100644 --- a/include/linux/filter.h +++ b/include/linux/filter.h @@ -53,14 +53,10 @@ struct sock_reuseport; #define BPF_REG_D BPF_REG_8 /* data, callee-saved */ #define BPF_REG_H BPF_REG_9 /* hlen, callee-saved */ -/* Kernel hidden auxiliary/helper register for hardening step. - * Only used by eBPF JITs. It's nothing more than a temporary - * register that JITs use internally, only that here it's part - * of eBPF instructions that have been rewritten for blinding - * constants. See JIT pre-step in bpf_jit_blind_constants(). - */ +/* Kernel hidden auxiliary/helper register. */ #define BPF_REG_AX MAX_BPF_REG -#define MAX_BPF_JIT_REG (MAX_BPF_REG + 1) +#define MAX_BPF_EXT_REG (MAX_BPF_REG + 1) +#define MAX_BPF_JIT_REG MAX_BPF_EXT_REG /* unused opcode to mark special call to bpf_tail_call() helper */ #define BPF_TAIL_CALL 0xf0 |