Re: [PATCH bpf-next] bpf/verifier: properly clear union members after a ctx read

2018-09-05 Thread Alexei Starovoitov
On Wed, Sep 05, 2018 at 02:47:22PM +0100, Edward Cree wrote: > On 05/09/18 03:23, Alexei Starovoitov wrote: > > So would you agree it's fair to add > > Fixes: f1174f77b50c ("bpf/verifier: rework value tracking") > > ? > Sure.  Though I don't think it needs backporting, as it's a conservative >  

Re: [PATCH bpf-next] bpf/verifier: properly clear union members after a ctx read

2018-09-05 Thread Edward Cree
On 05/09/18 03:23, Alexei Starovoitov wrote: > So would you agree it's fair to add > Fixes: f1174f77b50c ("bpf/verifier: rework value tracking") > ? Sure.  Though I don't think it needs backporting, as it's a conservative  bug (i.e. it merely prevents pruning, but that's safe security-wise). > How

Re: [PATCH bpf-next] bpf/verifier: properly clear union members after a ctx read

2018-09-04 Thread Alexei Starovoitov
On Tue, Sep 04, 2018 at 03:19:52PM +0100, Edward Cree wrote: > In check_mem_access(), for the PTR_TO_CTX case, after check_ctx_access() > has supplied a reg_type, the other members of the register state are set > appropriately. Previously reg.range was set to 0, but as it is in a > union with

[PATCH bpf-next] bpf/verifier: properly clear union members after a ctx read

2018-09-04 Thread Edward Cree
In check_mem_access(), for the PTR_TO_CTX case, after check_ctx_access() has supplied a reg_type, the other members of the register state are set appropriately. Previously reg.range was set to 0, but as it is in a union with reg.map_ptr, which is larger, upper bytes of the latter were left in