bpf/verifier: Fix states_equal() comparison of pointer and UNKNOWN
authorBen Hutchings <ben@decadent.org.uk>
Sat, 23 Dec 2017 00:29:56 +0000 (00:29 +0000)
committerBen Hutchings <ben@decadent.org.uk>
Sat, 23 Dec 2017 00:39:51 +0000 (00:39 +0000)
commitbd21ec094a10e3cd4945b11f969c226766c33c02
treefcce335377fc21996cc34f2a9255f4441cfe5e4b
parentd51c3d753b058db59349f41bb356eadb0d4730d4
bpf/verifier: Fix states_equal() comparison of pointer and UNKNOWN

An UNKNOWN_VALUE is not supposed to be derived from a pointer, unless
pointer leaks are allowed.  Therefore, states_equal() must not treat
a state with a pointer in a register as "equal" to a state with an
UNKNOWN_VALUE in that register.

This appears to have been fixed upstream as part of commit
f1174f77b50c "bpf/verifier: rework value tracking", and can be
detected by the bpf/verifier sub-test "pointer/scalar confusion in
state equality check (way 1)" in mainline.

Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: Edward Cree <ecree@solarflare.com>
Cc: Jann Horn <jannh@google.com>
Cc: Alexei Starovoitov <ast@kernel.org>
Gbp-Pq: Topic bugfix/all
Gbp-Pq: Name bpf-verifier-fix-states_equal-comparison-of-pointer-and-unknown.patch
kernel/bpf/verifier.c