linux-kernel - Re: [PATCH bpf-next 0/2] bpf: Fix incorrect immediate spill

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <707a9c4c001ca5efe8bf7db36e7341f308651451.camel@gmail.com>
Date:   Fri, 27 Oct 2023 00:33:30 +0300
From:   Eduard Zingerman <eddyz87@...il.com>
To:     Hao Sun <sunhao.th@...il.com>, Alexei Starovoitov <ast@...nel.org>,
        Daniel Borkmann <daniel@...earbox.net>,
        John Fastabend <john.fastabend@...il.com>,
        Andrii Nakryiko <andrii@...nel.org>,
        Martin KaFai Lau <martin.lau@...ux.dev>,
        Song Liu <song@...nel.org>,
        Yonghong Song <yonghong.song@...ux.dev>,
        KP Singh <kpsingh@...nel.org>,
        Stanislav Fomichev <sdf@...gle.com>,
        Hao Luo <haoluo@...gle.com>, Jiri Olsa <jolsa@...nel.org>,
        Mykola Lysenko <mykolal@...com>, Shuah Khan <shuah@...nel.org>
Cc:     bpf@...r.kernel.org, linux-kernel@...r.kernel.org,
        linux-kselftest@...r.kernel.org
Subject: Re: [PATCH bpf-next 0/2] bpf: Fix incorrect immediate spill

On Thu, 2023-10-26 at 17:13 +0200, Hao Sun wrote:
> Immediate is incorrectly cast to u32 before being spilled, losing sign
> information. The range information is incorrect after load again. Fix
> immediate spill by remove the cast. The second patch add a test case
> for this.
> 
> Signed-off-by: Hao Sun <sunhao.th@...il.com>

Thank you for finding and fixing this issue.

Acked-by: Eduard Zingerman <eddyz87@...il.com>

> ---
> Hao Sun (2):
>       bpf: Fix check_stack_write_fixed_off() to correctly spill imm
>       selftests/bpf: Add test for immediate spilled to stack
> 
>  kernel/bpf/verifier.c                             |  2 +-
>  tools/testing/selftests/bpf/verifier/bpf_st_mem.c | 32 +++++++++++++++++++++++
>  2 files changed, 33 insertions(+), 1 deletion(-)
> ---
> base-commit: 399f6185a1c02f39bcadb8749bc2d9d48685816f
> change-id: 20231026-fix-check-stack-write-c40996694dfa
> 
> Best regards,