4.14-stable patches

added patches:
	bpf-fix-masking-negation-logic-upon-negative-dst-register.patch

diff --git a/queue-4.14/bpf-fix-masking-negation-logic-upon-negative-dst-register.patch b/queue-4.14/bpf-fix-masking-negation-logic-upon-negative-dst-register.patch
new file mode 100644 (file)
index 0000000..09f146a
--- /dev/null
+++ b/queue-4.14/bpf-fix-masking-negation-logic-upon-negative-dst-register.patch
@@ -0,0 +1,50 @@
+From b9b34ddbe2076ade359cd5ce7537d5ed019e9807 Mon Sep 17 00:00:00 2001
+From: Daniel Borkmann <daniel@iogearbox.net>
+Date: Fri, 30 Apr 2021 16:21:46 +0200
+Subject: bpf: Fix masking negation logic upon negative dst register
+
+From: Daniel Borkmann <daniel@iogearbox.net>
+
+commit b9b34ddbe2076ade359cd5ce7537d5ed019e9807 upstream.
+
+The negation logic for the case where the off_reg is sitting in the
+dst register is not correct given then we cannot just invert the add
+to a sub or vice versa. As a fix, perform the final bitwise and-op
+unconditionally into AX from the off_reg, then move the pointer from
+the src to dst and finally use AX as the source for the original
+pointer arithmetic operation such that the inversion yields a correct
+result. The single non-AX mov in between is possible given constant
+blinding is retaining it as it's not an immediate based operation.
+
+Fixes: 979d63d50c0c ("bpf: prevent out of bounds speculation on pointer arithmetic")
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Tested-by: Piotr Krysiuk <piotras@gmail.com>
+Reviewed-by: Piotr Krysiuk <piotras@gmail.com>
+Reviewed-by: John Fastabend <john.fastabend@gmail.com>
+Acked-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ kernel/bpf/verifier.c |   12 ++++--------
+ 1 file changed, 4 insertions(+), 8 deletions(-)
+
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -4816,14 +4816,10 @@ static int fixup_bpf_calls(struct bpf_ve
+                       *patch++ = BPF_ALU64_REG(BPF_OR, BPF_REG_AX, off_reg);
+                       *patch++ = BPF_ALU64_IMM(BPF_NEG, BPF_REG_AX, 0);
+                       *patch++ = BPF_ALU64_IMM(BPF_ARSH, BPF_REG_AX, 63);
+-                      if (issrc) {
+-                              *patch++ = BPF_ALU64_REG(BPF_AND, BPF_REG_AX,
+-                                                       off_reg);
+-                              insn->src_reg = BPF_REG_AX;
+-                      } else {
+-                              *patch++ = BPF_ALU64_REG(BPF_AND, off_reg,
+-                                                       BPF_REG_AX);
+-                      }
++                      *patch++ = BPF_ALU64_REG(BPF_AND, BPF_REG_AX, off_reg);
++                      if (!issrc)
++                              *patch++ = BPF_MOV64_REG(insn->dst_reg, insn->src_reg);
++                      insn->src_reg = BPF_REG_AX;
+                       if (isneg)
+                               insn->code = insn->code == code_add ?
+                                            code_sub : code_add;

diff --git a/queue-4.14/series b/queue-4.14/series
index c95ca0d9357ce1b98e703b314cc120ea1a3c9fe5..c9177d6fbf640646a5c5a8fbf6329b6eda554b1d 100644 (file)
--- a/queue-4.14/series
+++ b/queue-4.14/series
@@ -8,3 +8,4 @@ iwlwifi-fix-softirq-hardirq-disabling-in-iwl_pcie_enqueue_hcmd.patch
 mips-introduce-isa-rev.h-to-define-mips_isa_rev.patch
 mips-cpu-features.h-replace-__mips_isa_rev-with-mips_isa_rev.patch
 mips-do-not-include-hi-and-lo-in-clobber-list-for-r6.patch
+bpf-fix-masking-negation-logic-upon-negative-dst-register.patch