From: Greg Kroah-Hartman Date: Tue, 4 May 2021 11:35:59 +0000 (+0200) Subject: 4.14-stable patches X-Git-Tag: v4.19.190~32 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=0da8807ce645d30895c32d1ec81cfa094419e98d;p=thirdparty%2Fkernel%2Fstable-queue.git 4.14-stable patches added patches: bpf-fix-masking-negation-logic-upon-negative-dst-register.patch --- diff --git a/queue-4.14/bpf-fix-masking-negation-logic-upon-negative-dst-register.patch b/queue-4.14/bpf-fix-masking-negation-logic-upon-negative-dst-register.patch new file mode 100644 index 00000000000..09f146a20fa --- /dev/null +++ b/queue-4.14/bpf-fix-masking-negation-logic-upon-negative-dst-register.patch @@ -0,0 +1,50 @@ +From b9b34ddbe2076ade359cd5ce7537d5ed019e9807 Mon Sep 17 00:00:00 2001 +From: Daniel Borkmann +Date: Fri, 30 Apr 2021 16:21:46 +0200 +Subject: bpf: Fix masking negation logic upon negative dst register + +From: Daniel Borkmann + +commit b9b34ddbe2076ade359cd5ce7537d5ed019e9807 upstream. + +The negation logic for the case where the off_reg is sitting in the +dst register is not correct given then we cannot just invert the add +to a sub or vice versa. As a fix, perform the final bitwise and-op +unconditionally into AX from the off_reg, then move the pointer from +the src to dst and finally use AX as the source for the original +pointer arithmetic operation such that the inversion yields a correct +result. The single non-AX mov in between is possible given constant +blinding is retaining it as it's not an immediate based operation. + +Fixes: 979d63d50c0c ("bpf: prevent out of bounds speculation on pointer arithmetic") +Signed-off-by: Daniel Borkmann +Tested-by: Piotr Krysiuk +Reviewed-by: Piotr Krysiuk +Reviewed-by: John Fastabend +Acked-by: Alexei Starovoitov +Signed-off-by: Greg Kroah-Hartman +--- + kernel/bpf/verifier.c | 12 ++++-------- + 1 file changed, 4 insertions(+), 8 deletions(-) + +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -4816,14 +4816,10 @@ static int fixup_bpf_calls(struct bpf_ve + *patch++ = BPF_ALU64_REG(BPF_OR, BPF_REG_AX, off_reg); + *patch++ = BPF_ALU64_IMM(BPF_NEG, BPF_REG_AX, 0); + *patch++ = BPF_ALU64_IMM(BPF_ARSH, BPF_REG_AX, 63); +- if (issrc) { +- *patch++ = BPF_ALU64_REG(BPF_AND, BPF_REG_AX, +- off_reg); +- insn->src_reg = BPF_REG_AX; +- } else { +- *patch++ = BPF_ALU64_REG(BPF_AND, off_reg, +- BPF_REG_AX); +- } ++ *patch++ = BPF_ALU64_REG(BPF_AND, BPF_REG_AX, off_reg); ++ if (!issrc) ++ *patch++ = BPF_MOV64_REG(insn->dst_reg, insn->src_reg); ++ insn->src_reg = BPF_REG_AX; + if (isneg) + insn->code = insn->code == code_add ? + code_sub : code_add; diff --git a/queue-4.14/series b/queue-4.14/series index c95ca0d9357..c9177d6fbf6 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -8,3 +8,4 @@ iwlwifi-fix-softirq-hardirq-disabling-in-iwl_pcie_enqueue_hcmd.patch mips-introduce-isa-rev.h-to-define-mips_isa_rev.patch mips-cpu-features.h-replace-__mips_isa_rev-with-mips_isa_rev.patch mips-do-not-include-hi-and-lo-in-clobber-list-for-r6.patch +bpf-fix-masking-negation-logic-upon-negative-dst-register.patch