On Sat, Dec 23, 2017 at 02:26:17AM +0000, Ben Hutchings wrote: > An UNKNOWN_VALUE is not supposed to be derived from a pointer, unless > pointer leaks are allowed. Therefore, states_equal() must not treat > a state with a pointer in a register as "equal" to a state with an > UNKNOWN_VALUE in that register. > > This was fixed differently upstream, but the code around here was > largely rewritten in 4.14 by commit f1174f77b50c "bpf/verifier: rework > value tracking". The bug can be detected by the bpf/verifier sub-test > "pointer/scalar confusion in state equality check (way 1)". > > Signed-off-by: Ben Hutchings <b...@decadent.org.uk> > Cc: Edward Cree <ec...@solarflare.com> > Cc: Jann Horn <ja...@google.com> > Cc: Alexei Starovoitov <a...@kernel.org>
Acked-by: Alexei Starovoitov <a...@kernel.org>
