On 01/22/2019 05:44 PM, David Miller wrote:
> From: Jann Horn <ja...@google.com>
> Date: Tue, 22 Jan 2019 15:36:54 +0100
>
>> On Thu, Jan 3, 2019 at 1:08 AM Alexei Starovoitov
>> <alexei.starovoi...@gmail.com> wrote:
>>> On Thu, Jan 03, 2019 at 12:58:26AM +0100, Daniel Borkmann wrote:
>>>> This set fixes an out of bounds case under speculative execution
>>>> by implementing masking of pointer alu into the verifier. For
>>>> details please see the individual patches.
>>>>
>>>> Thanks!
>>>>
>>>> v2 -> v3:
>>>> - 8/9: change states_equal condition into old->speculative &&
>>>> !cur->speculative, thanks Jakub!
>>>> - 8/9: remove incorrect speculative state test in
>>>> propagate_liveness(), thanks Jakub!
>>>> v1 -> v2:
>>>> - Typo fixes in commit msg and a comment, thanks David!
>>>
>>> Applied, Thanks
>>
>> This series and the followup fix ("bpf: fix sanitation of alu op with
>> pointer / scalar type from different paths") have been in Linus' tree
>> for six days, but from what I can tell, they aren't queued up for
>> stable yet.
>>
>> @davem: Are you going to send this through stable, or is this only
>> going to be in 5.0?
>
> The BPF developers handle their -stable submissions.
Will get this to stable towards end of week. We wanted to let this sit
for a while in Linus' tree given the complexity of the fix to get some
more coverage. We also need 9d5564ddcf2a ("bpf: fix inner map masking
to prevent oob under speculation") in addition.
Thanks,
Daniel
