From: Alexei Starovoitov <[email protected]>
Date: Wed, 15 Apr 2015 16:19:33 -0700
> 1.
> first bug is a silly mistake. It broke tracing examples and prevented
> simple bpf programs from loading.
...
> 2.
> second bug is more subtle.
> If malicious code is using the same dest register as source register,
> the checks designed to prevent the same instruction to be used with different
> pointer types will fail to trigger, since we were assigning src_reg_type
> when it was already overwritten by check_mem_access().
> The fix is trivial. Just move line:
> src_reg_type = regs[insn->src_reg].type;
> before check_mem_access().
> Add new 'access skb fields bad4' test to check this case.
>
> Fixes: 9bac3d6d548e ("bpf: allow extended BPF programs access skb fields")
> Signed-off-by: Alexei Starovoitov <[email protected]>
Applied, thank you.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
