Daniel Borkmann
7b5b73ea87
bpf: fix branch pruning logic ...
From: Alexei Starovoitov <ast@fb.com>
[ Upstream commit c131187db2d3fa2f8bf32fdf4e9a4ef805168467 ]
when the verifier detects that register contains a runtime constant
and it's compared with another constant it will prune exploration
of the branch that is guaranteed not to be taken at runtime.
This is all correct, but malicious program may be constructed
in such a way that it always has a constant comparison and
the other branch is never taken under any conditions.
In this case such path through the program will not be explored
by the verifier. It won't be taken at run-time either, but since
all instructions are JITed the malicious program may cause JITs
to complain about using reserved fields, etc.
To fix the issue we have to track the instructions explored by
the verifier and sanitize instructions that are dead at run time
with NOPs. We cannot reject such dead code, since llvm generates
it for valid C code, since it doesn't do as much data flow
analysis as the verifier does.
Fixes: 17a5267067
2017-12-25 14:23:47 +01:00
bpf: fix branch pruning logic
2017-12-25 14:23:47 +01:00
config: android: enable CONFIG_SECCOMP
2016-10-11 15:06:32 -07:00
kdb: Fix handling of kallsyms_symbol_next() return value
2017-12-14 09:28:13 +01:00
perf/x86/intel: Account interrupts for PEBS errors
2017-12-09 22:01:52 +01:00
gcov: support GCC 7.1
2017-09-02 07:07:53 +02:00
genirq: Make sparse_irq_lock protect what it should protect
2017-10-05 09:43:58 +02:00
livepatch/module: make TAINT_LIVEPATCH module-specific
2016-08-26 14:42:08 +02:00
locking/lockdep: Add nest_lock integrity test
2017-10-21 17:21:33 +02:00
sched/cpuset/pm: Fix cpuset vs. suspend-resume bugs
2017-10-12 11:51:25 +02:00
printk: use rcuidle console tracepoint
2017-02-23 17:44:36 +01:00
rcu: Allow for page faults in NMI handlers
2017-10-18 09:35:38 +02:00
sched/deadline: Use deadline instead of period when calculating overflow
2017-12-20 10:07:23 +01:00
hrtimer: Catch invalid clockids again
2017-10-21 17:21:38 +02:00
tracing: Exclude 'generic fields' from histograms
2017-12-25 14:23:44 +01:00
audit: ensure that 'audit=1' actually enables audit for PID 1
2017-12-16 16:25:47 +01:00
Merge branch 'stable-4.8' of git://git.infradead.org/users/pcmoore/audit
2016-07-29 17:54:17 -07:00
wrappers for ->i_mutex access
2016-01-22 18:04:28 -05:00
audit: cleanup prune_tree_thread
2016-04-04 09:46:47 -04:00
audit: Fix use after free in audit_remove_watch_rule()
2017-08-24 17:12:18 -07:00
audit: add fields to exclude filter by reusing user filter
2016-06-27 11:01:00 -04:00
Merge branch 'stable-4.9' of git://git.infradead.org/users/pcmoore/audit
2016-10-04 14:21:41 -07:00
ptrace: Capture the ptracer's creds not PT_PTRACE_CAP
2017-01-06 10:40:13 +01:00
cgroup: fix error return value from cgroup_subtree_control()
2017-08-11 08:49:28 -07:00
cgroup/pids: remove spurious suspicious RCU usage warning
2017-03-26 13:05:58 +02:00
smp/hotplug: Move step CPUHP_AP_SMPCFD_DYING to the correct place
2017-12-14 09:28:13 +01:00
sched/cpuset/pm: Fix cpuset vs. suspend-resume bugs
2017-10-12 11:51:25 +02:00
cred: Reject inodes with invalid ids in set_create_file_as()
2016-06-30 18:05:09 -05:00
kmemcg: account certain kmem allocations to memcg
2016-01-14 16:00:49 -08:00
sched/autogroup: Do not use autogroup->tg in zombie threads
2016-11-22 12:33:43 +01:00
kernel/extable.c: mark core_kernel_text notrace
2017-07-21 07:42:21 +02:00
mm, uprobes: fix multiple free of ->uprobes_state.xol_area
2017-09-07 08:35:39 +02:00
freezer, oom: check TIF_MEMDIE on the correct task
2016-07-28 16:07:41 -07:00
futex: Remove unnecessary warning from get_futex_key
2017-08-16 13:43:15 -07:00
ptrace: use fsuid, fsgid, effective creds for fs access checks
2016-01-20 17:09:18 -08:00
cred: simpler, 1D supplementary groups
2016-10-07 18:46:30 -07:00
hung_task: allow hung_task_panic when hung_task_warnings is 0
2016-10-11 15:06:33 -07:00
jump_label: Invoke jump_label_test() via early_initcall()
2017-12-14 09:28:24 +01:00
kallsyms: add support for relative offsets in kallsyms address table
2016-03-15 16:55:16 -07:00
ptrace: use fsuid, fsgid, effective creds for fs access checks
2016-01-20 17:09:18 -08:00
kcov: add missing #include <linux/sched.h>
2016-12-07 17:10:00 -08:00
kexec: allow architectures to override boot mapping
2016-08-02 19:35:27 -04:00
kexec: add restriction on kexec_load() segment sizes
2016-08-02 19:35:31 -04:00
kexec: fix double-free when failing to relocate the purgatory
2016-09-01 17:52:01 -07:00
kexec: move some memembers and definitions within the scope of CONFIG_KEXEC_FILE
2016-01-20 17:09:18 -08:00
tracing/kprobes: Enforce kprobes teardown after testing
2017-05-25 15:44:47 +02:00
kexec: add a kexec_crash_loaded() function
2016-08-02 19:35:30 -04:00
cgroup, kthread: close race window where new kthreads can be migrated to non-root cgroups
2017-04-21 09:31:18 +02:00
sched/debug: Make schedstats a runtime tunable that is disabled by default
2016-02-09 11:54:23 +01:00
kernel/watchdog.c: move hardlockup detector to separate file
2017-06-17 06:41:57 +02:00
Fix: Disable sys_membarrier when nohz_full is enabled
2017-03-12 06:41:45 +01:00
mm, devm_memremap_pages: hold device_hotplug lock over mem_hotplug_{begin, done}
2017-03-12 06:41:43 +01:00
Re-enable CONFIG_MODVERSIONS in a slightly weaker form
2016-11-29 16:01:30 -08:00
KEYS: Move the point of trust determination to __key_link()
2016-04-11 22:43:43 +01:00
cgroup: introduce cgroup namespaces
2016-02-16 13:04:58 -05:00
padata: free correct variable
2017-05-20 14:28:40 +02:00
kernel/panic.c: add missing \n
2017-07-05 14:40:24 +02:00
pids: make task_tgid_nr_ns() safe
2017-08-24 17:12:21 -07:00
pid_ns: Sleep in TASK_INTERRUPTIBLE in zap_pid_ns_processes
2017-05-25 15:44:38 +02:00
profile: Convert to hotplug state machine
2016-07-15 10:41:42 +02:00
ptrace: Properly initialize ptracer_cred on fork
2017-06-14 15:05:54 +02:00
relay: check array offset before using it
2017-01-12 11:39:30 +01:00
/proc/iomem: only expose physical resource addresses to privileged users
2016-04-14 12:56:09 -07:00
seccomp: fix the usage of get/put_seccomp_filter() in seccomp_get_filter()
2017-10-05 09:44:02 +02:00
signal: protect SIGNAL_UNKILLABLE from unintentional clearing.
2017-08-11 08:49:36 -07:00
smp: Allocate smp_call_on_cpu() workqueue on stack too
2016-09-22 14:49:10 +02:00
kthread/smpboot: do not park in kthread_create_on_cpu()
2016-10-11 15:06:33 -07:00
cpu/hotplug: Create hotplug threads
2016-03-01 20:36:56 +01:00
softirq: Display IRQ_POLL for irq-poll statistics
2016-10-21 15:45:47 -06:00
stacktrace, lockdep: Fix address, newline ugliness
2017-02-14 15:25:42 -08:00
Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2016-10-03 13:39:00 -07:00
prctl: make PR_SET_THP_DISABLE wait for mmap_sem killable
2016-05-23 17:04:14 -07:00
x86/pkeys: Fix pkeys build breakage for some non-x86 arches
2016-09-13 14:41:36 +02:00
timer/sysclt: Restrict timer migration sysctl values to 0 and 1
2017-10-05 09:44:04 +02:00
kernel/sysctl_binary.c: use generic UUID library
2016-05-20 17:58:30 -07:00
task_work: use READ_ONCE/lockless_dereference, avoid pi_lock if !task_works
2016-08-02 19:35:02 -04:00
taskstats: fix the length of cgroupstats_cmd_get_policy
2016-11-03 16:55:58 -04:00
torture: Convert torture_shutdown() to hrtimer
2016-08-22 10:01:49 -07:00
kernel/...: convert pr_warning to pr_warn
2016-03-22 15:36:02 -07:00
time, acct: Drop irq save & restore from __acct_update_integrals()
2016-02-29 09:53:09 +01:00
kernel/ucount.c: mark user_header with kmemleak_ignore()
2017-06-17 06:41:51 +02:00
cred: simpler, 1D supplementary groups
2016-10-07 18:46:30 -07:00
smp: Add function to execute a function synchronously on a CPU
2016-09-05 13:52:39 +02:00
Merge branch 'nsfs-ioctls' into HEAD
2016-09-22 20:00:36 -05:00
Merge branch 'nsfs-ioctls' into HEAD
2016-09-22 20:00:36 -05:00
kernel/watchdog: prevent false hardlockup on overloaded system
2017-06-17 06:41:57 +02:00
kernel/watchdog: prevent false hardlockup on overloaded system
2017-06-17 06:41:57 +02:00
workqueue: trigger WARN if queue_delayed_work() is called with NULL @wq
2017-12-14 09:28:19 +01:00
workqueue: Fix NULL pointer dereference
2017-11-15 15:53:17 +01:00
7b5b73ea87