On Thu, Nov 01, 2018 at 10:29:53PM +0100, Daniel Borkmann wrote:
commit 0962590e553331db2cc0aef2dc35c57f6300dbbe upstream.
ALU operations on pointers such as scalar_reg += map_value_ptr are handled in adjust_ptr_min_max_vals(). Problem is however that map_ptr and range in the register state share a union, so transferring state through dst_reg->range = ptr_reg->range is just buggy as any new map_ptr in the dst_reg is then truncated (or null) for subsequent checks. Fix this by adding a raw member and use it for copying state over to dst_reg.
Fixes: f1174f77b50c ("bpf/verifier: rework value tracking") Signed-off-by: Daniel Borkmann daniel@iogearbox.net Cc: Edward Cree ecree@solarflare.com Acked-by: Alexei Starovoitov ast@kernel.org Signed-off-by: Alexei Starovoitov ast@kernel.org Acked-by: Edward Cree ecree@solarflare.com
Queued this and the other patch to their respective trees, thank you!
-- Thanks, Sasha