From: Jakub Sitnicki <jakub@cloudflare•com>
To: Daniel Borkmann <daniel@iogearbox•net>
Cc: ast@fb•com, afabre@cloudflare•com, marek@cloudflare•com,
bpf@vger•kernel.org, netdev@vger•kernel.org
Subject: Re: [PATCH bpf] bpf: fix sanitation rewrite in case of non-pointers
Date: Tue, 05 Mar 2019 15:12:27 +0100 [thread overview]
Message-ID: <87lg1tz9ys.fsf@cloudflare.com> (raw)
In-Reply-To: <20190301210529.8218-1-daniel@iogearbox.net>
On Fri, Mar 01, 2019 at 10:05 PM CET, Daniel Borkmann wrote:
> Marek reported that he saw an issue with the below snippet in that
> timing measurements where off when loaded as unpriv while results
> were reasonable when loaded as privileged:
>
> [...]
> uint64_t a = bpf_ktime_get_ns();
> uint64_t b = bpf_ktime_get_ns();
> uint64_t delta = b - a;
> if ((int64_t)delta > 0) {
> [...]
>
> Turns out there is a bug where a corner case is missing in the fix
> d3bd7413e0ca ("bpf: fix sanitation of alu op with pointer / scalar
> type from different paths"), namely fixup_bpf_calls() only checks
> whether aux has a non-zero alu_state, but it also needs to test for
> the case of BPF_ALU_NON_POINTER since in both occasions we need to
> skip the masking rewrite (as there is nothing to mask).
>
> Fixes: d3bd7413e0ca ("bpf: fix sanitation of alu op with pointer / scalar type from different paths")
> Reported-by: Marek Majkowski <marek@cloudflare•com>
> Reported-by: Arthur Fabre <afabre@cloudflare•com>
> Signed-off-by: Daniel Borkmann <daniel@iogearbox•net>
> Link: https://lore.kernel.org/netdev/CAJPywTJqP34cK20iLM5YmUMz9KXQOdu1-+BZrGMAGgLuBWz7fg@mail.gmail.com/T/
> ---
Could you please queue it for -stable which has d3bd7413e0ca ("bpf: fix
sanitation of alu op with pointer / scalar type from different paths")?
Thanks,
Jakub
next prev parent reply other threads:[~2019-03-05 14:12 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-03-01 21:05 [PATCH bpf] bpf: fix sanitation rewrite in case of non-pointers Daniel Borkmann
2019-03-01 23:18 ` Song Liu
2019-03-01 23:22 ` Daniel Borkmann
2019-03-01 23:42 ` Song Liu
2019-03-02 5:30 ` Alexei Starovoitov
2019-03-02 10:11 ` Sergei Shtylyov
2019-03-05 14:12 ` Jakub Sitnicki [this message]
2019-03-05 14:30 ` Daniel Borkmann
2019-03-06 8:59 ` Jakub Sitnicki
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87lg1tz9ys.fsf@cloudflare.com \
--to=jakub@cloudflare$(echo .)com \
--cc=afabre@cloudflare$(echo .)com \
--cc=ast@fb$(echo .)com \
--cc=bpf@vger$(echo .)kernel.org \
--cc=daniel@iogearbox$(echo .)net \
--cc=marek@cloudflare$(echo .)com \
--cc=netdev@vger$(echo .)kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox