Re: [PATCH bpf] bpf: properly enforce index mask to prevent out-of-bounds speculation

2018-05-24 Thread Alexei Starovoitov
On Thu, May 24, 2018 at 02:32:53AM +0200, Daniel Borkmann wrote: > While reviewing the verifier code, I recently noticed that the > following two program variants in relation to tail calls can be > loaded. > > Fixes: b2157399cc98 ("bpf: prevent out-of-bounds speculation") > Signed-off-by: Daniel B

[PATCH bpf] bpf: properly enforce index mask to prevent out-of-bounds speculation

2018-05-23 Thread Daniel Borkmann
While reviewing the verifier code, I recently noticed that the following two program variants in relation to tail calls can be loaded. Variant 1: # bpftool p d x i 15 0: (15) if r1 == 0x0 goto pc+3 1: (18) r2 = map[id:5] 3: (05) goto pc+2 4: (18) r2 = map[id:6] 6: (b7) r3 =