diff options
| author | Wolfram Sang <wsa@the-dreams.de> | 2018-10-12 00:07:30 +0300 |
|---|---|---|
| committer | Wolfram Sang <wsa@the-dreams.de> | 2018-10-12 00:07:30 +0300 |
| commit | 90fb814b6c025da45f71db1703cffe3fe87f575c (patch) | |
| tree | 5fd739d407654df6f9d6e82900a45e027dd8b9f0 /kernel/bpf/verifier.c | |
| parent | b30f2f65568f840e5ca522d98ba2ad73b8f59cde (diff) | |
| parent | 0238df646e6224016a45505d2c111a24669ebe21 (diff) | |
| download | linux-90fb814b6c025da45f71db1703cffe3fe87f575c.tar.xz | |
Merge tag 'v4.19-rc7' into i2c/for-4.20
This is the 4.19-rc7 release
Diffstat (limited to 'kernel/bpf/verifier.c')
| -rw-r--r-- | kernel/bpf/verifier.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index bb07e74b34a2..465952a8e465 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -2896,6 +2896,15 @@ static int adjust_scalar_min_max_vals(struct bpf_verifier_env *env, u64 umin_val, umax_val; u64 insn_bitness = (BPF_CLASS(insn->code) == BPF_ALU64) ? 64 : 32; + if (insn_bitness == 32) { + /* Relevant for 32-bit RSH: Information can propagate towards + * LSB, so it isn't sufficient to only truncate the output to + * 32 bits. + */ + coerce_reg_to_size(dst_reg, 4); + coerce_reg_to_size(&src_reg, 4); + } + smin_val = src_reg.smin_value; smax_val = src_reg.smax_value; umin_val = src_reg.umin_value; @@ -3131,7 +3140,6 @@ static int adjust_scalar_min_max_vals(struct bpf_verifier_env *env, if (BPF_CLASS(insn->code) != BPF_ALU64) { /* 32-bit ALU ops are (32,32)->32 */ coerce_reg_to_size(dst_reg, 4); - coerce_reg_to_size(&src_reg, 4); } __reg_deduce_bounds(dst_reg); |