Signed-off-by: Bruce Allan <email address hidden>
Signed-off-by: Tony Nguyen <email address hidden>
Tested-by: Andrew Bowers <email address hidden>
Signed-off-by: Jeff Kirsher <email address hidden>
(cherry picked from commit 195fb97766da1b41b4d49bccc37e13603bcb49cc)
Signed-off-by: Michael Reed <email address hidden>
bpf: No need to simulate speculative domain for immediates
In 801c6058d14a ("bpf: Fix leakage of uninitialized bpf stack under
speculation") we replaced masking logic with direct loads of immediates
if the register is a known constant. Given in this case we do not apply
any masking, there is also no reason for the operation to be truncated
under the speculative domain.
Therefore, there is also zero reason for the verifier to branch-off and
simulate this case, it only needs to do it for unknown but bounded scalars.
As a side-effect, this also enables few test cases that were previously
rejected due to simulation under zero truncation.
Signed-off-by: Daniel Borkmann <email address hidden>
Reviewed-by: Piotr Krysiuk <email address hidden>
Acked-by: Alexei Starovoitov <email address hidden>
(cherry picked from commit a7036191277f9fa68d92f2071ddc38c09b1e5ee5)
CVE-2021-33200
Signed-off-by: Thadeu Lima de Souza Cascardo <email address hidden>
Acked-by: Ian May <email address hidden>
Acked-by: Tim Gardner <email address hidden>
Signed-off-by: Kelsey Skunberg <email address hidden>
bpf: Fix mask direction swap upon off reg sign change
Masking direction as indicated via mask_to_left is considered to be
calculated once and then used to derive pointer limits. Thus, this
needs to be placed into bpf_sanitize_info instead so we can pass it
to sanitize_ptr_alu() call after the pointer move. Piotr noticed a
corner case where the off reg causes masking direction change which
then results in an incorrect final aux->alu_limit.
Fixes: 7fedb63a8307 ("bpf: Tighten speculative pointer arithmetic mask")
Reported-by: Piotr Krysiuk <email address hidden>
Signed-off-by: Daniel Borkmann <email address hidden>
Reviewed-by: Piotr Krysiuk <email address hidden>
Acked-by: Alexei Starovoitov <email address hidden>
(cherry picked from commit bb01a1bba579b4b1c5566af24d95f1767859771e)
CVE-2021-33200
Signed-off-by: Thadeu Lima de Souza Cascardo <email address hidden>
Acked-by: Ian May <email address hidden>
Acked-by: Tim Gardner <email address hidden>
Signed-off-by: Kelsey Skunberg <email address hidden>
bpf: Wrap aux data inside bpf_sanitize_info container
Add a container structure struct bpf_sanitize_info which holds
the current aux info, and update call-sites to sanitize_ptr_alu()
to pass it in. This is needed for passing in additional state
later on.
Signed-off-by: Daniel Borkmann <email address hidden>
Reviewed-by: Piotr Krysiuk <email address hidden>
Acked-by: Alexei Starovoitov <email address hidden>
(cherry picked from commit 3d0220f6861d713213b015b582e9f21e5b28d2e0)
CVE-2021-33200
Signed-off-by: Thadeu Lima de Souza Cascardo <email address hidden>
Acked-by: Ian May <email address hidden>
Acked-by: Tim Gardner <email address hidden>
Signed-off-by: Kelsey Skunberg <email address hidden>
On the Realtek high-speed Hub(0bda:5487), the port which has wakeup
enabled_descendants will sometimes timeout when setting PORT_SUSPEND
feature. After checking the PORT_SUSPEND bit in wPortStatus, it is
already set which means the port has been suspended. We should treat
it suspended to make sure it will be resumed correctly.
Acked-by: Alan Stern <email address hidden>
Signed-off-by: Chris Chiu <email address hidden>
Link: https://<email address hidden>
Signed-off-by: Greg Kroah-Hartman <email address hidden>
(cherry picked from commit 7142452387c72207f34683382b04f38499da58f7 linux-next)
Signed-off-by: Chris Chiu <email address hidden>
Acked-by: Krzysztof Kozlowski <email address hidden>
Acked-by: Kleber Sacilotto de Souza <email address hidden>
Signed-off-by: Kleber Sacilotto de Souza <email address hidden>
