Daniel Borkmann 80f1d68ccb ebpf: verifier: check that call reg with ARG_ANYTHING is initialized ... I noticed that a helper function with argument type ARG_ANYTHING does not need to have an initialized value (register). This can worst case lead to unintented stack memory leakage in future helper functions if they are not carefully designed, or unintended application behaviour in case the application developer was not careful enough to match a correct helper function signature in the API. The underlying issue is that ARG_ANYTHING should actually be split into two different semantics: 1) ARG_DONTCARE for function arguments that the helper function does not care about (in other words: the default for unused function arguments), and 2) ARG_ANYTHING that is an argument actually being used by a helper function and *guaranteed* to be an initialized register. The current risk is low: ARG_ANYTHING is only used for the 'flags' argument (r4) in bpf_map_update_elem() that internally does strict checking. Fixes: 17a5267067 ("bpf: verifier (add verifier core)") Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Alexei Starovoitov <ast@plumgrid.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2015-03-12 15:29:31 -04:00
..
arraymap.c	ebpf: constify various function pointer structs	2015-03-01 14:05:18 -05:00
core.c	ebpf: bpf_map_*: fix linker error on avr32 and openrisc arch	2015-03-06 21:50:55 -05:00
hashtab.c	ebpf: constify various function pointer structs	2015-03-01 14:05:18 -05:00
helpers.c	ebpf: constify various function pointer structs	2015-03-01 14:05:18 -05:00
Makefile	ebpf: remove kernel test stubs	2015-03-01 14:05:18 -05:00
syscall.c	cls_bpf: add initial eBPF support for programmable classifiers	2015-03-01 14:05:19 -05:00
verifier.c	ebpf: verifier: check that call reg with ARG_ANYTHING is initialized	2015-03-12 15:29:31 -04:00