Patch "net: bpf: reject invalid shifts" has been added to the 4.1-stable tree

This is a note to let you know that I've just added the patch titled

net: bpf: reject invalid shifts

to the 4.1-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
net-bpf-reject-invalid-shifts.patch
and it can be found in the queue-4.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Rabin Vincent <[email protected]>
Date: Tue, 12 Jan 2016 20:17:08 +0100
Subject: net: bpf: reject invalid shifts

From: Rabin Vincent <[email protected]>

[ Upstream commit 229394e8e62a4191d592842cf67e80c62a492937 ]

On ARM64, a BUG() is triggered in the eBPF JIT if a filter with a constant shift that can't be encoded in the immediate field of the UBFM/SBFM instructions is passed to the JIT. Since these shifts amounts, which are negative or >= regsize, are invalid, reject them in the eBPF verifier and the classic BPF filter checker, for all architectures.

---
 kernel/bpf/verifier.c |   10 ++++++++++
 net/core/filter.c     |    5 +++++
 2 files changed, 15 insertions(+)

@@ -1019,6 +1019,16 @@ static int check_alu_op(struct reg_state
 			return -EINVAL;
 		}
 
+		if ((opcode == BPF_LSH || opcode == BPF_RSH ||
+		     opcode == BPF_ARSH) && BPF_SRC(insn->code) == BPF_K) {
+			int size = BPF_CLASS(insn->code) == BPF_ALU64 ? 64 : 32;
+
+			if (insn->imm < 0 || insn->imm >= size) {
+				verbose("invalid shift %d\n", insn->imm);
+				return -EINVAL;
+			}
+		}
+
 		/* pattern match 'bpf_add Rx, imm' instruction */
 		if (opcode == BPF_ADD && BPF_CLASS(insn->code) == BPF_ALU64 &&
 		    regs[insn->dst_reg].type == FRAME_PTR &&

@@ -775,6 +775,11 @@ int bpf_check_classic(const struct sock_
 			if (ftest->k == 0)
 				return -EINVAL;
 			break;
+		case BPF_ALU | BPF_LSH | BPF_K:
+		case BPF_ALU | BPF_RSH | BPF_K:
+			if (ftest->k >= 32)
+				return -EINVAL;
+			break;
 		case BPF_LD | BPF_MEM:
 		case BPF_LDX | BPF_MEM:
 		case BPF_ST:

Patches currently in stable-queue which might be from [email protected] are

queue-4.1/net-filter-make-jits-zero-a-for-skf_ad_alu_xor_x.patch queue-4.1/net-bpf-reject-invalid-shifts.patch