)]}'
{
  "commit": "b7137c4eab85c1cf3d46acdde90ce1163b28c873",
  "tree": "4005fca9ca55a25752eb774062aea14553fc0cba",
  "parents": [
    "9d7eceede769f90b66cfa06ad5b357140d5141ed"
  ],
  "author": {
    "name": "Daniel Borkmann",
    "email": "daniel@iogearbox.net",
    "time": "Thu Jan 03 00:58:33 2019 +0100"
  },
  "committer": {
    "name": "Alexei Starovoitov",
    "email": "ast@kernel.org",
    "time": "Wed Jan 02 16:01:24 2019 -0800"
  },
  "message": "bpf: fix check_map_access smin_value test when pointer contains offset\n\nIn check_map_access() we probe actual bounds through __check_map_access()\nwith offset of reg-\u003esmin_value + off for lower bound and offset of\nreg-\u003eumax_value + off for the upper bound. However, even though the\nreg-\u003esmin_value could have a negative value, the final result of the\nsum with off could be positive when pointer arithmetic with known and\nunknown scalars is combined. In this case we reject the program with\nan error such as \"R\u003cx\u003e min value is negative, either use unsigned index\nor do a if (index \u003e\u003d0) check.\" even though the access itself would be\nfine. Therefore extend the check to probe whether the actual resulting\nreg-\u003esmin_value + off is less than zero.\n\nSigned-off-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\nAcked-by: Alexei Starovoitov \u003cast@kernel.org\u003e\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "eebbc03e5af2f15407d568568225657b7095bb65",
      "old_mode": 33188,
      "old_path": "kernel/bpf/verifier.c",
      "new_id": "8e5da1ce5da454f48734df09e96d53278f242568",
      "new_mode": 33188,
      "new_path": "kernel/bpf/verifier.c"
    }
  ]
}