Revert "bpf: fix incorrect sign extension in check_alu_op()"

BugLink: http://bugs.launchpad.net/bugs/1764666
CVE-2017-16995

This reverts commit 04e1c8db to be
replaced by its upstream version in 4.4.123.
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>

kernel/bpf/verifier.c

@@ -142,7 +142,7 @@ struct reg_state {
 	enum bpf_reg_type type;
 	union {
 		/* valid when type == CONST_IMM | PTR_TO_STACK */
-		s64 imm;
+		int imm;
 
 		/* valid when type == CONST_PTR_TO_MAP | PTR_TO_MAP_VALUE |
 		 *   PTR_TO_MAP_VALUE_OR_NULL
@@ -259,7 +259,7 @@ static void print_verifier_state(struct verifier_env *env)
 			continue;
 		verbose(" R%d=%s", i, reg_type_str[t]);
 		if (t == CONST_IMM || t == PTR_TO_STACK)
-			verbose("%lld", env->cur_state.regs[i].imm);
+			verbose("%d", env->cur_state.regs[i].imm);
 		else if (t == CONST_PTR_TO_MAP || t == PTR_TO_MAP_VALUE ||
 			 t == PTR_TO_MAP_VALUE_OR_NULL)
 			verbose("(ks=%d,vs=%d)",
@@ -487,6 +487,7 @@ static void init_reg_state(struct reg_state *regs)
 	for (i = 0; i < MAX_BPF_REG; i++) {
 		regs[i].type = NOT_INIT;
 		regs[i].imm = 0;
+		regs[i].map_ptr = NULL;
 	}
 
 	/* frame pointer */
@@ -501,6 +502,7 @@ static void mark_reg_unknown_value(struct reg_state *regs, u32 regno)
 	BUG_ON(regno >= MAX_BPF_REG);
 	regs[regno].type = UNKNOWN_VALUE;
 	regs[regno].imm = 0;
+	regs[regno].map_ptr = NULL;
 }
 
 enum reg_arg_type {
@@ -755,15 +757,6 @@ static int check_mem_access(struct verifier_env *env, u32 regno, int off,
 			regno, reg_type_str[state->regs[regno].type]);
 		return -EACCES;
 	}
-
-	if (!err && size <= 2 && value_regno >= 0 && env->allow_ptr_leaks &&
-	    state->regs[value_regno].type == UNKNOWN_VALUE) {
-		/* 1 or 2 byte load zero-extends, determine the number of
-		 * zero upper bits. Not doing it fo 4 byte load, since
-		 * such values cannot be added to ptr_to_packet anyway.
-		 */
-		state->regs[value_regno].imm = 64 - size * 8;
-	}
 	return err;
 }
 
@@ -1146,15 +1139,8 @@ static int check_alu_op(struct verifier_env *env, struct bpf_insn *insn)
 			/* case: R = imm
 			 * remember the value we stored into this reg
 			 */
-			u64 imm;
-
-			if (BPF_CLASS(insn->code) == BPF_ALU64)
-				imm = insn->imm;
-			else
-				imm = (u32)insn->imm;
-
 			regs[insn->dst_reg].type = CONST_IMM;
-			regs[insn->dst_reg].imm = imm;
+			regs[insn->dst_reg].imm = insn->imm;
 		}
 
 	} else if (opcode > BPF_END) {