| Message ID | 20160914072415.26021-5-mic@digikod.net (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On 09/14/16 at 09:23am, Mickaël Salaün wrote: > This fix a pointer leak when an unprivileged eBPF program read a pointer > value from the context. Even if is_valid_access() returns a pointer > type, the eBPF verifier replace it with UNKNOWN_VALUE. The register > value containing an address is then allowed to leak. Moreover, this > prevented unprivileged eBPF programs to use functions with (legitimate) > pointer arguments. > > This bug was not a problem until now because the only unprivileged eBPF > program allowed is of type BPF_PROG_TYPE_SOCKET_FILTER and all the types > from its context are UNKNOWN_VALUE. > > Signed-off-by: Mickaël Salaün <mic@digikod.net> > Fixes: 969bf05eb3ce ("bpf: direct packet access") > Cc: Alexei Starovoitov <ast@kernel.org> > Cc: Daniel Borkmann <daniel@iogearbox.net> Can you post this fix separately? It's valid and needed outside of the scope of this series. -- To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On 10/19/2016 04:54 PM, Thomas Graf wrote: > On 09/14/16 at 09:23am, Mickaël Salaün wrote: >> This fix a pointer leak when an unprivileged eBPF program read a pointer >> value from the context. Even if is_valid_access() returns a pointer >> type, the eBPF verifier replace it with UNKNOWN_VALUE. The register >> value containing an address is then allowed to leak. Moreover, this >> prevented unprivileged eBPF programs to use functions with (legitimate) >> pointer arguments. >> >> This bug was not a problem until now because the only unprivileged eBPF >> program allowed is of type BPF_PROG_TYPE_SOCKET_FILTER and all the types >> from its context are UNKNOWN_VALUE. >> >> Signed-off-by: Mickaël Salaün <mic@digikod.net> >> Fixes: 969bf05eb3ce ("bpf: direct packet access") >> Cc: Alexei Starovoitov <ast@kernel.org> >> Cc: Daniel Borkmann <daniel@iogearbox.net> > > Can you post this fix separately? It's valid and needed outside of the > scope of this series. Yes, that one was already merged: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1955351da41caa1dbf4139191358fed84909d64b -- To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index c0c4a92dae8c..608cbffb0e86 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -794,10 +794,8 @@ static int check_mem_access(struct verifier_env *env, u32 regno, int off, } err = check_ctx_access(env, off, size, t, ®_type); if (!err && t == BPF_READ && value_regno >= 0) { - mark_reg_unknown_value(state->regs, value_regno); - if (env->allow_ptr_leaks) - /* note that reg.[id|off|range] == 0 */ - state->regs[value_regno].type = reg_type; + /* note that reg.[id|off|range] == 0 */ + state->regs[value_regno].type = reg_type; } } else if (reg->type == FRAME_PTR || reg->type == PTR_TO_STACK) {
This fix a pointer leak when an unprivileged eBPF program read a pointer value from the context. Even if is_valid_access() returns a pointer type, the eBPF verifier replace it with UNKNOWN_VALUE. The register value containing an address is then allowed to leak. Moreover, this prevented unprivileged eBPF programs to use functions with (legitimate) pointer arguments. This bug was not a problem until now because the only unprivileged eBPF program allowed is of type BPF_PROG_TYPE_SOCKET_FILTER and all the types from its context are UNKNOWN_VALUE. Signed-off-by: Mickaël Salaün <mic@digikod.net> Fixes: 969bf05eb3ce ("bpf: direct packet access") Cc: Alexei Starovoitov <ast@kernel.org> Cc: Daniel Borkmann <daniel@iogearbox.net> --- kernel/bpf/verifier.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-)