| Message ID | 20220309123321.2400262-1-houtao1@huawei.com (mailing list archive) |
|---|---|
| Headers | show |
| Series | fixes for bpf_jit_harden race | expand |
Hello: This series was applied to bpf/bpf-next.git (master) by Alexei Starovoitov <ast@kernel.org>: On Wed, 9 Mar 2022 20:33:17 +0800 you wrote: > Hi, > > Now bpf_jit_harden will be tested twice for each subprog if there are > subprogs in bpf program and constant blinding may increase the length of > program, so when running "./test_progs -t subprogs" and toggling > bpf_jit_harden between 0 and 2, extra pass in bpf_int_jit_compile() may > fail because constant blinding increases the length of subprog and > the length is mismatched with the first pass. > > [...] Here is the summary with links: - [bpf-next,1/4] bpf, x86: Fall back to interpreter mode when extra pass fails https://git.kernel.org/bpf/bpf-next/c/73e14451f39e - [bpf-next,2/4] bpf: Introduce bpf_int_jit_abort() (no matching commit) - [bpf-next,3/4] bpf: Fix net.core.bpf_jit_harden race https://git.kernel.org/bpf/bpf-next/c/d2a3b7c5becc - [bpf-next,4/4] selftests/bpf: Test subprog jit when toggle bpf_jit_harden repeatedly https://git.kernel.org/bpf/bpf-next/c/ad13baf45691 You are awesome, thank you!
Hi, Now bpf_jit_harden will be tested twice for each subprog if there are subprogs in bpf program and constant blinding may increase the length of program, so when running "./test_progs -t subprogs" and toggling bpf_jit_harden between 0 and 2, extra pass in bpf_int_jit_compile() may fail because constant blinding increases the length of subprog and the length is mismatched with the first pass. The failure uncovers several issues in error handling of jit_subprogs() and bpf_int_jit_compile(): (1) jit_subprogs() continues even when extra pass for one subprogs fails It may leads to oops during to UAF. Fixed in patch #1. (2) jit_subprogs() doesn't do proper cleanup for other subprogs which have not went through the extra pass. It will lead to oops and memory leak. Fixed in patch #2. Other arch JIT may have the same problem, and will fix later if the proposed fix for x86-64 is accepted. (3) bpf_int_jit_compile() may fail due to inconsistent twice read values from bpf_jit_harden Fixed in patch #3 by caching the value of bpf_jit_blinding_enabled(). Patch #4 just adds a test to ensure these problem are fixed. Comments and suggestions are welcome. Regards, Tao Hou Tao (4): bpf, x86: Fall back to interpreter mode when extra pass fails bpf: Introduce bpf_int_jit_abort() bpf: Fix net.core.bpf_jit_harden race selftests/bpf: Test subprog jit when toggle bpf_jit_harden repeatedly arch/x86/net/bpf_jit_comp.c | 35 ++++++++- include/linux/filter.h | 2 + kernel/bpf/core.c | 12 ++- kernel/bpf/verifier.c | 8 +- .../selftests/bpf/prog_tests/subprogs.c | 77 ++++++++++++++++--- 5 files changed, 120 insertions(+), 14 deletions(-)