V5: https://lore.kernel.org/bpf/20240324185356.59111-1-puranjay12@xxxxxxxxx/ Changes in V6: - Disable the verifier's instrumentation in x86-64 and update the JIT to take care of vsyscall page in addition to userspace addresses. - Update bpf_testmod to test for vsyscall addresses. V4: https://lore.kernel.org/bpf/20240321124640.8870-1-puranjay12@xxxxxxxxx/ Changes in V5: - Use TASK_SIZE_MAX + PAGE_SIZE, VSYSCALL_ADDR as userspace boundary in x86-64 JIT. - Added Acked-by: Ilya Leoshkevich <iii@xxxxxxxxxxxxx> V3: https://lore.kernel.org/bpf/20240321120842.78983-1-puranjay12@xxxxxxxxx/ Changes in V4: - Disable this feature on architectures that don't define CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE. - By doing the above, we don't need anything explicitly for s390x. V2: https://lore.kernel.org/bpf/20240321101058.68530-1-puranjay12@xxxxxxxxx/ Changes in V3: - Return 0 from bpf_arch_uaddress_limit() in disabled case because it returns u64. - Modify the check in verifier to no do instrumentation when uaddress_limit is 0. V1: https://lore.kernel.org/bpf/20240320105436.4781-1-puranjay12@xxxxxxxxx/ Changes in V2: - Disable this feature on s390x. With BPF_PROBE_MEM, BPF allows de-referencing an untrusted pointer. To thwart invalid memory accesses, the JITs add an exception table entry for all such accesses. But in case the src_reg + offset is a userspace address, the BPF program might read that memory if the user has mapped it. x86-64 JIT already instruments the BPF_PROBE_MEM based loads with checks to skip loads from userspace addresses, but is doesn't check for vsyscall page because it falls in the kernel address space but is considered a userspace page. The second patch in this series fixes the x86-64 JIT to also skip loads from the vsyscall page. The last patch updates the bpf_testmod so this address can be checked as part of the selftests. Other architectures don't have the complexity of the vsyscall address and just need to skip loads from the userspace. To make this more scalable and robust, the verifier is updated in the first patch to instrument BPF_PROBE_MEM to skip loads from the userspace addresses. Puranjay Mohan (3): bpf: verifier: prevent userspace memory access bpf, x86: Fix PROBE_MEM runtime load check selftests/bpf: Test PROBE_MEM of VSYSCALL_ADDR on x86-64 arch/x86/net/bpf_jit_comp.c | 63 +++++++++---------- include/linux/filter.h | 1 + kernel/bpf/core.c | 9 +++ kernel/bpf/verifier.c | 30 +++++++++ .../selftests/bpf/bpf_testmod/bpf_testmod.c | 3 + 5 files changed, 74 insertions(+), 32 deletions(-) -- 2.40.1
