On Mon, Nov 20, 2023 at 03:46:42PM +0100, Peter Zijlstra wrote: > Hi! > > There's a problem with FineIBT and eBPF using __nocfi when > CONFIG_BPF_JIT_ALWAYS_ON=n, in which case the __nocfi indirect call can target > a normal function like __bpf_prog_run32(). The lack (or partially broken) cfi in the kernel built with CONFIG_BPF_JIT_ALWAYS_ON=n is probably the last of people security concerns. We introduced CONFIG_BPF_JIT_ALWAYS_ON=y to remove the interpreter, since mere presence of _any_ interpreter in the kernel (bpf and any other) is an attack vector. As it was demonstrated during spectre days an interpreter sitting in executable part of vmlinux .text tremendously helps to craft a speculative execution exploit. Anyway, motivation aside, more comments in the patch 2... > Specifically the various preambles look like: > > FineIBT JIT > > __cfi_foo: > endbr64 > subl $hash, %r10d > jz 1f > ud2 > 1: nop > foo: foo: > osp nop3 endbr64 > ... ... > > So while bpf_dispatcher_*_func() does a __nocfi call to foo()+0 and this > matches what the JIT generates, it does not work for regular FineIBT functions, > since their +0 endbr got poisoned and things go *boom*. > > Cure this by teaching the BPF JIT about all the various CFI forms. Notably this > removes the last __nocfi call on x86. > > If the BPF folks agree (and the robots don't find fail) I'd like to take this > through the x86 tree, because I have a few more patches that turn the non-fatal > 'osp nop3' poison into a 4 byte ud1 instruction which is rather fatal. As a > result this problem will also surface on !IBT hardware. >
