Patch "bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS" has been added to the 6.1-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS

to the 6.1-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     bpf-reject-variable-offset-alu-on-ptr_to_flow_keys.patch
and it can be found in the queue-6.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 188da699fdbdc32ddeeadd2f7b4184f6c4bfb315
Author: Hao Sun <sunhao.th@xxxxxxxxx>
Date:   Mon Jan 15 09:20:27 2024 +0100

    bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS
    
    [ Upstream commit 22c7fa171a02d310e3a3f6ed46a698ca8a0060ed ]
    
    For PTR_TO_FLOW_KEYS, check_flow_keys_access() only uses fixed off
    for validation. However, variable offset ptr alu is not prohibited
    for this ptr kind. So the variable offset is not checked.
    
    The following prog is accepted:
    
      func#0 @0
      0: R1=ctx() R10=fp0
      0: (bf) r6 = r1                       ; R1=ctx() R6_w=ctx()
      1: (79) r7 = *(u64 *)(r6 +144)        ; R6_w=ctx() R7_w=flow_keys()
      2: (b7) r8 = 1024                     ; R8_w=1024
      3: (37) r8 /= 1                       ; R8_w=scalar()
      4: (57) r8 &= 1024                    ; R8_w=scalar(smin=smin32=0,
      smax=umax=smax32=umax32=1024,var_off=(0x0; 0x400))
      5: (0f) r7 += r8
      mark_precise: frame0: last_idx 5 first_idx 0 subseq_idx -1
      mark_precise: frame0: regs=r8 stack= before 4: (57) r8 &= 1024
      mark_precise: frame0: regs=r8 stack= before 3: (37) r8 /= 1
      mark_precise: frame0: regs=r8 stack= before 2: (b7) r8 = 1024
      6: R7_w=flow_keys(smin=smin32=0,smax=umax=smax32=umax32=1024,var_off
      =(0x0; 0x400)) R8_w=scalar(smin=smin32=0,smax=umax=smax32=umax32=1024,
      var_off=(0x0; 0x400))
      6: (79) r0 = *(u64 *)(r7 +0)          ; R0_w=scalar()
      7: (95) exit
    
    This prog loads flow_keys to r7, and adds the variable offset r8
    to r7, and finally causes out-of-bounds access:
    
      BUG: unable to handle page fault for address: ffffc90014c80038
      [...]
      Call Trace:
       <TASK>
       bpf_dispatcher_nop_func include/linux/bpf.h:1231 [inline]
       __bpf_prog_run include/linux/filter.h:651 [inline]
       bpf_prog_run include/linux/filter.h:658 [inline]
       bpf_prog_run_pin_on_cpu include/linux/filter.h:675 [inline]
       bpf_flow_dissect+0x15f/0x350 net/core/flow_dissector.c:991
       bpf_prog_test_run_flow_dissector+0x39d/0x620 net/bpf/test_run.c:1359
       bpf_prog_test_run kernel/bpf/syscall.c:4107 [inline]
       __sys_bpf+0xf8f/0x4560 kernel/bpf/syscall.c:5475
       __do_sys_bpf kernel/bpf/syscall.c:5561 [inline]
       __se_sys_bpf kernel/bpf/syscall.c:5559 [inline]
       __x64_sys_bpf+0x73/0xb0 kernel/bpf/syscall.c:5559
       do_syscall_x64 arch/x86/entry/common.c:52 [inline]
       do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:83
       entry_SYSCALL_64_after_hwframe+0x63/0x6b
    
    Fix this by rejecting ptr alu with variable offset on flow_keys.
    Applying the patch rejects the program with "R7 pointer arithmetic
    on flow_keys prohibited".
    
    Fixes: d58e468b1112 ("flow_dissector: implements flow dissector BPF hook")
    Signed-off-by: Hao Sun <sunhao.th@xxxxxxxxx>
    Signed-off-by: Daniel Borkmann <daniel@xxxxxxxxxxxxx>
    Acked-by: Yonghong Song <yonghong.song@xxxxxxxxx>
    Link: https://lore.kernel.org/bpf/20240115082028.9992-1-sunhao.th@xxxxxxxxx
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 95e7b638418e..23b6d57b5eef 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -8541,6 +8541,10 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env,
 	}
 
 	switch (base_type(ptr_reg->type)) {
+	case PTR_TO_FLOW_KEYS:
+		if (known)
+			break;
+		fallthrough;
 	case CONST_PTR_TO_MAP:
 		/* smin_val represents the known value */
 		if (known && smin_val == 0 && opcode == BPF_ADD)




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux