Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1240084

Re: [PATCH net-next 1/2] bpf: enable non-root eBPF programs

Show all headers | View raw

On 10/5/15 3:14 PM, Daniel Borkmann wrote:
> One scenario that comes to mind ... what happens when there are kernel
> pointers stored in skb->cb[] (either from the current layer or an old
> one from a different layer that the skb went through previously, but
> which did not get overwritten)?
>
> Socket filters could read a portion of skb->cb[] also when unprived and
> leak that out through maps. I think the verifier doesn't catch that,
> right?

grrr. indeed. previous layer before sk_filter() can leave junk in there.
Would need to disable cb[0-5] for unpriv, but that will make tail_call
much harder to use, since cb[0-5] is a way to pass arguments from
one prog to another and clearing them is not an option, since it's
too expensive. Like samples/bpf/sockex3_kern.c usage of cb[0]
won't work anymore. I guess that's the price of unpriv.
Will fix this, add few tail_call specific tests and respin.
Please keep poking.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH net-next 1/2] bpf: enable non-root eBPF programs Alexei Starovoitov <ast@plumgrid.com> - 2015-10-05 22:50 +0200
  Re: [PATCH net-next 1/2] bpf: enable non-root eBPF programs Kees Cook <keescook@chromium.org> - 2015-10-05 23:10 +0200
    Re: [PATCH net-next 1/2] bpf: enable non-root eBPF programs Andy Lutomirski <luto@amacapital.net> - 2015-10-05 23:20 +0200
      Re: [PATCH net-next 1/2] bpf: enable non-root eBPF programs Alexei Starovoitov <ast@plumgrid.com> - 2015-10-05 23:40 +0200
    Re: [PATCH net-next 1/2] bpf: enable non-root eBPF programs Alexei Starovoitov <ast@plumgrid.com> - 2015-10-05 23:20 +0200
      Re: [PATCH net-next 1/2] bpf: enable non-root eBPF programs Kees Cook <keescook@chromium.org> - 2015-10-06 00:10 +0200
        Re: [PATCH net-next 1/2] bpf: enable non-root eBPF programs Alexei Starovoitov <ast@plumgrid.com> - 2015-10-06 02:30 +0200
  Re: [PATCH net-next 1/2] bpf: enable non-root eBPF programs Daniel Borkmann <daniel@iogearbox.net> - 2015-10-06 00:20 +0200
    Re: [PATCH net-next 1/2] bpf: enable non-root eBPF programs Alexei Starovoitov <ast@plumgrid.com> - 2015-10-06 03:00 +0200
      Re: [PATCH net-next 1/2] bpf: enable non-root eBPF programs Ingo Molnar <mingo@kernel.org> - 2015-10-06 09:20 +0200
        Re: [PATCH net-next 1/2] bpf: enable non-root eBPF programs Daniel Borkmann <daniel@iogearbox.net> - 2015-10-06 10:10 +0200
          Re: [PATCH net-next 1/2] bpf: enable non-root eBPF programs Ingo Molnar <mingo@kernel.org> - 2015-10-06 10:30 +0200
            Re: [PATCH net-next 1/2] bpf: enable non-root eBPF programs Daniel Borkmann <daniel@iogearbox.net> - 2015-10-06 10:50 +0200
              Re: [PATCH net-next 1/2] bpf: enable non-root eBPF programs Alexei Starovoitov <ast@plumgrid.com> - 2015-10-06 20:00 +0200
                Re: [PATCH net-next 1/2] bpf: enable non-root eBPF programs Eric Dumazet <eric.dumazet@gmail.com> - 2015-10-06 20:00 +0200
                Re: [PATCH net-next 1/2] bpf: enable non-root eBPF programs Andy Lutomirski <luto@amacapital.net> - 2015-10-06 20:10 +0200
                Re: [PATCH net-next 1/2] bpf: enable non-root eBPF programs Ingo Molnar <mingo@kernel.org> - 2015-10-07 08:10 +0200
                Re: [PATCH net-next 1/2] bpf: enable non-root eBPF programs Alexei Starovoitov <ast@plumgrid.com> - 2015-10-06 21:30 +0200
                Re: [PATCH net-next 1/2] bpf: enable non-root eBPF programs Daniel Borkmann <daniel@iogearbox.net> - 2015-10-06 20:10 +0200
      Re: [PATCH net-next 1/2] bpf: enable non-root eBPF programs Daniel Borkmann <daniel@iogearbox.net> - 2015-10-06 14:50 +0200
        Re: [PATCH net-next 1/2] bpf: enable non-root eBPF programs Alexei Starovoitov <ast@plumgrid.com> - 2015-10-07 23:30 +0200
          Re: [PATCH net-next 1/2] bpf: enable non-root eBPF programs Daniel Borkmann <daniel@iogearbox.net> - 2015-10-08 00:10 +0200
            Re: [PATCH net-next 1/2] bpf: enable non-root eBPF programs Kees Cook <keescook@chromium.org> - 2015-10-08 00:30 +0200
              Re: [PATCH net-next 1/2] bpf: enable non-root eBPF programs Alexei Starovoitov <ast@plumgrid.com> - 2015-10-08 01:50 +0200
                Re: [PATCH net-next 1/2] bpf: enable non-root eBPF programs Ingo Molnar <mingo@kernel.org> - 2015-10-08 08:30 +0200
                Re: [PATCH net-next 1/2] bpf: enable non-root eBPF programs Alexei Starovoitov <ast@plumgrid.com> - 2015-10-08 08:40 +0200
                Re: [PATCH net-next 1/2] bpf: enable non-root eBPF programs Kees Cook <keescook@chromium.org> - 2015-10-08 19:50 +0200
  Re: [PATCH net-next 1/2] bpf: enable non-root eBPF programs Alexei Starovoitov <ast@plumgrid.com> - 2015-10-08 04:30 +0200

csiph-web