Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1639834

[PATCH 4.11 23/28] bpf: dont let ldimm64 leak map addresses on unprivileged

Show all headers | View raw

4.11-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Daniel Borkmann <daniel@iogearbox.net>


[ Upstream commit 0d0e57697f162da4aa218b5feafe614fb666db07 ]

The patch fixes two things at once:

1) It checks the env->allow_ptr_leaks and only prints the map address to
   the log if we have the privileges to do so, otherwise it just dumps 0
   as we would when kptr_restrict is enabled on %pK. Given the latter is
   off by default and not every distro sets it, I don't want to rely on
   this, hence the 0 by default for unprivileged.

2) Printing of ldimm64 in the verifier log is currently broken in that
   we don't print the full immediate, but only the 32 bit part of the
   first insn part for ldimm64. Thus, fix this up as well; it's okay to
   access, since we verified all ldimm64 earlier already (including just
   constants) through replace_map_fd_with_map_ptr().

Fixes: 1be7f75d1668 ("bpf: enable non-root eBPF programs")
Fixes: cbd357008604 ("bpf: verifier (add ability to receive verification log)")
Reported-by: Jann Horn <jannh@google.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/bpf/verifier.c |   21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -296,7 +296,8 @@ static const char *const bpf_jmp_string[
 	[BPF_EXIT >> 4] = "exit",
 };
 
-static void print_bpf_insn(struct bpf_insn *insn)
+static void print_bpf_insn(const struct bpf_verifier_env *env,
+			   const struct bpf_insn *insn)
 {
 	u8 class = BPF_CLASS(insn->code);
 
@@ -360,9 +361,19 @@ static void print_bpf_insn(struct bpf_in
 				insn->code,
 				bpf_ldst_string[BPF_SIZE(insn->code) >> 3],
 				insn->src_reg, insn->imm);
-		} else if (BPF_MODE(insn->code) == BPF_IMM) {
-			verbose("(%02x) r%d = 0x%x\n",
-				insn->code, insn->dst_reg, insn->imm);
+		} else if (BPF_MODE(insn->code) == BPF_IMM &&
+			   BPF_SIZE(insn->code) == BPF_DW) {
+			/* At this point, we already made sure that the second
+			 * part of the ldimm64 insn is accessible.
+			 */
+			u64 imm = ((u64)(insn + 1)->imm << 32) | (u32)insn->imm;
+			bool map_ptr = insn->src_reg == BPF_PSEUDO_MAP_FD;
+
+			if (map_ptr && !env->allow_ptr_leaks)
+				imm = 0;
+
+			verbose("(%02x) r%d = 0x%llx\n", insn->code,
+				insn->dst_reg, (unsigned long long)imm);
 		} else {
 			verbose("BUG_ld_%02x\n", insn->code);
 			return;
@@ -2835,7 +2846,7 @@ static int do_check(struct bpf_verifier_
 
 		if (log_level) {
 			verbose("%d: ", insn_idx);
-			print_bpf_insn(insn);
+			print_bpf_insn(env, insn);
 		}
 
 		err = ext_analyzer_insn_hook(env, insn_idx, prev_insn_idx);

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.11 00/28] 4.11.1-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-11 18:10 +0200
  [PATCH 4.11 13/28] tcp: fix wraparound issue in tcp_lp Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-11 18:10 +0200
  [PATCH 4.11 27/28] xen: Revert commits da72ff5bfcb0 and 72a9b186292d Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-11 18:10 +0200
  [PATCH 4.11 18/28] rtnetlink: NUL-terminate IFLA_PHYS_PORT_NAME string Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-11 18:10 +0200
  [PATCH 4.11 26/28] xen/arm,arm64: fix xen_dma_ops after 815dd18 "Consolidate get_dma_ops..." Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-11 18:10 +0200
  [PATCH 4.11 06/28] sparc64: fix fault handling in NGbzero.S and GENbzero.S Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-11 18:10 +0200
  [PATCH 4.11 28/28] block: get rid of blk_integrity_revalidate() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-11 18:10 +0200
  [PATCH 4.11 08/28] net: macb: fix phy interrupt parsing Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-11 18:10 +0200
  [PATCH 4.11 23/28] bpf: dont let ldimm64 leak map addresses on unprivileged Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-11 18:10 +0200
  [PATCH 4.11 22/28] bnxt_en: allocate enough space for ->ntp_fltr_bmap Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-11 18:10 +0200
  [PATCH 4.11 21/28] tcp: randomize timestamps on syncookies Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-11 18:10 +0200
  [PATCH 4.11 14/28] net: ipv6: Do not duplicate DAD on link up Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-11 18:10 +0200
  [PATCH 4.11 16/28] tcp: do not inherit fastopen_req from parent Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-11 18:10 +0200
  [PATCH 4.11 20/28] ipv6: reorder ip6_route_dev_notifier after ipv6_dev_notf Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-11 18:10 +0200
  [PATCH 4.11 09/28] tcp: fix access to sk->sk_state in tcp_poll() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-11 18:10 +0200
  [PATCH 4.11 24/28] net: mdio-mux: bcm-iproc: call mdiobus_free() in error path Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-11 18:10 +0200
  [PATCH 4.11 12/28] bpf, arm64: fix jit branch offset related to ldimm64 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-11 18:10 +0200
  [PATCH 4.11 17/28] ipv4, ipv6: ensure raw socket message is big enough to hold an IP header Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-11 18:10 +0200
  [PATCH 4.11 19/28] ipv6: initialize route null entry in addrconf_init() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-11 18:10 +0200
  Re: [PATCH 4.11 00/28] 4.11.1-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-05-12 17:30 +0200
    Re: [PATCH 4.11 00/28] 4.11.1-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-12 17:50 +0200
    Re: [PATCH 4.11 00/28] 4.11.1-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-05-12 18:10 +0200
      Re: [PATCH 4.11 00/28] 4.11.1-stable review Matt Fleming <matt@codeblueprint.co.uk> - 2017-05-15 16:40 +0200
  Re: [PATCH 4.11 00/28] 4.11.1-stable review Guenter Roeck <linux@roeck-us.net> - 2017-05-12 22:00 +0200
    Re: [PATCH 4.11 00/28] 4.11.1-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-05-14 13:10 +0200

csiph-web