linux/kernel/bpf
Daniel Borkmann 7fedb63a83 bpf: Tighten speculative pointer arithmetic mask
This work tightens the offset mask we use for unprivileged pointer arithmetic
in order to mitigate a corner case reported by Piotr and Benedict where in
the speculative domain it is possible to advance, for example, the map value
pointer by up to value_size-1 out-of-bounds in order to leak kernel memory
via side-channel to user space.

Before this change, the computed ptr_limit for retrieve_ptr_limit() helper
represents largest valid distance when moving pointer to the right or left
which is then fed as aux->alu_limit to generate masking instructions against
the offset register. After the change, the derived aux->alu_limit represents
the largest potential value of the offset register which we mask against which
is just a narrower subset of the former limit.

For minimal complexity, we call sanitize_ptr_alu() from 2 observation points
in adjust_ptr_min_max_vals(), that is, before and after the simulated alu
operation. In the first step, we retieve the alu_state and alu_limit before
the operation as well as we branch-off a verifier path and push it to the
verification stack as we did before which checks the dst_reg under truncation,
in other words, when the speculative domain would attempt to move the pointer
out-of-bounds.

In the second step, we retrieve the new alu_limit and calculate the absolute
distance between both. Moreover, we commit the alu_state and final alu_limit
via update_alu_sanitation_state() to the env's instruction aux data, and bail
out from there if there is a mismatch due to coming from different verification
paths with different states.

Reported-by: Piotr Krysiuk <piotras@gmail.com>
Reported-by: Benedict Schlueter <benedict.schlueter@rub.de>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: John Fastabend <john.fastabend@gmail.com>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Tested-by: Benedict Schlueter <benedict.schlueter@rub.de>
2021-04-16 23:52:01 +02:00
..
preload bpf: Fix umd memory leak in copy_process() 2021-03-19 22:23:19 +01:00
arraymap.c bpf: Eliminate rlimit-based memory accounting for arraymap maps 2020-12-02 18:32:46 -08:00
bpf_inode_storage.c bpf: Change inode_storage's lookup_elem return value from NULL to -EBADF 2021-03-08 16:08:06 +01:00
bpf_iter.c bpf: Fix an unitialized value in bpf_iter 2021-02-12 13:33:50 -08:00
bpf_local_storage.c bpf: Eliminate rlimit-based memory accounting for bpf local storage maps 2020-12-02 18:32:47 -08:00
bpf_lru_list.c bpf_lru_list: Read double-checked variable once without lock 2021-02-10 15:54:26 -08:00
bpf_lru_list.h bpf: Fix a typo "inacitve" -> "inactive" 2020-04-06 21:54:10 +02:00
bpf_lsm.c bpf: Drop disabled LSM hooks from the sleepable set 2021-01-26 17:08:50 +01:00
bpf_struct_ops_types.h bpf: tcp: Support tcp_congestion_ops in bpf 2020-01-09 08:46:18 -08:00
bpf_struct_ops.c bpf: Fix fexit trampoline. 2021-03-18 00:22:51 +01:00
bpf_task_storage.c bpf: Local storage helpers should check nullness of owner ptr passed 2021-01-12 16:07:56 +01:00
btf.c bpf: Drop imprecise log message 2021-02-24 16:43:39 +01:00
cgroup.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next 2021-02-16 13:14:06 -08:00
core.c bpf: Fix fexit trampoline. 2021-03-18 00:22:51 +01:00
cpumap.c net, xdp: Introduce __xdp_build_skb_from_frame utility routine 2021-01-20 14:10:35 -08:00
devmap.c bpf, devmap: Use GFP_KERNEL for xdp bulk queue allocation 2021-02-13 00:11:26 +01:00
disasm.c bpf: Fix a spelling typo in bpf_atomic_alu_string disasm 2021-03-26 17:56:48 +01:00
disasm.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 295 2019-06-05 17:36:38 +02:00
dispatcher.c bpf: Remove bpf_image tree 2020-03-13 12:49:52 -07:00
hashtab.c bpf: Allows per-cpu maps and map-in-map in sleepable programs 2021-02-11 16:19:26 +01:00
helpers.c bpf: Simplify cases in bpf_base_func_proto 2021-01-29 02:20:28 +01:00
inode.c bpf: program: Refuse non-O_RDWR flags in BPF_OBJ_GET 2021-04-01 14:33:48 -07:00
local_storage.c bpf: Eliminate rlimit-based memory accounting for cgroup storage maps 2020-12-02 18:32:46 -08:00
lpm_trie.c bpf: Eliminate rlimit-based memory accounting for lpm_trie maps 2020-12-02 18:32:46 -08:00
Makefile Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next 2020-11-14 09:13:41 -08:00
map_in_map.c bpf: Relax max_entries check for most of the inner map types 2020-08-28 15:41:30 +02:00
map_in_map.h bpf: Add map_meta_equal map ops 2020-08-28 15:41:30 +02:00
map_iter.c bpf: Implement link_query callbacks in map element iterators 2020-08-21 14:01:39 -07:00
net_namespace.c bpf: Add support for forced LINK_DETACH command 2020-08-01 20:38:28 -07:00
offload.c bpf, offload: Replace bitwise AND by logical AND in bpf_prog_offload_info_fill 2020-02-17 16:53:49 +01:00
percpu_freelist.c bpf: Use raw_spin_trylock() for pcpu_freelist_push/pop in NMI 2020-10-06 00:04:11 +02:00
percpu_freelist.h bpf: Use raw_spin_trylock() for pcpu_freelist_push/pop in NMI 2020-10-06 00:04:11 +02:00
prog_iter.c bpf: Refactor bpf_iter_reg to have separate seq_info member 2020-07-25 20:16:32 -07:00
queue_stack_maps.c bpf: Eliminate rlimit-based memory accounting for queue_stack_maps maps 2020-12-02 18:32:46 -08:00
reuseport_array.c bpf: Eliminate rlimit-based memory accounting for reuseport_array maps 2020-12-02 18:32:47 -08:00
ringbuf.c bpf: Eliminate rlimit-based memory accounting for bpf ringbuffer 2020-12-02 18:32:47 -08:00
stackmap.c bpf: Refcount task stack in bpf_get_task_stack 2021-04-01 13:58:07 -07:00
syscall.c bpf: Dont allow vmlinux BTF to be used in map_create and prog_load. 2021-03-08 13:32:46 +01:00
sysfs_btf.c bpf: Load and verify kernel module BTFs 2020-11-10 15:25:53 -08:00
task_iter.c bpf: Introduce task_vma bpf_iter 2021-02-12 12:56:53 -08:00
tnum.c bpf: Verifier, do explicit ALU32 bounds tracking 2020-03-30 14:59:53 -07:00
trampoline.c bpf: Take module reference for trampoline in module 2021-03-26 19:30:11 -07:00
verifier.c bpf: Tighten speculative pointer arithmetic mask 2021-04-16 23:52:01 +02:00