netdev - Re: [PATCH net-next] bpf, trace: make ctx access checks more robust

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 16 Jan 2017 14:42:29 -0500 (EST)
From:   David Miller <davem@...emloft.net>
To:     daniel@...earbox.net
Cc:     alexei.starovoitov@...il.com, netdev@...r.kernel.org
Subject: Re: [PATCH net-next] bpf, trace: make ctx access checks more robust

From: Daniel Borkmann <daniel@...earbox.net>
Date: Sun, 15 Jan 2017 01:34:25 +0100

> Make sure that ctx cannot potentially be accessed oob by asserting
> explicitly that ctx access size into pt_regs for BPF_PROG_TYPE_KPROBE
> programs must be within limits. In case some 32bit archs have pt_regs
> not being a multiple of 8, then BPF_DW access could cause such access.
> 
> BPF_PROG_TYPE_KPROBE progs don't have a ctx conversion function since
> there's no extra mapping needed. kprobe_prog_is_valid_access() didn't
> enforce sizeof(long) as the only allowed access size, since LLVM can
> generate non BPF_W/BPF_DW access to regs from time to time.
> 
> For BPF_PROG_TYPE_TRACEPOINT we don't have a ctx conversion either, so
> add a BUILD_BUG_ON() check to make sure that BPF_DW access will not be
> a similar issue in future (ctx works on event buffer as opposed to
> pt_regs there).
> 
> Fixes: 2541517c32be ("tracing, perf: Implement BPF programs attached to kprobes")
> Signed-off-by: Daniel Borkmann <daniel@...earbox.net>
> Acked-by: Alexei Starovoitov <ast@...nel.org>

Applied.