netdev - Re: [PATCH v3 bpf] bpf: introduce BPF_JIT_ALWAYS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 28 Jan 2018 15:45:04 +0100
From:   Greg KH <gregkh@...uxfoundation.org>
To:     Daniel Borkmann <daniel@...earbox.net>
Cc:     David Woodhouse <dwmw2@...radead.org>,
        Alexei Starovoitov <ast@...nel.org>, davem@...emloft.net,
        netdev@...r.kernel.org, linux-kernel@...r.kernel.org,
        kernel-team@...com,
        "stable@...r.kernel.org" <stable@...r.kernel.org>,
        "dave.hansen@...ux.intel.com" <dave.hansen@...ux.intel.com>
Subject: Re: [PATCH v3 bpf] bpf: introduce BPF_JIT_ALWAYS_ON config

On Wed, Jan 24, 2018 at 11:10:50AM +0100, Daniel Borkmann wrote:
> On 01/24/2018 11:07 AM, David Woodhouse wrote:
> > On Tue, 2018-01-09 at 22:39 +0100, Daniel Borkmann wrote:
> >> On 01/09/2018 07:04 PM, Alexei Starovoitov wrote:
> >>>
> >>> The BPF interpreter has been used as part of the spectre 2 attack CVE-2017-5715.
> >>>
> >>> A quote from goolge project zero blog:
> >>> "At this point, it would normally be necessary to locate gadgets in
> >>> the host kernel code that can be used to actually leak data by reading
> >>> from an attacker-controlled location, shifting and masking the result
> >>> appropriately and then using the result of that as offset to an
> >>> attacker-controlled address for a load. But piecing gadgets together
> >>> and figuring out which ones work in a speculation context seems annoying.
> >>> So instead, we decided to use the eBPF interpreter, which is built into
> >>> the host kernel - while there is no legitimate way to invoke it from inside
> >>> a VM, the presence of the code in the host kernel's text section is sufficient
> >>> to make it usable for the attack, just like with ordinary ROP gadgets."
> >>>
> >>> To make attacker job harder introduce BPF_JIT_ALWAYS_ON config
> >>> option that removes interpreter from the kernel in favor of JIT-only mode.
> >>> So far eBPF JIT is supported by:
> >>> x64, arm64, arm32, sparc64, s390, powerpc64, mips64
> >>>
> >>> The start of JITed program is randomized and code page is marked as read-only.
> >>> In addition "constant blinding" can be turned on with net.core.bpf_jit_harden
> >>>
> >>> v2->v3:
> >>> - move __bpf_prog_ret0 under ifdef (Daniel)
> >>>
> >>> v1->v2:
> >>> - fix init order, test_bpf and cBPF (Daniel's feedback)
> >>> - fix offloaded bpf (Jakub's feedback)
> >>> - add 'return 0' dummy in case something can invoke prog->bpf_func
> >>> - retarget bpf tree. For bpf-next the patch would need one extra hunk.
> >>>   It will be sent when the trees are merged back to net-next
> >>>
> >>> Considered doing:
> >>>   int bpf_jit_enable __read_mostly = BPF_EBPF_JIT_DEFAULT;
> >>> but it seems better to land the patch as-is and in bpf-next remove
> >>> bpf_jit_enable global variable from all JITs, consolidate in one place
> >>> and remove this jit_init() function.
> >>>
> >>> Signed-off-by: Alexei Starovoitov <ast@...nel.org>
> >>
> >> Applied to bpf tree, thanks Alexei!
> > 
> > For stable too?
> 
> Yes, this will go into stable as well; batch of backports will come Thurs/Fri.

Any word on these?  Worse case, a simple list of git commit ids to
backport is all I need.

thanks,

greg k-h