lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Fri, 4 Dec 2015 20:48:57 +0100 From: Dmitry Vyukov <dvyukov@...gle.com> To: David Miller <davem@...emloft.net> Cc: Alexei Starovoitov <alexei.starovoitov@...il.com>, Alexei Starovoitov <ast@...nel.org>, netdev <netdev@...r.kernel.org>, LKML <linux-kernel@...r.kernel.org>, syzkaller <syzkaller@...glegroups.com>, Kostya Serebryany <kcc@...gle.com>, Alexander Potapenko <glider@...gle.com>, Sasha Levin <sasha.levin@...cle.com>, Eric Dumazet <edumazet@...gle.com>, Andrey Ryabinin <ryabinin.a.a@...il.com> Subject: Re: bpf: undefined shift in __bpf_prog_run On Fri, Dec 4, 2015 at 8:26 PM, David Miller <davem@...emloft.net> wrote: > From: Alexei Starovoitov <alexei.starovoitov@...il.com> > Date: Fri, 4 Dec 2015 11:10:15 -0800 > >> just don't generate random bpf programs with such shifts. > > Agreed, it is exactly the same as if the compiler emitted real cpu > shift instructions with undefined behavior. > > The creator of the BPF code in question is what should be fixed. There is another magical gcc flag enabled in kernel that alleviates this undefined behavior? Or we are just assuming that C compilers are still dump translators to machine code without analysis and optimizations? C standard per-se is pretty clear on this code: 6.5.7/3 The integer promotions are performed on each of the operands. The type of the result is that of the promoted left operand. If the value of the right operand is negative or is greater than or equal to the width of the promoted left operand, the behavior is undefined. 3.4.3 undefined behavior 1 behavior, upon use of a nonportable or erroneous program construct or of erroneous data, for which this International Standard imposes no requirements 2 NOTE Possible undefined behavior ranges from ignoring the situation completely with unpredictable results, to behaving during translation or program execution in a documented manner characteristic of the environment (with or without the issuance of a diagnostic message), to terminating a translation or execution For example, a compiler can assume that result of left shift is larger or equal to first operand, which in turn can allow it to elide some bounds check in code, which in turn can lead to an exploit. I am not saying that this particular pattern is present in the code, what I want to say is that such undefined behaviors can lead to very unpredictable and unexpected consequences. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists