linux-kernel - [PATCH 3/3] selftests/bpf: Add test case for defence against SSB exploitation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20181123183510.irdednmxibfal5mu@xylophone.i.decadent.org.uk>
Date:   Fri, 23 Nov 2018 18:35:10 +0000
From:   Ben Hutchings <ben.hutchings@...ethink.co.uk>
To:     Alexei Starovoitov <ast@...nel.org>,
        Daniel Borkmann <daniel@...earbox.net>
Cc:     netdev@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: [PATCH 3/3] selftests/bpf: Add test case for defence against SSB
 exploitation

Test that the defence added by commit af86ca4e3088 "bpf: Prevent
memory disambiguation attack" is actually being applied.

Signed-off-by: Ben Hutchings <ben.hutchings@...ethink.co.uk>
---
 tools/testing/selftests/bpf/test_verifier.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c
index e71b7f2e5f17..ca21a63541b0 100644
--- a/tools/testing/selftests/bpf/test_verifier.c
+++ b/tools/testing/selftests/bpf/test_verifier.c
@@ -13927,6 +13927,21 @@ static struct bpf_test tests[] = {
 		.result = ACCEPT,
 	},
 	{
+		"reference tracking: defend against SSB exploitation",
+		.insns = {
+			BPF_MOV32_IMM(BPF_REG_2, 1),
+			/* stack[-1] = (integer) 1 */
+			BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_2, -8),
+			/* stack[-1] = (pointer) context */
+			BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
+			BPF_MOV32_IMM(BPF_REG_0, 0),
+			BPF_EXIT_INSN(),
+		},
+		.infostr_unpriv = "patching in sanitization against SSB at 2",
+		.result_unpriv = ACCEPT,
+		.result = ACCEPT,
+	},
+	{
 		"calls: ctx read at start of subprog",
 		.insns = {
 			BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
-- 
Ben Hutchings, Software Developer                         Codethink Ltd
https://www.codethink.co.uk/                 Dale House, 35 Dale Street
                                     Manchester, M1 2HF, United Kingdom