| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <202402180711.22F5C511E5@keescook>
Date: Sun, 18 Feb 2024 07:19:44 -0800
From: Kees Cook <keescook@...omium.org>
To: Christophe Leroy <christophe.leroy@...roup.eu>
Cc: Alexei Starovoitov <ast@...nel.org>,
Daniel Borkmann <daniel@...earbox.net>,
Andrii Nakryiko <andrii@...nel.org>,
Martin KaFai Lau <martin.lau@...ux.dev>,
Eduard Zingerman <eddyz87@...il.com>, Song Liu <song@...nel.org>,
Yonghong Song <yonghong.song@...ux.dev>,
John Fastabend <john.fastabend@...il.com>,
KP Singh <kpsingh@...nel.org>, Stanislav Fomichev <sdf@...gle.com>,
Hao Luo <haoluo@...gle.com>, Jiri Olsa <jolsa@...nel.org>,
Russell King <linux@...linux.org.uk>,
Puranjay Mohan <puranjay12@...il.com>,
Zi Shen Lim <zlim.lnx@...il.com>,
Catalin Marinas <catalin.marinas@....com>,
Will Deacon <will@...nel.org>, Tiezhu Yang <yangtiezhu@...ngson.cn>,
Hengqi Chen <hengqi.chen@...il.com>,
Huacai Chen <chenhuacai@...nel.org>,
WANG Xuerui <kernel@...0n.name>,
Johan Almbladh <johan.almbladh@...finetworks.com>,
Paul Burton <paulburton@...nel.org>,
Thomas Bogendoerfer <tsbogend@...ha.franken.de>,
"James E.J. Bottomley" <James.Bottomley@...senpartnership.com>,
Helge Deller <deller@....de>, Ilya Leoshkevich <iii@...ux.ibm.com>,
Heiko Carstens <hca@...ux.ibm.com>,
Vasily Gorbik <gor@...ux.ibm.com>,
Alexander Gordeev <agordeev@...ux.ibm.com>,
Christian Borntraeger <borntraeger@...ux.ibm.com>,
Sven Schnelle <svens@...ux.ibm.com>,
"David S. Miller" <davem@...emloft.net>,
Andreas Larsson <andreas@...sler.com>,
Wang YanQing <udknight@...il.com>, David Ahern <dsahern@...nel.org>,
Thomas Gleixner <tglx@...utronix.de>,
Ingo Molnar <mingo@...hat.com>, Borislav Petkov <bp@...en8.de>,
Dave Hansen <dave.hansen@...ux.intel.com>, x86@...nel.org,
"H. Peter Anvin" <hpa@...or.com>, bpf@...r.kernel.org,
linux-arm-kernel@...ts.infradead.org, linux-kernel@...r.kernel.org,
loongarch@...ts.linux.dev, linux-mips@...r.kernel.org,
linux-parisc@...r.kernel.org, linux-s390@...r.kernel.org,
sparclinux@...r.kernel.org, netdev@...r.kernel.org,
"linux-hardening @ vger . kernel . org" <linux-hardening@...r.kernel.org>
Subject: Re: [PATCH bpf-next 2/2] bpf: Take return from set_memory_rox() into
account with bpf_jit_binary_lock_ro()
On Sun, Feb 18, 2024 at 11:55:02AM +0100, Christophe Leroy wrote:
> set_memory_rox() can fail, leaving memory unprotected.
>
> Check return and bail out when bpf_jit_binary_lock_ro() returns
> and error.
>
> Signed-off-by: Christophe Leroy <christophe.leroy@...roup.eu>
> ---
> Previous patch introduces a dependency on this patch because it modifies bpf_prog_lock_ro(), but they are independant.
> It is possible to apply this patch as standalone by handling trivial conflict with unmodified bpf_prog_lock_ro().
> ---
> arch/arm/net/bpf_jit_32.c | 25 ++++++++++++-------------
> arch/arm64/net/bpf_jit_comp.c | 21 +++++++++++++++------
> arch/loongarch/net/bpf_jit.c | 21 +++++++++++++++------
> arch/mips/net/bpf_jit_comp.c | 3 ++-
> arch/parisc/net/bpf_jit_core.c | 8 +++++++-
> arch/s390/net/bpf_jit_comp.c | 6 +++++-
> arch/sparc/net/bpf_jit_comp_64.c | 6 +++++-
> arch/x86/net/bpf_jit_comp32.c | 3 +--
> include/linux/filter.h | 4 ++--
> 9 files changed, 64 insertions(+), 33 deletions(-)
>
> diff --git a/arch/arm/net/bpf_jit_32.c b/arch/arm/net/bpf_jit_32.c
> index 1d672457d02f..01516f83a95a 100644
> --- a/arch/arm/net/bpf_jit_32.c
> +++ b/arch/arm/net/bpf_jit_32.c
> @@ -2222,28 +2222,21 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
> /* If building the body of the JITed code fails somehow,
> * we fall back to the interpretation.
> */
> - if (build_body(&ctx) < 0) {
> - image_ptr = NULL;
> - bpf_jit_binary_free(header);
> - prog = orig_prog;
> - goto out_imms;
> - }
> + if (build_body(&ctx) < 0)
> + goto out_free;
> build_epilogue(&ctx);
>
> /* 3.) Extra pass to validate JITed Code */
> - if (validate_code(&ctx)) {
> - image_ptr = NULL;
> - bpf_jit_binary_free(header);
> - prog = orig_prog;
> - goto out_imms;
> - }
> + if (validate_code(&ctx))
> + goto out_free;
> flush_icache_range((u32)header, (u32)(ctx.target + ctx.idx));
>
> if (bpf_jit_enable > 1)
> /* there are 2 passes here */
> bpf_jit_dump(prog->len, image_size, 2, ctx.target);
>
> - bpf_jit_binary_lock_ro(header);
> + if (bpf_jit_binary_lock_ro(header))
> + goto out_free;
> prog->bpf_func = (void *)ctx.target;
> prog->jited = 1;
> prog->jited_len = image_size;
> @@ -2260,5 +2253,11 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
> bpf_jit_prog_release_other(prog, prog == orig_prog ?
> tmp : orig_prog);
> return prog;
> +
> +out_free:
> + image_ptr = NULL;
> + bpf_jit_binary_free(header);
> + prog = orig_prog;
> + goto out_imms;
These gotos give me the creeps, but yes, it does appear to be in the
style of the existing error handling.
> [...]
> diff --git a/arch/x86/net/bpf_jit_comp32.c b/arch/x86/net/bpf_jit_comp32.c
> index b18ce19981ec..f2be1dcf3b24 100644
> --- a/arch/x86/net/bpf_jit_comp32.c
> +++ b/arch/x86/net/bpf_jit_comp32.c
> @@ -2600,8 +2600,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
> if (bpf_jit_enable > 1)
> bpf_jit_dump(prog->len, proglen, pass + 1, image);
>
> - if (image) {
> - bpf_jit_binary_lock_ro(header);
> + if (image && !bpf_jit_binary_lock_ro(header)) {
I find the "!" kind of hard to read the "inverted" logic (0 is success),
so if this gets a revision, maybe do "== 0"?:
if (image && bpf_jit_binary_lock_ro(header) == 0) {
But that's just me. So, regardless:
Reviewed-by: Kees Cook <keescook@...omium.org>
--
Kees Cook
Powered by blists - more mailing lists