linux-kernel - Re: [PATCH v2 bpf-next 1/2] bpf: Fix out-of-bounds read in check_atomic

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <44d4adae6a5398dcd97afbe2c922f8c9a71598f2.camel@gmail.com>
Date: Fri, 21 Mar 2025 15:16:43 -0700
From: Eduard Zingerman <eddyz87@...il.com>
To: Kohei Enju <enjuk@...zon.com>, bpf@...r.kernel.org, 
	linux-kernel@...r.kernel.org
Cc: Alexei Starovoitov <ast@...nel.org>, Daniel Borkmann
 <daniel@...earbox.net>,  John Fastabend <john.fastabend@...il.com>, Andrii
 Nakryiko <andrii@...nel.org>, Martin KaFai Lau	 <martin.lau@...ux.dev>,
 Song Liu <song@...nel.org>, Yonghong Song	 <yonghong.song@...ux.dev>, KP
 Singh <kpsingh@...nel.org>, Stanislav Fomichev	 <sdf@...ichev.me>, Hao Luo
 <haoluo@...gle.com>, Jiri Olsa <jolsa@...nel.org>,  Peilin Ye
 <yepeilin@...gle.com>, Ilya Leoshkevich <iii@...ux.ibm.com>, Kuniyuki
 Iwashima	 <kuniyu@...zon.com>, kohei.enju@...il.com, 
	syzbot+a5964227adc0f904549c@...kaller.appspotmail.com
Subject: Re: [PATCH v2 bpf-next 1/2] bpf: Fix out-of-bounds read in
 check_atomic_load/store()

On Fri, 2025-03-21 at 19:59 +0900, Kohei Enju wrote:
> syzbot reported the following splat [0].
> 
> In check_atomic_load/store(), register validity is not checked before
> atomic_ptr_type_ok(). This causes the out-of-bounds read in is_ctx_reg()
> called from atomic_ptr_type_ok() when the register number is MAX_BPF_REG
> or greater.
> 
> Let's call check_load_mem()/check_store_reg() before atomic_ptr_type_ok()
> to avoid the OOB read.

[...]

>  Memory state around the buggy address:
>   ffff888141b0d580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>   ffff888141b0d600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>  >ffff888141b0d680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>                           ^
>   ffff888141b0d700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>   ffff888141b0d780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> 
> Reported-by: syzbot+a5964227adc0f904549c@...kaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=a5964227adc0f904549c
> Tested-by: syzbot+a5964227adc0f904549c@...kaller.appspotmail.com
> Fixes: e24bbad29a8d ("bpf: Introduce load-acquire and store-release instructions")
> Fixes: ff3afe5da998 ("selftests/bpf: Add selftests for load-acquire and store-release instructions")
> Signed-off-by: Kohei Enju <enjuk@...zon.com>
> ---

Acked-by: Eduard Zingerman <eddyz87@...il.com>

[...]