linux-kernel - Re: [PATCH bpf-next 1/2] bpf: Skip bounds adjustment for conditional jumps on same register

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <790be7b7d3752f26f2c4e62476acb0bfe448df84.camel@linux.dev>
Date: Sat, 25 Oct 2025 00:53:00 +0800
From: KaFai Wan <kafai.wan@...ux.dev>
To: Alexei Starovoitov <alexei.starovoitov@...il.com>
Cc: Eduard Zingerman <eddyz87@...il.com>, Yonghong Song
 <yonghong.song@...ux.dev>, Alexei Starovoitov <ast@...nel.org>, Daniel
 Borkmann <daniel@...earbox.net>, John Fastabend <john.fastabend@...il.com>,
 Andrii Nakryiko <andrii@...nel.org>, Martin KaFai Lau
 <martin.lau@...ux.dev>, Song Liu <song@...nel.org>,  KP Singh
 <kpsingh@...nel.org>, Stanislav Fomichev <sdf@...ichev.me>, Hao Luo
 <haoluo@...gle.com>,  Jiri Olsa <jolsa@...nel.org>, Shuah Khan
 <shuah@...nel.org>, Paul Chaignon <paul.chaignon@...il.com>,  Matan
 Shachnai <m.shachnai@...il.com>, Luis Gerhorst <luis.gerhorst@....de>,
 colin.i.king@...il.com,  Harishankar Vishwanathan
 <harishankar.vishwanathan@...il.com>, bpf <bpf@...r.kernel.org>, LKML
 <linux-kernel@...r.kernel.org>,  "open list:KERNEL SELFTEST FRAMEWORK"
 <linux-kselftest@...r.kernel.org>, Kaiyan Mei <M202472210@...t.edu.cn>, 
 Yinhao Hu <dddddd@...t.edu.cn>
Subject: Re: [PATCH bpf-next 1/2] bpf: Skip bounds adjustment for
 conditional jumps on same register

On Fri, 2025-10-24 at 09:40 -0700, Alexei Starovoitov wrote:
> On Fri, Oct 24, 2025 at 9:38 AM KaFai Wan <kafai.wan@...ux.dev> wrote:
> > 
> > On Fri, 2025-10-24 at 09:21 -0700, Eduard Zingerman wrote:
> > > On Sat, 2025-10-25 at 00:13 +0800, KaFai Wan wrote:
> > > 
> > > [...]
> > > 
> > > > For non-scalar cases we only allow pointer comparison on pkt_ptr, this check is before
> > > > is_branch_taken()
> > > > 
> > > >     src_reg = &regs[insn->src_reg];
> > > >     if (!(reg_is_pkt_pointer_any(dst_reg) && reg_is_pkt_pointer_any(src_reg)) &&
> > > >         is_pointer_value(env, insn->src_reg)) {
> > > >             verbose(env, "R%d pointer comparison prohibited\n",
> > > >                     insn->src_reg);
> > > >             return -EACCES;
> > > >     }
> > > > 
> > > > and in the end of check_cond_jmp_op() (after is_branch_taken()), we checked again
> > > > 
> > > >     } else if (!try_match_pkt_pointers(insn, dst_reg, &regs[insn->src_reg],
> > > >                                        this_branch, other_branch) &&
> > > >                is_pointer_value(env, insn->dst_reg)) {
> > > >             verbose(env, "R%d pointer comparison prohibited\n",
> > > >                     insn->dst_reg);
> > > >             return -EACCES;
> > > >     }
> > > > 
> > > > this time we check if it is valid comparison on pkt_ptr in try_match_pkt_pointers().
> > > > 
> > > > Currently we just allow 4 opcode (BPF_JGT, BPF_JLT, BPF_JGE, BPF_JLE) on pkt_ptr, and with
> > > > conditions. But we bypass these prohibits in privileged mode (is_pointer_value() always
> > > > return false in privileged mode).
> > > > 
> > > > So the logic skip these prohibits for pkt_ptr in unprivileged mode.
> > > 
> > > Well, yes, but do you really need to do forbid `if r0 > r0 goto ...` in unpriv?
> > 
> > Currently `if r0 > r0 goto ...` is forbid in unpriv, but we can allow it.
> 
> Let's not relax unpriv. We don't need new threads with researchers
> whether such things can be exploited.
> 
Ok, I'll keep the logic for both scalar and non-scalar cases.

-- 
Thanks,
KaFai