netdev - Re: Bug with BPF_ALU64

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20170914.111424.934672262035736390.davem@davemloft.net>
Date:   Thu, 14 Sep 2017 11:14:24 -0700 (PDT)
From:   David Miller <davem@...emloft.net>
To:     ecree@...arflare.com
Cc:     daniel@...earbox.net, ast@...com, netdev@...r.kernel.org
Subject: Re: Bug with BPF_ALU64 | BPF_END?

From: Edward Cree <ecree@...arflare.com>
Date: Thu, 14 Sep 2017 18:53:17 +0100

> Is BPF_END supposed to only be used with BPF_ALU, never with BPF_ALU64?
> In kernel/bpf/core.c:___bpf_prog_run(), there are only jump table targets
>  for the BPF_ALU case, not for the BPF_ALU64 case (opcodes 0xd7 and 0xdf).
> But the verifier doesn't enforce this; by crafting a program that uses
>  these opcodes I can get a WARN when they're run (without JIT; it looks
>  like the x86 JIT, at least, won't like it either).
> Proposed patch below the cut; build-tested only.

Good catch.

A really neat test would be a program that uploads random BPF programs
into the kernel, in a syzkaller'ish way.  It might have triggered this
(eventually).