netdev - Re: [PATCH v2] bpf: verifier: MOV64 don't mark dst reg unbounded

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 31 Jul 2018 19:02:11 +0100
From:   Edward Cree <ecree@...arflare.com>
To:     Arthur Fabre <afabre@...udflare.com>,
        Alexei Starovoitov <ast@...nel.org>,
        Daniel Borkmann <daniel@...earbox.net>,
        Y Song <ys114321@...il.com>, <netdev@...r.kernel.org>
Subject: Re: [PATCH v2] bpf: verifier: MOV64 don't mark dst reg unbounded

On 31/07/18 18:17, Arthur Fabre wrote:
> When check_alu_op() handles a BPF_MOV64 between two registers,
> it calls check_reg_arg(DST_OP) on the dst register, marking it as unbounded.
> If the src and dst register are the same, this marks the src as
> unbounded, which can lead to unexpected errors for further checks that
> rely on bounds info. For example:
>
> 	BPF_MOV64_IMM(BPF_REG_2, 0),
> 	BPF_MOV64_REG(BPF_REG_2, BPF_REG_2),
> 	BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_2),
> 	BPF_MOV64_IMM(BPF_REG_0, 0),
> 	BPF_EXIT_INSN(),
>
> results in:
>
> 	"math between ctx pointer and register with unbounded min value is not
>         allowed"
>
> check_alu_op() now uses check_reg_arg(DST_OP_NO_MARK), and MOVs
> that need to mark the dst register (MOVIMM, MOV32) do so.
>
> Added a test case for MOV64 dst == src, and dst != src.
>
> Signed-off-by: Arthur Fabre <afabre@...udflare.com>
> ---
> v2: Add mov64 tests, always use DST_OP_NO_MARK
>
>  kernel/bpf/verifier.c                       |  6 +++--
>  tools/testing/selftests/bpf/test_verifier.c | 26 +++++++++++++++++++++
>  2 files changed, 30 insertions(+), 2 deletions(-)
Acked-by: Edward Cree <ecree@...arflare.com>