netdev - Re: [PATCH bpf-next v2] bpf, seccomp: fix false positive preemption splat for cbpf->ebpf progs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 20 Feb 2019 20:02:57 -0800
From:   Alexei Starovoitov <alexei.starovoitov@...il.com>
To:     Daniel Borkmann <daniel@...earbox.net>,
        Jann Horn <jannh@...gle.com>,
        Andy Lutomirski <luto@...capital.net>
Cc:     Alexei Starovoitov <ast@...nel.org>,
        Kees Cook <keescook@...omium.org>,
        Network Development <netdev@...r.kernel.org>
Subject: Re: [PATCH bpf-next v2] bpf, seccomp: fix false positive preemption
 splat for cbpf->ebpf progs

On Wed, Feb 20, 2019 at 3:59 PM Alexei Starovoitov
<alexei.starovoitov@...il.com> wrote:
>
> On Thu, Feb 21, 2019 at 12:01:35AM +0100, Daniel Borkmann wrote:
> > In 568f196756ad ("bpf: check that BPF programs run with preemption disabled")
> > a check was added for BPF_PROG_RUN() that for every invocation preemption is
> > disabled to not break eBPF assumptions (e.g. per-cpu map). Of course this does
> > not count for seccomp because only cBPF -> eBPF is loaded here and it does
> > not make use of any functionality that would require this assertion. Fix this
> > false positive by adding and using SECCOMP_RUN() variant that does not have
> > the cant_sleep(); check.
> >
> > Fixes: 568f196756ad ("bpf: check that BPF programs run with preemption disabled")
> > Reported-by: syzbot+8bf19ee2aa580de7a2a7@...kaller.appspotmail.com
> > Signed-off-by: Daniel Borkmann <daniel@...earbox.net>
> > Acked-by: Kees Cook <keescook@...omium.org>
>
> Applied, Thanks

Actually I think it's a wrong approach to go long term.
I'm thinking to revert it.
I think it's better to disable preemption for duration of
seccomp cbpf prog.
It's short and there is really no reason for it to be preemptible.
When seccomp switches to ebpf we'll have this weird inconsistency.
Let's just disable preemption for seccomp as well.