netdev - Re: [PATCH bpf] bpf: fix BPF_ALU32

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 25 Jun 2019 13:15:32 -0700
From:   Song Liu <liu.song.a23@...il.com>
To:     Jiong Wang <jiong.wang@...ronome.com>
Cc:     Alexei Starovoitov <alexei.starovoitov@...il.com>,
        Daniel Borkmann <daniel@...earbox.net>,
        yauheni.kaliuta@...hat.com, bpf <bpf@...r.kernel.org>,
        Networking <netdev@...r.kernel.org>, oss-drivers@...ronome.com
Subject: Re: [PATCH bpf] bpf: fix BPF_ALU32 | BPF_ARSH on BE arches

On Tue, Jun 25, 2019 at 12:31 PM Jiong Wang <jiong.wang@...ronome.com> wrote:
>
> Yauheni reported the following code do not work correctly on BE arches:
>
>        ALU_ARSH_X:
>                DST = (u64) (u32) ((*(s32 *) &DST) >> SRC);
>                CONT;
>        ALU_ARSH_K:
>                DST = (u64) (u32) ((*(s32 *) &DST) >> IMM);
>                CONT;
>
> and are causing failure of test_verifier test 'arsh32 on imm 2' on BE
> arches.
>
> The code is taking address and interpreting memory directly, so is not
> endianness neutral. We should instead perform standard C type casting on
> the variable. A u64 to s32 conversion will drop the high 32-bit and reserve
> the low 32-bit as signed integer, this is all we want.
>
> Fixes: 2dc6b100f928 ("bpf: interpreter support BPF_ALU | BPF_ARSH")
> Reported-by: Yauheni Kaliuta <yauheni.kaliuta@...hat.com>
> Reviewed-by: Jakub Kicinski <jakub.kicinski@...ronome.com>
> Reviewed-by: Quentin Monnet <quentin.monnet@...ronome.com>
> Signed-off-by: Jiong Wang <jiong.wang@...ronome.com>

Acked-by: Song Liu <songliubraving@...com>

I guess we need:

Cc: <stable@...r.kernel.org> #v5.0+


> ---
>  kernel/bpf/core.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
> index 080e2bb..f2148db 100644
> --- a/kernel/bpf/core.c
> +++ b/kernel/bpf/core.c
> @@ -1364,10 +1364,10 @@ static u64 ___bpf_prog_run(u64 *regs, const struct bpf_insn *insn, u64 *stack)
>                 insn++;
>                 CONT;
>         ALU_ARSH_X:
> -               DST = (u64) (u32) ((*(s32 *) &DST) >> SRC);
> +               DST = (u64) (u32) (((s32) DST) >> SRC);
>                 CONT;
>         ALU_ARSH_K:
> -               DST = (u64) (u32) ((*(s32 *) &DST) >> IMM);
> +               DST = (u64) (u32) (((s32) DST) >> IMM);
>                 CONT;
>         ALU64_ARSH_X:
>                 (*(s64 *) &DST) >>= SRC;
> --
> 2.7.4
>