lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 20 May 2020 20:29:31 -0700 From: Alexei Starovoitov <alexei.starovoitov@...il.com> To: Jann Horn <jannh@...gle.com> Cc: Andrii Nakryiko <andriin@...com>, bpf <bpf@...r.kernel.org>, Network Development <netdev@...r.kernel.org>, Alexei Starovoitov <ast@...com>, Daniel Borkmann <daniel@...earbox.net>, Andrii Nakryiko <andrii.nakryiko@...il.com>, Kernel Team <kernel-team@...com> Subject: Re: [PATCH bpf] bpf: prevent mmap()'ing read-only maps as writable On Thu, May 21, 2020 at 04:50:32AM +0200, Jann Horn wrote: > On Tue, May 19, 2020 at 7:38 AM Andrii Nakryiko <andriin@...com> wrote: > > As discussed in [0], it's dangerous to allow mapping BPF map, that's meant to > > be frozen and is read-only on BPF program side, because that allows user-space > > to actually store a writable view to the page even after it is frozen. This is > > exacerbated by BPF verifier making a strong assumption that contents of such > > frozen map will remain unchanged. To prevent this, disallow mapping > > BPF_F_RDONLY_PROG mmap()'able BPF maps as writable, ever. > > > > [0] https://lore.kernel.org/bpf/CAEf4BzYGWYhXdp6BJ7_=9OQPJxQpgug080MMjdSB72i9R+5c6g@mail.gmail.com/ > > > > Suggested-by: Jann Horn <jannh@...gle.com> > > Fixes: fc9702273e2e ("bpf: Add mmap() support for BPF_MAP_TYPE_ARRAY") > > Signed-off-by: Andrii Nakryiko <andriin@...com> > > Reviewed-by: Jann Horn <jannh@...gle.com> I fixed trailing white space after 'writable page' and applied to bpf tree. Thanks
Powered by blists - more mailing lists