netdev - Re: linux-next: manual merge of the net-next tree with the net tree

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 19 Mar 2021 08:33:37 -0700
From:   Alexei Starovoitov <alexei.starovoitov@...il.com>
To:     Yonghong Song <yhs@...com>
Cc:     Daniel Borkmann <daniel@...earbox.net>,
        Piotr Krysiuk <piotras@...il.com>,
        David Miller <davem@...emloft.net>,
        Networking <netdev@...r.kernel.org>,
        Alexei Starovoitov <ast@...nel.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        Linux Next Mailing List <linux-next@...r.kernel.org>,
        Stephen Rothwell <sfr@...b.auug.org.au>
Subject: Re: linux-next: manual merge of the net-next tree with the net tree

On Fri, Mar 19, 2021 at 8:17 AM Yonghong Song <yhs@...com> wrote:
>
>
>
> On 3/19/21 12:21 AM, Daniel Borkmann wrote:
> > On 3/19/21 3:11 AM, Piotr Krysiuk wrote:
> >> Hi Daniel,
> >>
> >> On Fri, Mar 19, 2021 at 12:16 AM Stephen Rothwell <sfr@...b.auug.org.au>
> >> wrote:
> >>
> >>> diff --cc kernel/bpf/verifier.c
> >>> index 44e4ec1640f1,f9096b049cd6..000000000000
> >>> --- a/kernel/bpf/verifier.c
> >>> +++ b/kernel/bpf/verifier.c
> >>> @@@ -5876,10 -6056,22 +6060,23 @@@ static int
> >>> retrieve_ptr_limit(const str
> >>>                  if (mask_to_left)
> >>>                          *ptr_limit = MAX_BPF_STACK + off;
> >>>                  else
> >>>   -                      *ptr_limit = -off;
> >>>   -              return 0;
> >>>   +                      *ptr_limit = -off - 1;
> >>>   +              return *ptr_limit >= max ? -ERANGE : 0;
> >>> +       case PTR_TO_MAP_KEY:
> >>> +               /* Currently, this code is not exercised as the only use
> >>> +                * is bpf_for_each_map_elem() helper which requires
> >>> +                * bpf_capble. The code has been tested manually for
> >>> +                * future use.
> >>> +                */
> >>> +               if (mask_to_left) {
> >>> +                       *ptr_limit = ptr_reg->umax_value + ptr_reg->off;
> >>> +               } else {
> >>> +                       off = ptr_reg->smin_value + ptr_reg->off;
> >>> +                       *ptr_limit = ptr_reg->map_ptr->key_size - off;
> >>> +               }
> >>> +               return 0;
> >>>
> >>
> >> PTR_TO_MAP_VALUE logic above looks like copy-paste of old
> >> PTR_TO_MAP_VALUE
> >> code from before "bpf: Fix off-by-one for area size in creating mask to
> >> left" and is apparently affected by the same off-by-one, except this time
> >> on "key_size" area and not "value_size".
> >>
> >> This needs to be fixed in the same way as we did with PTR_TO_MAP_VALUE.
> >> What is the best way to proceed?
> >
> > Hm, not sure why PTR_TO_MAP_KEY was added by 69c087ba6225 in the first
> > place, I
> > presume noone expects this to be used from unprivileged as the comment
> > says.
> > Resolution should be to remove the PTR_TO_MAP_KEY case entirely from
> > that switch
> > until we have an actual user.
>
> Alexei suggested so that we don't forget it in the future if
> bpf_capable() requirement is removed.
>     https://lore.kernel.org/bpf/c837ae55-2487-2f39-47f6-a18781dc6fcc@fb.com/
>
> I am okay with either way, fix it or remove it.

I prefer to fix it.