netdev - Re: [PATCH bpf-next 2/3] bpf: Allow helpers access trusted PTR_TO_BTF

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 13 Mar 2023 19:07:06 -0500
From:   David Vernet <void@...ifault.com>
To:     Alexei Starovoitov <alexei.starovoitov@...il.com>
Cc:     davem@...emloft.net, daniel@...earbox.net, andrii@...nel.org,
        martin.lau@...nel.org, davemarchevsky@...a.com, tj@...nel.org,
        memxor@...il.com, netdev@...r.kernel.org, bpf@...r.kernel.org,
        kernel-team@...com
Subject: Re: [PATCH bpf-next 2/3] bpf: Allow helpers access trusted
 PTR_TO_BTF_ID.

On Mon, Mar 13, 2023 at 04:58:44PM -0700, Alexei Starovoitov wrote:
> From: Alexei Starovoitov <ast@...nel.org>
> 
> The verifier rejects the code:
>   bpf_strncmp(task->comm, 16, "my_task");
> with the message:
>   16: (85) call bpf_strncmp#182
>   R1 type=trusted_ptr_ expected=fp, pkt, pkt_meta, map_key, map_value, mem, ringbuf_mem, buf
> 
> Teach the verifier that such access pattern is safe.
> Do not allow untrusted and legacy ptr_to_btf_id to be passed into helpers.
> 
> Reported-by: David Vernet <void@...ifault.com>
> Signed-off-by: Alexei Starovoitov <ast@...nel.org>

Acked-by: David Vernet <void@...ifault.com>

> ---
>  kernel/bpf/verifier.c | 15 +++++++++++++++
>  1 file changed, 15 insertions(+)
> 
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 883d4ff2e288..2bbd89279070 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -6303,6 +6303,9 @@ static int check_helper_mem_access(struct bpf_verifier_env *env, int regno,
>  				env,
>  				regno, reg->off, access_size,
>  				zero_size_allowed, ACCESS_HELPER, meta);
> +	case PTR_TO_BTF_ID:
> +		return check_ptr_to_btf_access(env, regs, regno, reg->off,
> +					       access_size, BPF_READ, -1);
>  	case PTR_TO_CTX:
>  		/* in case the function doesn't know how to access the context,
>  		 * (because we are in a program of type SYSCALL for example), we
> @@ -7014,6 +7017,7 @@ static const struct bpf_reg_types mem_types = {
>  		PTR_TO_MEM,
>  		PTR_TO_MEM | MEM_RINGBUF,
>  		PTR_TO_BUF,
> +		PTR_TO_BTF_ID | PTR_TRUSTED,
>  	},
>  };
>  
> @@ -7145,6 +7149,17 @@ static int check_reg_type(struct bpf_verifier_env *env, u32 regno,
>  	if (base_type(reg->type) != PTR_TO_BTF_ID)
>  		return 0;
>  
> +	if (compatible == &mem_types) {
> +		if (!(arg_type & MEM_RDONLY)) {
> +			verbose(env,
> +				"%s() may write into memory pointed by R%d type=%s\n",
> +				func_id_name(meta->func_id),
> +				regno, reg_type_str(env, reg->type));
> +			return -EACCES;
> +		}
> +		return 0;
> +	}
> +
>  	switch ((int)reg->type) {
>  	case PTR_TO_BTF_ID:
>  	case PTR_TO_BTF_ID | PTR_TRUSTED:
> -- 
> 2.34.1
>