netdev - Re: [PATCH bpf-next v3 03/11] bpf, lsm: Check bpf lsm hook return values in verifier

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <d9f79f367e3a5cdff691e586383e9ad6a831d53d.camel@gmail.com>
Date: Sat, 13 Apr 2024 14:44:09 +0300
From: Eduard Zingerman <eddyz87@...il.com>
To: Xu Kuohai <xukuohai@...weicloud.com>, bpf@...r.kernel.org, 
	netdev@...r.kernel.org, linux-security-module@...r.kernel.org, 
	linux-kselftest@...r.kernel.org
Cc: Alexei Starovoitov <ast@...nel.org>, Andrii Nakryiko
 <andrii@...nel.org>,  Daniel Borkmann <daniel@...earbox.net>, Martin KaFai
 Lau <martin.lau@...ux.dev>, Song Liu <song@...nel.org>,  Yonghong Song
 <yonghong.song@...ux.dev>, John Fastabend <john.fastabend@...il.com>, KP
 Singh <kpsingh@...nel.org>, Stanislav Fomichev <sdf@...gle.com>, Hao Luo
 <haoluo@...gle.com>, Jiri Olsa <jolsa@...nel.org>, Matt Bobrowski
 <mattbobrowski@...gle.com>, Brendan Jackman <jackmanb@...omium.org>, Paul
 Moore <paul@...l-moore.com>, James Morris <jmorris@...ei.org>, "Serge E .
 Hallyn" <serge@...lyn.com>, Khadija Kamran <kamrankhadijadj@...il.com>,
 Casey Schaufler <casey@...aufler-ca.com>, Ondrej Mosnacek
 <omosnace@...hat.com>, Kees Cook <keescook@...omium.org>, John Johansen
 <john.johansen@...onical.com>, Lukas Bulwahn <lukas.bulwahn@...il.com>,
 Roberto Sassu <roberto.sassu@...wei.com>, Shung-Hsi Yu
 <shung-hsi.yu@...e.com>
Subject: Re: [PATCH bpf-next v3 03/11] bpf, lsm: Check bpf lsm hook return
 values in verifier

On Thu, 2024-04-11 at 20:27 +0800, Xu Kuohai wrote:
> From: Xu Kuohai <xukuohai@...wei.com>
> 
> A bpf prog returning positive number attached to file_alloc_security hook
> will make kernel panic.
> 
> The reason is that the positive number returned by bpf prog is not a
> valid errno, and could not be filtered out with IS_ERR which is used by
> the file system to check errors. As a result, the file system uses this
> positive number as file pointer, causing panic.
> 
> Considering that hook file_alloc_security never returned positive number
> before bpf lsm was introduced, and other bpf lsm hooks may have the same
> problem, this patch adds lsm return value check in bpf verifier to ensure
> no unpredicted values will be returned by lsm bpf prog.
> 
> Fixes: 520b7aa00d8c ("bpf: lsm: Initialize the BPF LSM hooks")
> Reported-by: Xin Liu <liuxin350@...wei.com>
> Signed-off-by: Xu Kuohai <xukuohai@...wei.com>
> ---

Acked-by: Eduard Zingerman <eddyz87@...il.com>