netdev - Re: [RFC] Use after free in BPF/ XDP during XDP

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250314153041.9BKexZXH@linutronix.de>
Date: Fri, 14 Mar 2025 16:30:41 +0100
From: Sebastian Andrzej Siewior <bigeasy@...utronix.de>
To: Toke Høiland-Jørgensen <toke@...nel.org>
Cc: netdev@...r.kernel.org, bpf@...r.kernel.org,
	Ricardo Cañuelo Navarro <rcn@...lia.com>,
	Alexei Starovoitov <ast@...nel.org>,
	Andrii Nakryiko <andrii@...nel.org>,
	Daniel Borkmann <daniel@...earbox.net>,
	"David S. Miller" <davem@...emloft.net>,
	Jakub Kicinski <kuba@...nel.org>,
	Jesper Dangaard Brouer <hawk@...nel.org>,
	John Fastabend <john.fastabend@...il.com>,
	Thomas Gleixner <tglx@...utronix.de>
Subject: Re: [RFC] Use after free in BPF/ XDP during XDP_REDIRECT

On 2025-03-14 10:21:15 [+0100], Toke Høiland-Jørgensen wrote:
> Hmm, how about putting the reset (essentially the changes you have
> above) into bpf_prog_run_xdp() itself, before executing the BPF program?

That would be the snippet below. It does work as far as the testcase
goes. It is just and unconditional write which might look like a waste
but given the circumstances…

While at it, is there anything that ensures that only bpf_prog_run_xdp()
can invoke the map_redirect callback? Mainline only assigns the task
pointer in NAPI callback so any usage outside of bpf_prog_run_xdp() will
lead to a segfault and I haven't seen a report yet so…

--- a/include/net/xdp.h
+++ b/include/net/xdp.h
@@ -486,7 +486,12 @@ static __always_inline u32 bpf_prog_run_xdp(const struct bpf_prog *prog,
 	 * under local_bh_disable(), which provides the needed RCU protection
 	 * for accessing map entries.
 	 */
-	u32 act = __bpf_prog_run(prog, xdp, BPF_DISPATCHER_FUNC(xdp));
+	struct bpf_redirect_info *ri = this_cpu_ptr(&bpf_redirect_info);
+	u32 act;
+
+	ri->map_id = INT_MAX;
+	ri->map_type = BPF_MAP_TYPE_UNSPEC;
+	act = __bpf_prog_run(prog, xdp, BPF_DISPATCHER_FUNC(xdp));
 
 	if (static_branch_unlikely(&bpf_master_redirect_enabled_key)) {
 		if (act == XDP_TX && netif_is_bond_slave(xdp->rxq->dev))
-- 
2.47.2


> -Toke

Sebastian