mirror of https://github.com/torvalds/linux.git
6bdf6abc56
Leaking kernel addresses on unpriviledged is generally disallowed, for example, verifier rejects the following: 0: (b7) r0 = 0 1: (18) r2 = 0xffff897e82304400 3: (7b) *(u64 *)(r1 +48) = r2 R2 leaks addr into ctx Doing pointer arithmetic on them is also forbidden, so that they don't turn into unknown value and then get leaked out. However, there's xadd as a special case, where we don't check the src reg for being a pointer register, e.g. the following will pass: 0: (b7) r0 = 0 1: (7b) *(u64 *)(r1 +48) = r0 2: (18) r2 = 0xffff897e82304400 ; map 4: (db) lock *(u64 *)(r1 +48) += r2 5: (95) exit We could store the pointer into skb->cb, loose the type context, and then read it out from there again to leak it eventually out of a map value. Or more easily in a different variant, too: 0: (bf) r6 = r1 1: (7a) *(u64 *)(r10 -8) = 0 2: (bf) r2 = r10 3: (07) r2 += -8 4: (18) r1 = 0x0 6: (85) call bpf_map_lookup_elem#1 7: (15) if r0 == 0x0 goto pc+3 R0=map_value(ks=8,vs=8,id=0),min_value=0,max_value=0 R6=ctx R10=fp 8: (b7) r3 = 0 9: (7b) *(u64 *)(r0 +0) = r3 10: (db) lock *(u64 *)(r0 +0) += r6 11: (b7) r0 = 0 12: (95) exit from 7 to 11: R0=inv,min_value=0,max_value=0 R6=ctx R10=fp 11: (b7) r0 = 0 12: (95) exit Prevent this by checking xadd src reg for pointer types. Also add a couple of test cases related to this. Fixes: |
||
|---|---|---|
| .. | ||
| bpf | ||
| breakpoints | ||
| capabilities | ||
| cpu-hotplug | ||
| cpufreq | ||
| drivers/gpu | ||
| efivarfs | ||
| exec | ||
| filesystems | ||
| firmware | ||
| ftrace | ||
| futex | ||
| gpio | ||
| ia64 | ||
| intel_pstate | ||
| ipc | ||
| kcmp | ||
| lib | ||
| locking | ||
| media_tests | ||
| membarrier | ||
| memfd | ||
| memory-hotplug | ||
| mount | ||
| mqueue | ||
| net | ||
| networking/timestamping | ||
| nsfs | ||
| ntb | ||
| powerpc | ||
| prctl | ||
| pstore | ||
| ptp | ||
| ptrace | ||
| rcutorture | ||
| seccomp | ||
| sigaltstack | ||
| size | ||
| splice | ||
| static_keys | ||
| sync | ||
| sysctl | ||
| timers | ||
| user | ||
| vDSO | ||
| vm | ||
| watchdog | ||
| x86 | ||
| zram | ||
| .gitignore | ||
| Makefile | ||
| gen_kselftest_tar.sh | ||
| kselftest.h | ||
| kselftest_install.sh | ||
| lib.mk | ||