mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-22 10:31:08 +00:00
Code Issues Releases Wiki Activity
linux-stable/arch/mips
History
Piotr Krysiuk 37cb28ec7d bpf, mips: Validate conditional branch offsets 
The conditional branch instructions on MIPS use 18-bit signed offsets
allowing for a branch range of 128 KBytes (backward and forward).
However, this limit is not observed by the cBPF JIT compiler, and so
the JIT compiler emits out-of-range branches when translating certain
cBPF programs. A specific example of such a cBPF program is included in
the "BPF_MAXINSNS: exec all MSH" test from lib/test_bpf.c that executes
anomalous machine code containing incorrect branch offsets under JIT.

Furthermore, this issue can be abused to craft undesirable machine
code, where the control flow is hijacked to execute arbitrary Kernel
code.

The following steps can be used to reproduce the issue:

  # echo 1 > /proc/sys/net/core/bpf_jit_enable
  # modprobe test_bpf test_name="BPF_MAXINSNS: exec all MSH"

This should produce multiple warnings from build_bimm() similar to:

  ------------[ cut here ]------------
  WARNING: CPU: 0 PID: 209 at arch/mips/mm/uasm-mips.c:210 build_insn+0x558/0x590
  Micro-assembler field overflow
  Modules linked in: test_bpf(+)
  CPU: 0 PID: 209 Comm: modprobe Not tainted 5.14.3 #1
  Stack : 00000000 807bb824 82b33c9c 801843c0 00000000 00000004 00000000 63c9b5ee
          82b33af4 80999898 80910000 80900000 82fd6030 00000001 82b33a98 82087180
          00000000 00000000 80873b28 00000000 000000fc 82b3394c 00000000 2e34312e
          6d6d6f43 809a180f 809a1836 6f6d203a 80900000 00000001 82b33bac 80900000
          00027f80 00000000 00000000 807bb824 00000000 804ed790 001cc317 00000001
  [...]
  Call Trace:
  [<80108f44>] show_stack+0x38/0x118
  [<807a7aac>] dump_stack_lvl+0x5c/0x7c
  [<807a4b3c>] __warn+0xcc/0x140
  [<807a4c3c>] warn_slowpath_fmt+0x8c/0xb8
  [<8011e198>] build_insn+0x558/0x590
  [<8011e358>] uasm_i_bne+0x20/0x2c
  [<80127b48>] build_body+0xa58/0x2a94
  [<80129c98>] bpf_jit_compile+0x114/0x1e4
  [<80613fc4>] bpf_prepare_filter+0x2ec/0x4e4
  [<8061423c>] bpf_prog_create+0x80/0xc4
  [<c0a006e4>] test_bpf_init+0x300/0xba8 [test_bpf]
  [<8010051c>] do_one_initcall+0x50/0x1d4
  [<801c5e54>] do_init_module+0x60/0x220
  [<801c8b20>] sys_finit_module+0xc4/0xfc
  [<801144d0>] syscall_common+0x34/0x58
  [...]
  ---[ end trace a287d9742503c645 ]---

Then the anomalous machine code executes:

=> 0xc0a18000:  addiu   sp,sp,-16
   0xc0a18004:  sw      s3,0(sp)
   0xc0a18008:  sw      s4,4(sp)
   0xc0a1800c:  sw      s5,8(sp)
   0xc0a18010:  sw      ra,12(sp)
   0xc0a18014:  move    s5,a0
   0xc0a18018:  move    s4,zero
   0xc0a1801c:  move    s3,zero

   # __BPF_STMT(BPF_LDX | BPF_B | BPF_MSH, 0)
   0xc0a18020:  lui     t6,0x8012
   0xc0a18024:  ori     t4,t6,0x9e14
   0xc0a18028:  li      a1,0
   0xc0a1802c:  jalr    t4
   0xc0a18030:  move    a0,s5
   0xc0a18034:  bnez    v0,0xc0a1ffb8           # incorrect branch offset
   0xc0a18038:  move    v0,zero
   0xc0a1803c:  andi    s4,s3,0xf
   0xc0a18040:  b       0xc0a18048
   0xc0a18044:  sll     s4,s4,0x2
   [...]

   # __BPF_STMT(BPF_LDX | BPF_B | BPF_MSH, 0)
   0xc0a1ffa0:  lui     t6,0x8012
   0xc0a1ffa4:  ori     t4,t6,0x9e14
   0xc0a1ffa8:  li      a1,0
   0xc0a1ffac:  jalr    t4
   0xc0a1ffb0:  move    a0,s5
   0xc0a1ffb4:  bnez    v0,0xc0a1ffb8           # incorrect branch offset
   0xc0a1ffb8:  move    v0,zero
   0xc0a1ffbc:  andi    s4,s3,0xf
   0xc0a1ffc0:  b       0xc0a1ffc8
   0xc0a1ffc4:  sll     s4,s4,0x2

   # __BPF_STMT(BPF_LDX | BPF_B | BPF_MSH, 0)
   0xc0a1ffc8:  lui     t6,0x8012
   0xc0a1ffcc:  ori     t4,t6,0x9e14
   0xc0a1ffd0:  li      a1,0
   0xc0a1ffd4:  jalr    t4
   0xc0a1ffd8:  move    a0,s5
   0xc0a1ffdc:  bnez    v0,0xc0a3ffb8           # correct branch offset
   0xc0a1ffe0:  move    v0,zero
   0xc0a1ffe4:  andi    s4,s3,0xf
   0xc0a1ffe8:  b       0xc0a1fff0
   0xc0a1ffec:  sll     s4,s4,0x2
   [...]

   # epilogue
   0xc0a3ffb8:  lw      s3,0(sp)
   0xc0a3ffbc:  lw      s4,4(sp)
   0xc0a3ffc0:  lw      s5,8(sp)
   0xc0a3ffc4:  lw      ra,12(sp)
   0xc0a3ffc8:  addiu   sp,sp,16
   0xc0a3ffcc:  jr      ra
   0xc0a3ffd0:  nop

To mitigate this issue, we assert the branch ranges for each emit call
that could generate an out-of-range branch.

Fixes: 36366e367e ("MIPS: BPF: Restore MIPS32 cBPF JIT")
Fixes: c6610de353 ("MIPS: net: Add BPF JIT")
Signed-off-by: Piotr Krysiuk <piotras@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Tested-by: Johan Almbladh <johan.almbladh@anyfinetworks.com>
Acked-by: Johan Almbladh <johan.almbladh@anyfinetworks.com>
Cc: Paul Burton <paulburton@kernel.org>
Cc: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Link: https://lore.kernel.org/bpf/20210915160437.4080-1-piotras@gmail.com
2021-09-15 21:38:16 +02:00
..
alchemy MIPS: Alchemy: Fix spelling contraction "cant" -> "can't" 2021-07-29 11:41:05 +02:00
ar7 mips: ar7: convert to CONFIG_COMMON_CLK 2021-06-08 17:00:09 +02:00
ath25 mips: Bulk conversion to generic_handle_domain_irq() 2021-08-12 11:39:40 +01:00
ath79 MIPS: of: Introduce helper function to get DTB 2021-02-04 13:34:51 +01:00
bcm47xx MIPS: Remove empty prom_free_prom_memory functions 2021-01-07 17:11:33 +01:00
bcm63xx MIPS: BCM63XX: Use BUG_ON instead of condition followed by BUG. 2021-04-26 10:23:52 +02:00
bmips MIPS: bmips: include <linux/dma-direct.h> for phys_to_dma 2021-03-06 08:43:40 +01:00
boot MIPS: mscc: ocelot: mark the phy-mode for internal PHY ports 2021-08-21 10:38:48 +02:00
cavium-octeon mips: clean up kernel-doc in cavium-octeon/*.c 2021-07-28 11:22:21 +02:00
cobalt MIPS: Remove empty prom_free_prom_memory functions 2021-01-07 17:11:33 +01:00
configs MIPS: Retire MACH_PISTACHIO 2021-08-12 16:01:50 +02:00
crypto asm-generic: unaligned always use struct helpers 2021-05-10 17:50:47 +02:00
dec MIPS: DEC: Restore bootmem reservation for firmware working memory area 2020-10-14 23:57:57 +02:00
fw MIPS: Remove empty prom_free_prom_memory functions 2021-01-07 17:11:33 +01:00
generic MIPS: ingenic: Unconditionally enable clock of CPU #0 2021-08-29 13:31:02 +02:00
include - converted Pistachio platform to use MIPS generic kernel 2021-09-03 11:11:54 -07:00
ingenic MIPS: Kconfig: ingenic: Ensure MACH_INGENIC_GENERIC selects all SoCs 2021-06-01 11:44:47 +02:00
jazz MIPS/jazzdma: return error code from jazz_dma_map_sg() 2021-08-09 17:13:05 +02:00
kernel - converted Pistachio platform to use MIPS generic kernel 2021-09-03 11:11:54 -07:00
kvm ARM: 2021-09-07 13:40:51 -07:00
lantiq mips: Bulk conversion to generic_handle_domain_irq() 2021-08-12 11:39:40 +01:00
lib MIPS: Fix kernel hang under FUNCTION_GRAPH_TRACER and PREEMPT_TRACER 2021-05-25 15:33:17 +02:00
loongson2ef MIPS: loongson2ef: don't build serial.o unconditionally 2021-08-05 10:58:21 +02:00
loongson32 MIPS: Remove empty prom_free_prom_memory functions 2021-01-07 17:11:33 +01:00
loongson64 MIPS: loongsoon64: Reserve memory below starting pfn to prevent Oops 2021-06-29 10:15:46 +02:00
math-emu
mm - converted Pistachio platform to use MIPS generic kernel 2021-09-03 11:11:54 -07:00
mti-malta - converted Pistachio platform to use MIPS generic kernel 2021-09-03 11:11:54 -07:00
n64 mips: Add N64 machine type 2021-01-22 11:40:00 +01:00
net bpf, mips: Validate conditional branch offsets 2021-09-15 21:38:16 +02:00
netlogic mips: netlogic: fix kernel-doc complaints in fmn-config.c 2021-07-22 11:48:06 +02:00
pci mips: Bulk conversion to generic_handle_domain_irq() 2021-08-12 11:39:40 +01:00
pic32 clkdev: remove CONFIG_CLKDEV_LOOKUP 2021-06-08 17:00:09 +02:00
power
ralink mips: Bulk conversion to generic_handle_domain_irq() 2021-08-12 11:39:40 +01:00
rb532 net: korina: Add support for device tree 2021-04-19 15:58:14 -07:00
sgi-ip22 bus: Make remove callback return void 2021-07-21 11:53:42 +02:00
sgi-ip27 mips: Bulk conversion to generic_handle_domain_irq() 2021-08-12 11:39:40 +01:00
sgi-ip30 mips: Bulk conversion to generic_handle_domain_irq() 2021-08-12 11:39:40 +01:00
sgi-ip32 kernel.h: split out panic and oops helpers 2021-07-01 11:06:04 -07:00
sibyte MIPS: Remove empty prom_free_prom_memory functions 2021-01-07 17:11:33 +01:00
sni MIPS: SNI: Fix spurious interrupts 2020-09-16 22:40:58 +02:00
tools
txx9 MIPS: Remove empty prom_free_prom_memory functions 2021-01-07 17:11:33 +01:00
vdso MIPS: Makefile: Replace -pg with CC_FLAGS_FTRACE 2021-04-21 13:44:35 +02:00
vr41xx MIPS: Remove empty prom_free_prom_memory functions 2021-01-07 17:11:33 +01:00
Kbuild
Kbuild.platforms MIPS: Retire MACH_PISTACHIO 2021-08-12 16:01:50 +02:00
Kconfig Tracing updates for 5.15: 2021-09-05 11:50:41 -07:00
Kconfig.debug tracing: Refactor TRACE_IRQFLAGS_SUPPORT in Kconfig 2021-08-16 11:37:21 -04:00
Makefile Kbuild updates for v5.15 2021-09-03 15:33:47 -07:00
Makefile.postlink