Hao Sun 29ffa63f21 bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS ... [ Upstream commit 22c7fa171a ] For PTR_TO_FLOW_KEYS, check_flow_keys_access() only uses fixed off for validation. However, variable offset ptr alu is not prohibited for this ptr kind. So the variable offset is not checked. The following prog is accepted: func#0 @0 0: R1=ctx() R10=fp0 0: (bf) r6 = r1 ; R1=ctx() R6_w=ctx() 1: (79) r7 = *(u64 *)(r6 +144) ; R6_w=ctx() R7_w=flow_keys() 2: (b7) r8 = 1024 ; R8_w=1024 3: (37) r8 /= 1 ; R8_w=scalar() 4: (57) r8 &= 1024 ; R8_w=scalar(smin=smin32=0, smax=umax=smax32=umax32=1024,var_off=(0x0; 0x400)) 5: (0f) r7 += r8 mark_precise: frame0: last_idx 5 first_idx 0 subseq_idx -1 mark_precise: frame0: regs=r8 stack= before 4: (57) r8 &= 1024 mark_precise: frame0: regs=r8 stack= before 3: (37) r8 /= 1 mark_precise: frame0: regs=r8 stack= before 2: (b7) r8 = 1024 6: R7_w=flow_keys(smin=smin32=0,smax=umax=smax32=umax32=1024,var_off =(0x0; 0x400)) R8_w=scalar(smin=smin32=0,smax=umax=smax32=umax32=1024, var_off=(0x0; 0x400)) 6: (79) r0 = *(u64 *)(r7 +0) ; R0_w=scalar() 7: (95) exit This prog loads flow_keys to r7, and adds the variable offset r8 to r7, and finally causes out-of-bounds access: BUG: unable to handle page fault for address: ffffc90014c80038 [...] Call Trace: <TASK> bpf_dispatcher_nop_func include/linux/bpf.h:1231 [inline] __bpf_prog_run include/linux/filter.h:651 [inline] bpf_prog_run include/linux/filter.h:658 [inline] bpf_prog_run_pin_on_cpu include/linux/filter.h:675 [inline] bpf_flow_dissect+0x15f/0x350 net/core/flow_dissector.c:991 bpf_prog_test_run_flow_dissector+0x39d/0x620 net/bpf/test_run.c:1359 bpf_prog_test_run kernel/bpf/syscall.c:4107 [inline] __sys_bpf+0xf8f/0x4560 kernel/bpf/syscall.c:5475 __do_sys_bpf kernel/bpf/syscall.c:5561 [inline] __se_sys_bpf kernel/bpf/syscall.c:5559 [inline] __x64_sys_bpf+0x73/0xb0 kernel/bpf/syscall.c:5559 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x63/0x6b Fix this by rejecting ptr alu with variable offset on flow_keys. Applying the patch rejects the program with "R7 pointer arithmetic on flow_keys prohibited". Fixes: d58e468b11 ("flow_dissector: implements flow dissector BPF hook") Signed-off-by: Hao Sun <sunhao.th@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Yonghong Song <yonghong.song@linux.dev> Link: https://lore.kernel.org/bpf/20240115082028.9992-1-sunhao.th@gmail.com Signed-off-by: Sasha Levin <sashal@kernel.org>		2024-01-25 14:52:53 -08:00
..
preload	libbpf: Move BPF_SEQ_PRINTF and BPF_SNPRINTF to bpf_helpers.h	2021-05-26 10:45:41 -07:00
arraymap.c	bpf: Fix prog_array_map_poke_run map poke update	2024-01-05 15:13:40 +01:00
bpf_inode_storage.c	bpf: Fix spelling mistakes	2021-05-24 21:13:05 -07:00
bpf_iter.c	bpf: Refactor BPF_PROG_RUN into a function	2021-08-17 00:45:07 +02:00
bpf_local_storage.c	bpf: Annotate data races in bpf_local_storage	2023-05-24 17:36:44 +01:00
bpf_lru_list.c	bpf_lru_list: Read double-checked variable once without lock	2021-02-10 15:54:26 -08:00
bpf_lru_list.h
bpf_lsm.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next	2021-06-17 11:54:56 -07:00
bpf_struct_ops.c	bpf: Handle return value of BPF_PROG_TYPE_STRUCT_OPS prog	2021-09-14 11:09:50 -07:00
bpf_struct_ops_types.h
bpf_task_storage.c	bpf: Use this_cpu_{inc|dec|inc_return} for bpf_task_storage_busy	2022-10-26 12:34:41 +02:00
btf.c	bpf/btf: Accept function names that contain dots	2023-06-28 10:29:49 +02:00
cgroup.c	bpf: Don't EFAULT for {g,s}setsockopt with wrong optlen	2023-07-23 13:46:49 +02:00
core.c	bpf: Detect IP == ksym.end as part of BPF program	2023-11-28 16:56:15 +00:00
cpumap.c	bpf, cpumap: Make sure kthread is running before map update returns	2023-08-11 15:13:58 +02:00
devmap.c	bpf, devmap: Exclude XDP broadcast to master device	2021-08-09 23:25:14 +02:00
disasm.c	bpf: Relicense disassembler as GPL-2.0-only OR BSD-2-Clause	2021-09-02 14:49:23 +02:00
disasm.h	bpf: Relicense disassembler as GPL-2.0-only OR BSD-2-Clause	2021-09-02 14:49:23 +02:00
dispatcher.c
hashtab.c	bpf: fix a memory leak in the LRU and LRU_PERCPU hash maps	2023-06-05 09:21:14 +02:00
helpers.c	bpf: Check map->usercnt after timer->timer is assigned	2023-11-20 11:08:28 +01:00
inode.c	bpf: Fix mount source show for bpffs	2022-01-27 11:05:26 +01:00
Kconfig	sock_map: Relax config dependency to CONFIG_NET	2021-07-15 18:17:49 -07:00
local_storage.c	bpf: Increase supported cgroup storage value size	2021-07-27 15:59:29 -07:00
lpm_trie.c	bpf, lpm: Fix check prefixlen before walking trie	2024-01-25 14:52:36 -08:00
Makefile	bpf: Enable task local storage for tracing programs	2021-02-26 11:51:47 -08:00
map_in_map.c	bpf: Remember BTF of inner maps.	2021-07-15 22:31:10 +02:00
map_in_map.h
map_iter.c	bpf: Introduce MEM_RDONLY flag	2022-05-01 17:22:24 +02:00
net_namespace.c
offload.c	bpf: restore the ebpf program ID for BPF_AUDIT_UNLOAD and PERF_BPF_EVENT_PROG_UNLOAD	2023-01-24 07:22:46 +01:00
percpu_freelist.c	bpf: Initialize same number of free nodes for each pcpu_freelist	2022-11-26 09:24:38 +01:00
percpu_freelist.h
prog_iter.c
queue_stack_maps.c	bpf: Avoid deadlock when using queue and stack maps from NMI	2023-10-06 13:18:04 +02:00
reuseport_array.c	bpf: Fix spelling mistakes	2021-05-24 21:13:05 -07:00
ringbuf.c	bpf: Add MEM_RDONLY for helper args that are pointers to rdonly mem.	2022-05-01 17:22:26 +02:00
stackmap.c	bpf: Add crosstask check to __bpf_get_stack	2024-01-25 14:52:36 -08:00
syscall.c	bpf: Fix re-attachment branch in bpf_tracing_prog_attach	2024-01-25 14:52:48 -08:00
sysfs_btf.c
task_iter.c	bpf: Consolidate task_struct BTF_ID declarations	2021-08-25 10:37:05 -07:00
tnum.c	bpf, tnums: Provably sound, faster, and more precise algorithm for tnum_mul	2021-06-01 13:34:15 +02:00
trampoline.c	bpf: Fix potential array overflow in bpf_trampoline_get_progs()	2022-06-06 08:43:42 +02:00
verifier.c	bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS	2024-01-25 14:52:53 -08:00