Hao Sun
22c7fa171a
bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS
For PTR_TO_FLOW_KEYS, check_flow_keys_access() only uses fixed off
for validation. However, variable offset ptr alu is not prohibited
for this ptr kind. So the variable offset is not checked.
The following prog is accepted:
func#0 @0
0: R1=ctx() R10=fp0
0: (bf) r6 = r1 ; R1=ctx() R6_w=ctx()
1: (79) r7 = *(u64 *)(r6 +144) ; R6_w=ctx() R7_w=flow_keys()
2: (b7) r8 = 1024 ; R8_w=1024
3: (37) r8 /= 1 ; R8_w=scalar()
4: (57) r8 &= 1024 ; R8_w=scalar(smin=smin32=0,
smax=umax=smax32=umax32=1024,var_off=(0x0; 0x400))
5: (0f) r7 += r8
mark_precise: frame0: last_idx 5 first_idx 0 subseq_idx -1
mark_precise: frame0: regs=r8 stack= before 4: (57) r8 &= 1024
mark_precise: frame0: regs=r8 stack= before 3: (37) r8 /= 1
mark_precise: frame0: regs=r8 stack= before 2: (b7) r8 = 1024
6: R7_w=flow_keys(smin=smin32=0,smax=umax=smax32=umax32=1024,var_off
=(0x0; 0x400)) R8_w=scalar(smin=smin32=0,smax=umax=smax32=umax32=1024,
var_off=(0x0; 0x400))
6: (79) r0 = *(u64 *)(r7 +0) ; R0_w=scalar()
7: (95) exit
This prog loads flow_keys to r7, and adds the variable offset r8
to r7, and finally causes out-of-bounds access:
BUG: unable to handle page fault for address: ffffc90014c80038
[...]
Call Trace:
<TASK>
bpf_dispatcher_nop_func include/linux/bpf.h:1231 [inline]
__bpf_prog_run include/linux/filter.h:651 [inline]
bpf_prog_run include/linux/filter.h:658 [inline]
bpf_prog_run_pin_on_cpu include/linux/filter.h:675 [inline]
bpf_flow_dissect+0x15f/0x350 net/core/flow_dissector.c:991
bpf_prog_test_run_flow_dissector+0x39d/0x620 net/bpf/test_run.c:1359
bpf_prog_test_run kernel/bpf/syscall.c:4107 [inline]
__sys_bpf+0xf8f/0x4560 kernel/bpf/syscall.c:5475
__do_sys_bpf kernel/bpf/syscall.c:5561 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5559 [inline]
__x64_sys_bpf+0x73/0xb0 kernel/bpf/syscall.c:5559
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x63/0x6b
Fix this by rejecting ptr alu with variable offset on flow_keys.
Applying the patch rejects the program with "R7 pointer arithmetic
on flow_keys prohibited".
Fixes: d58e468b11 ("flow_dissector: implements flow dissector BPF hook")
Signed-off-by: Hao Sun <sunhao.th@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Yonghong Song <yonghong.song@linux.dev>
Link: https://lore.kernel.org/bpf/20240115082028.9992-1-sunhao.th@gmail.com
2024-01-16 17:12:29 +01:00
..
2024-01-16 17:12:29 +01:00
2024-01-08 20:04:02 -08:00
2023-09-22 09:50:55 -07:00
2023-11-06 17:13:55 +00:00
2024-01-08 15:27:15 -08:00
2023-12-21 23:12:18 +01:00
2024-01-09 11:18:47 -08:00
2023-12-20 19:26:31 -05:00
2023-10-18 14:43:22 -07:00
2023-11-02 20:53:31 -10:00
2023-10-18 14:34:17 -07:00
2023-09-20 11:24:18 +02:00
2024-01-10 16:43:55 -08:00
2024-01-10 18:00:18 -08:00
2023-12-20 19:19:26 +01:00
2023-11-03 15:44:25 -10:00
2023-11-08 09:47:52 -08:00
2024-01-10 16:43:55 -08:00
2024-01-08 18:44:11 -08:00
2024-01-11 10:07:29 -08:00
2023-09-11 15:05:50 +02:00
2024-01-10 16:43:55 -08:00
2023-11-02 20:53:31 -10:00
2023-11-14 17:34:27 -05:00
2023-11-12 22:33:49 -05:00
2023-07-21 12:17:25 -04:00
2023-08-15 18:16:14 -04:00
2023-10-13 18:34:46 +02:00
2022-09-26 19:46:09 -07:00
2023-08-08 16:48:47 -04:00
2022-09-26 10:13:13 -07:00
2023-03-14 19:32:38 -07:00
2023-06-05 09:57:20 +02:00
2023-01-13 11:48:15 +01:00
2024-01-09 10:36:07 -08:00
2024-01-09 11:46:20 -08:00
2023-12-15 14:19:48 -08:00
2023-04-18 16:39:34 -07:00
2024-01-10 16:43:55 -08:00
2023-09-21 12:03:50 -06:00
2023-02-08 13:36:22 +01:00
2024-01-10 16:43:55 -08:00
2023-12-23 15:52:13 +01:00
2023-05-28 16:20:21 +09:00
2023-09-29 11:28:39 -07:00
2023-04-08 13:45:37 -07:00
2023-08-21 13:37:28 -07:00
2023-03-24 11:01:29 +01:00
2022-12-01 15:53:05 -08:00
2022-11-12 18:47:36 -08:00
2023-08-29 17:32:32 -07:00
2022-11-15 00:42:02 -08:00
2023-08-25 15:00:36 -07:00
2023-10-19 11:02:48 +02:00
2023-12-20 13:46:19 -08:00
2023-06-09 17:44:17 -07:00
2023-12-29 12:22:29 -08:00
2023-12-29 12:22:25 -08:00
2022-09-11 21:55:06 -07:00
2023-10-09 16:59:47 +10:00
2023-03-24 20:10:59 -07:00
2023-12-01 14:53:55 +09:00
2023-06-08 12:27:20 -07:00
2023-08-24 16:25:14 -07:00
2023-11-02 20:53:31 -10:00
2022-09-11 21:55:12 -07:00
2023-12-20 19:26:30 -05:00
2023-04-08 13:45:38 -07:00
2023-08-21 11:29:12 -07:00
2023-12-20 19:26:30 -05:00
2023-10-27 18:04:24 +08:00
2023-10-04 10:41:56 -07:00
2023-12-01 09:51:44 -08:00
2023-12-20 19:26:31 -05:00
2023-08-21 13:37:59 -07:00
2023-12-12 14:24:14 +01:00
2022-09-11 21:55:12 -07:00
2024-01-09 11:46:20 -08:00
2024-01-09 16:20:17 -08:00
2023-12-29 12:22:27 -08:00
2024-01-09 11:46:20 -08:00
2022-12-27 12:52:12 +01:00
2023-07-14 15:02:57 -07:00
2022-11-09 18:06:35 +00:00
2023-12-12 14:24:14 +01:00
2023-12-10 17:21:32 -08:00
2023-10-30 17:56:53 -10:00
2023-10-04 10:41:57 -07:00
2023-07-13 15:21:50 +02:00
2023-04-20 11:36:35 +02:00
2023-12-29 12:22:29 -08:00
2022-10-17 16:41:16 +02:00
2024-01-09 12:57:46 -08:00
2023-11-18 19:35:31 +01:00
2023-11-01 15:28:33 -10:00
2023-09-19 13:21:32 -07:00
2023-10-04 10:41:57 -07:00
2023-09-24 17:24:01 +02:00
2023-02-18 14:34:36 -05:00
2023-08-15 15:26:17 -07:00
2023-06-29 15:19:43 -07:00
2023-09-13 14:59:24 +02:00
2023-11-28 14:08:47 +01:00
2023-10-11 08:46:01 -07:00
2023-04-13 11:49:35 -07:00
2023-06-08 15:43:09 -04:00
2023-12-21 13:17:54 +01:00
2023-06-19 16:25:28 -07:00
2023-06-09 17:44:21 -07:00
2023-12-29 12:22:30 -08:00
2023-08-07 15:57:22 -10:00
2023-11-22 06:18:49 -10:00