From mboxrd@z Thu Jan 1 00:00:00 1970 Reply-To: kernel-hardening@lists.openwall.com Date: Wed, 19 Oct 2016 16:54:20 +0200 From: Thomas Graf Message-ID: <20161019145420.GA22003@pox.localdomain> References: <20160914072415.26021-1-mic@digikod.net> <20160914072415.26021-5-mic@digikod.net> MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <20160914072415.26021-5-mic@digikod.net> Subject: [kernel-hardening] Re: [RFC v3 04/22] bpf: Set register type according to is_valid_access() To: =?iso-8859-1?Q?Micka=EBl_Sala=FCn?= Cc: linux-kernel@vger.kernel.org, Alexei Starovoitov , Andy Lutomirski , Arnd Bergmann , Casey Schaufler , Daniel Borkmann , Daniel Mack , David Drysdale , "David S . Miller" , Elena Reshetova , "Eric W . Biederman" , James Morris , Kees Cook , Paul Moore , Sargun Dhillon , "Serge E . Hallyn" , Tejun Heo , Will Drewry , kernel-hardening@lists.openwall.com, linux-api@vger.kernel.org, linux-security-module@vger.kernel.org, netdev@vger.kernel.org, cgroups@vger.kernel.org List-ID: On 09/14/16 at 09:23am, Mickaël Salaün wrote: > This fix a pointer leak when an unprivileged eBPF program read a pointer > value from the context. Even if is_valid_access() returns a pointer > type, the eBPF verifier replace it with UNKNOWN_VALUE. The register > value containing an address is then allowed to leak. Moreover, this > prevented unprivileged eBPF programs to use functions with (legitimate) > pointer arguments. > > This bug was not a problem until now because the only unprivileged eBPF > program allowed is of type BPF_PROG_TYPE_SOCKET_FILTER and all the types > from its context are UNKNOWN_VALUE. > > Signed-off-by: Mickaël Salaün > Fixes: 969bf05eb3ce ("bpf: direct packet access") > Cc: Alexei Starovoitov > Cc: Daniel Borkmann Can you post this fix separately? It's valid and needed outside of the scope of this series.