All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH bpf] bpf: Dont allow vmlinux BTF to be used in map_create and prog_load.
@ 2021-03-07 22:52 Alexei Starovoitov
  2021-03-08  1:03 ` Yonghong Song
                   ` (2 more replies)
  0 siblings, 3 replies; 4+ messages in thread
From: Alexei Starovoitov @ 2021-03-07 22:52 UTC (permalink / raw)
  To: davem; +Cc: daniel, andrii, kafai, bpf, kernel-team

From: Alexei Starovoitov <ast@kernel.org>

The syzbot got FD of vmlinux BTF and passed it into map_create which caused
crash in btf_type_id_size() when it tried to access resolved_ids. The vmlinux
BTF doesn't have 'resolved_ids' and 'resolved_sizes' initialized to save
memory. To avoid such issues disallow using vmlinux BTF in prog_load and
map_create commands.

Reported-by: syzbot+8bab8ed346746e7540e8@syzkaller.appspotmail.com
Fixes: 5329722057d4 ("bpf: Assign ID to vmlinux BTF and return extra info for BTF in GET_OBJ_INFO")
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
---
 kernel/bpf/syscall.c  | 5 +++++
 kernel/bpf/verifier.c | 4 ++++
 2 files changed, 9 insertions(+)

diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index c859bc46d06c..250503482cda 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -854,6 +854,11 @@ static int map_create(union bpf_attr *attr)
 			err = PTR_ERR(btf);
 			goto free_map;
 		}
+		if (btf_is_kernel(btf)) {
+			btf_put(btf);
+			err = -EACCES;
+			goto free_map;
+		}
 		map->btf = btf;
 
 		if (attr->btf_value_type_id) {
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index c56e3fcb5f1a..4192a9e56654 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -9056,6 +9056,10 @@ static int check_btf_info(struct bpf_verifier_env *env,
 	btf = btf_get_by_fd(attr->prog_btf_fd);
 	if (IS_ERR(btf))
 		return PTR_ERR(btf);
+	if (btf_is_kernel(btf)) {
+		btf_put(btf);
+		return -EACCES;
+	}
 	env->prog->aux->btf = btf;
 
 	err = check_btf_func(env, attr, uattr);
-- 
2.24.1


^ permalink raw reply related	[flat|nested] 4+ messages in thread

* Re: [PATCH bpf] bpf: Dont allow vmlinux BTF to be used in map_create and prog_load.
  2021-03-07 22:52 [PATCH bpf] bpf: Dont allow vmlinux BTF to be used in map_create and prog_load Alexei Starovoitov
@ 2021-03-08  1:03 ` Yonghong Song
  2021-03-08 13:07 ` Daniel Borkmann
  2021-03-08 13:10 ` patchwork-bot+netdevbpf
  2 siblings, 0 replies; 4+ messages in thread
From: Yonghong Song @ 2021-03-08  1:03 UTC (permalink / raw)
  To: Alexei Starovoitov, davem; +Cc: daniel, andrii, kafai, bpf, kernel-team



On 3/7/21 2:52 PM, Alexei Starovoitov wrote:
> From: Alexei Starovoitov <ast@kernel.org>
> 
> The syzbot got FD of vmlinux BTF and passed it into map_create which caused
> crash in btf_type_id_size() when it tried to access resolved_ids. The vmlinux
> BTF doesn't have 'resolved_ids' and 'resolved_sizes' initialized to save
> memory. To avoid such issues disallow using vmlinux BTF in prog_load and
> map_create commands.
> 
> Reported-by: syzbot+8bab8ed346746e7540e8@syzkaller.appspotmail.com
> Fixes: 5329722057d4 ("bpf: Assign ID to vmlinux BTF and return extra info for BTF in GET_OBJ_INFO")
> Signed-off-by: Alexei Starovoitov <ast@kernel.org>

Acked-by: Yonghong Song <yhs@fb.com>

^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: [PATCH bpf] bpf: Dont allow vmlinux BTF to be used in map_create and prog_load.
  2021-03-07 22:52 [PATCH bpf] bpf: Dont allow vmlinux BTF to be used in map_create and prog_load Alexei Starovoitov
  2021-03-08  1:03 ` Yonghong Song
@ 2021-03-08 13:07 ` Daniel Borkmann
  2021-03-08 13:10 ` patchwork-bot+netdevbpf
  2 siblings, 0 replies; 4+ messages in thread
From: Daniel Borkmann @ 2021-03-08 13:07 UTC (permalink / raw)
  To: Alexei Starovoitov, davem; +Cc: andrii, kafai, bpf, kernel-team

On 3/7/21 11:52 PM, Alexei Starovoitov wrote:
> From: Alexei Starovoitov <ast@kernel.org>
> 
> The syzbot got FD of vmlinux BTF and passed it into map_create which caused
> crash in btf_type_id_size() when it tried to access resolved_ids. The vmlinux
> BTF doesn't have 'resolved_ids' and 'resolved_sizes' initialized to save
> memory. To avoid such issues disallow using vmlinux BTF in prog_load and
> map_create commands.
> 
> Reported-by: syzbot+8bab8ed346746e7540e8@syzkaller.appspotmail.com
> Fixes: 5329722057d4 ("bpf: Assign ID to vmlinux BTF and return extra info for BTF in GET_OBJ_INFO")
> Signed-off-by: Alexei Starovoitov <ast@kernel.org>
> ---
>   kernel/bpf/syscall.c  | 5 +++++
>   kernel/bpf/verifier.c | 4 ++++
>   2 files changed, 9 insertions(+)
> 
> diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
> index c859bc46d06c..250503482cda 100644
> --- a/kernel/bpf/syscall.c
> +++ b/kernel/bpf/syscall.c
> @@ -854,6 +854,11 @@ static int map_create(union bpf_attr *attr)
>   			err = PTR_ERR(btf);
>   			goto free_map;
>   		}
> +		if (btf_is_kernel(btf)) {
> +			btf_put(btf);
> +			err = -EACCES;
> +			goto free_map;
> +		}
>   		map->btf = btf;
>   
>   		if (attr->btf_value_type_id) {
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index c56e3fcb5f1a..4192a9e56654 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -9056,6 +9056,10 @@ static int check_btf_info(struct bpf_verifier_env *env,
>   	btf = btf_get_by_fd(attr->prog_btf_fd);
>   	if (IS_ERR(btf))
>   		return PTR_ERR(btf);
> +	if (btf_is_kernel(btf)) {
> +		btf_put(btf);
> +		return -EACCES;
> +	}

Looks good, applied!

>   	env->prog->aux->btf = btf;
>   
>   	err = check_btf_func(env, attr, uattr);

Btw, the error handling convention of c454a46b5efd ("bpf: Add bpf_line_info support")
is just highly confusing. Simple validation errors defer the BTF reference count drop
to __bpf_prog_put_noref() instead of just having it drop inside check_btf_info() as
you did and only assigning env->prog->aux->btf in actual success case.

^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: [PATCH bpf] bpf: Dont allow vmlinux BTF to be used in map_create and prog_load.
  2021-03-07 22:52 [PATCH bpf] bpf: Dont allow vmlinux BTF to be used in map_create and prog_load Alexei Starovoitov
  2021-03-08  1:03 ` Yonghong Song
  2021-03-08 13:07 ` Daniel Borkmann
@ 2021-03-08 13:10 ` patchwork-bot+netdevbpf
  2 siblings, 0 replies; 4+ messages in thread
From: patchwork-bot+netdevbpf @ 2021-03-08 13:10 UTC (permalink / raw)
  To: Alexei Starovoitov; +Cc: davem, daniel, andrii, kafai, bpf, kernel-team

Hello:

This patch was applied to bpf/bpf.git (refs/heads/master):

On Sun,  7 Mar 2021 14:52:48 -0800 you wrote:
> From: Alexei Starovoitov <ast@kernel.org>
> 
> The syzbot got FD of vmlinux BTF and passed it into map_create which caused
> crash in btf_type_id_size() when it tried to access resolved_ids. The vmlinux
> BTF doesn't have 'resolved_ids' and 'resolved_sizes' initialized to save
> memory. To avoid such issues disallow using vmlinux BTF in prog_load and
> map_create commands.
> 
> [...]

Here is the summary with links:
  - [bpf] bpf: Dont allow vmlinux BTF to be used in map_create and prog_load.
    https://git.kernel.org/bpf/bpf/c/350a5c4dd245

You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html



^ permalink raw reply	[flat|nested] 4+ messages in thread

end of thread, other threads:[~2021-03-08 13:11 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-03-07 22:52 [PATCH bpf] bpf: Dont allow vmlinux BTF to be used in map_create and prog_load Alexei Starovoitov
2021-03-08  1:03 ` Yonghong Song
2021-03-08 13:07 ` Daniel Borkmann
2021-03-08 13:10 ` patchwork-bot+netdevbpf

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.