From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.0 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2AFACC43381 for ; Thu, 21 Feb 2019 08:53:52 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 0492920880 for ; Thu, 21 Feb 2019 08:53:51 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726910AbfBUIxu (ORCPT ); Thu, 21 Feb 2019 03:53:50 -0500 Received: from www62.your-server.de ([213.133.104.62]:50640 "EHLO www62.your-server.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726354AbfBUIxu (ORCPT ); Thu, 21 Feb 2019 03:53:50 -0500 Received: from [78.46.172.2] (helo=sslproxy05.your-server.de) by www62.your-server.de with esmtpsa (TLSv1.2:DHE-RSA-AES256-GCM-SHA384:256) (Exim 4.89_1) (envelope-from ) id 1gwk6z-00050g-JT; Thu, 21 Feb 2019 09:53:45 +0100 Received: from [178.197.248.36] (helo=linux.home) by sslproxy05.your-server.de with esmtpsa (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.89) (envelope-from ) id 1gwk6z-000Lqe-Di; Thu, 21 Feb 2019 09:53:45 +0100 Subject: Re: [PATCH bpf-next v2] bpf, seccomp: fix false positive preemption splat for cbpf->ebpf progs To: Kees Cook , Alexei Starovoitov Cc: Jann Horn , Andy Lutomirski , Alexei Starovoitov , Network Development References: <20190220230135.9748-1-daniel@iogearbox.net> <20190220235952.uzrsjypoqkha7ya6@ast-mbp.dhcp.thefacebook.com> From: Daniel Borkmann Message-ID: Date: Thu, 21 Feb 2019 09:53:44 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.3.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit X-Authenticated-Sender: daniel@iogearbox.net X-Virus-Scanned: Clear (ClamAV 0.100.2/25366/Wed Feb 20 12:52:59 2019) Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org On 02/21/2019 06:31 AM, Kees Cook wrote: > On Wed, Feb 20, 2019 at 8:03 PM Alexei Starovoitov > wrote: >> >> On Wed, Feb 20, 2019 at 3:59 PM Alexei Starovoitov >> wrote: >>> >>> On Thu, Feb 21, 2019 at 12:01:35AM +0100, Daniel Borkmann wrote: >>>> In 568f196756ad ("bpf: check that BPF programs run with preemption disabled") >>>> a check was added for BPF_PROG_RUN() that for every invocation preemption is >>>> disabled to not break eBPF assumptions (e.g. per-cpu map). Of course this does >>>> not count for seccomp because only cBPF -> eBPF is loaded here and it does >>>> not make use of any functionality that would require this assertion. Fix this >>>> false positive by adding and using SECCOMP_RUN() variant that does not have >>>> the cant_sleep(); check. >>>> >>>> Fixes: 568f196756ad ("bpf: check that BPF programs run with preemption disabled") >>>> Reported-by: syzbot+8bf19ee2aa580de7a2a7@syzkaller.appspotmail.com >>>> Signed-off-by: Daniel Borkmann >>>> Acked-by: Kees Cook >>> >>> Applied, Thanks >> >> Actually I think it's a wrong approach to go long term. >> I'm thinking to revert it. >> I think it's better to disable preemption for duration of >> seccomp cbpf prog. >> It's short and there is really no reason for it to be preemptible. >> When seccomp switches to ebpf we'll have this weird inconsistency. >> Let's just disable preemption for seccomp as well. > > A lot of changes will be needed for seccomp ebpf -- not the least of > which is convincing me there is a use-case. ;) > > But the main issue is that I'm not a huge fan of dropping two > barriers() across syscall entry. That seems pretty heavy-duty for > something that is literally not needed right now. Yeah, I think it's okay to add once actually technically needed. Last time I looked, if I recall correctly, at least Chrome installs some heavy duty seccomp programs that go close to prog limit. Thanks, Daniel