* [PATCH 1/2] bpf: cgroup: Fix optlen WARN_ON_ONCE toctou
@ 2021-01-22 16:42 Loris Reiff
2021-01-22 16:42 ` [PATCH 2/2] bpf: cgroup: Fix problematic bounds check Loris Reiff
` (2 more replies)
0 siblings, 3 replies; 6+ messages in thread
From: Loris Reiff @ 2021-01-22 16:42 UTC (permalink / raw)
To: bpf
Cc: netdev, ast, daniel, andrii, kafai, songliubraving, yhs,
john.fastabend, kpsingh, sdf, Loris Reiff
A toctou issue in `__cgroup_bpf_run_filter_getsockopt` can trigger a
WARN_ON_ONCE in a check of `copy_from_user`.
`*optlen` is checked to be non-negative in the individual getsockopt
functions beforehand. Changing `*optlen` in a race to a negative value
will result in a `copy_from_user(ctx.optval, optval, ctx.optlen)` with
`ctx.optlen` being a negative integer.
Fixes: 0d01da6afc54 ("bpf: implement getsockopt and setsockopt hooks")
Signed-off-by: Loris Reiff <loris.reiff@liblor.ch>
---
kernel/bpf/cgroup.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c
index 96555a8a2..6ec8f02f4 100644
--- a/kernel/bpf/cgroup.c
+++ b/kernel/bpf/cgroup.c
@@ -1442,6 +1442,11 @@ int __cgroup_bpf_run_filter_getsockopt(struct sock *sk, int level,
goto out;
}
+ if (ctx.optlen < 0) {
+ ret = -EFAULT;
+ goto out;
+ }
+
if (copy_from_user(ctx.optval, optval,
min(ctx.optlen, max_optlen)) != 0) {
ret = -EFAULT;
--
2.29.2
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH 2/2] bpf: cgroup: Fix problematic bounds check
2021-01-22 16:42 [PATCH 1/2] bpf: cgroup: Fix optlen WARN_ON_ONCE toctou Loris Reiff
@ 2021-01-22 16:42 ` Loris Reiff
2021-01-22 17:04 ` Stanislav Fomichev
2021-01-22 17:04 ` [PATCH 1/2] bpf: cgroup: Fix optlen WARN_ON_ONCE toctou Stanislav Fomichev
2021-01-22 22:20 ` patchwork-bot+netdevbpf
2 siblings, 1 reply; 6+ messages in thread
From: Loris Reiff @ 2021-01-22 16:42 UTC (permalink / raw)
To: bpf
Cc: netdev, ast, daniel, andrii, kafai, songliubraving, yhs,
john.fastabend, kpsingh, sdf, Loris Reiff
Since ctx.optlen is signed, a larger value than max_value could be
passed, as it is later on used as unsigned, which causes a WARN_ON_ONCE
in the copy_to_user.
Fixes: 0d01da6afc54 ("bpf: implement getsockopt and setsockopt hooks")
Signed-off-by: Loris Reiff <loris.reiff@liblor.ch>
---
kernel/bpf/cgroup.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c
index 6ec8f02f4..6aa9e10c6 100644
--- a/kernel/bpf/cgroup.c
+++ b/kernel/bpf/cgroup.c
@@ -1464,7 +1464,7 @@ int __cgroup_bpf_run_filter_getsockopt(struct sock *sk, int level,
goto out;
}
- if (ctx.optlen > max_optlen) {
+ if (ctx.optlen > max_optlen || ctx.optlen < 0) {
ret = -EFAULT;
goto out;
}
--
2.29.2
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH 2/2] bpf: cgroup: Fix problematic bounds check
2021-01-22 16:42 ` [PATCH 2/2] bpf: cgroup: Fix problematic bounds check Loris Reiff
@ 2021-01-22 17:04 ` Stanislav Fomichev
2021-01-22 17:10 ` Loris Reiff
0 siblings, 1 reply; 6+ messages in thread
From: Stanislav Fomichev @ 2021-01-22 17:04 UTC (permalink / raw)
To: Loris Reiff
Cc: bpf, Netdev, Alexei Starovoitov, Daniel Borkmann,
Andrii Nakryiko, Martin Lau, Song Liu, Yonghong Song,
John Fastabend, kpsingh
On Fri, Jan 22, 2021 at 8:43 AM Loris Reiff <loris.reiff@liblor.ch> wrote:
>
> Since ctx.optlen is signed, a larger value than max_value could be
> passed, as it is later on used as unsigned, which causes a WARN_ON_ONCE
> in the copy_to_user.
>
> Fixes: 0d01da6afc54 ("bpf: implement getsockopt and setsockopt hooks")
> Signed-off-by: Loris Reiff <loris.reiff@liblor.ch>
> ---
> kernel/bpf/cgroup.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c
> index 6ec8f02f4..6aa9e10c6 100644
> --- a/kernel/bpf/cgroup.c
> +++ b/kernel/bpf/cgroup.c
> @@ -1464,7 +1464,7 @@ int __cgroup_bpf_run_filter_getsockopt(struct sock *sk, int level,
> goto out;
> }
>
> - if (ctx.optlen > max_optlen) {
> + if (ctx.optlen > max_optlen || ctx.optlen < 0) {
> ret = -EFAULT;
> goto out;
> }
> --
> 2.29.2
Thanks! I assume this is only an issue if the BPF program is written
incorrectly.
Reviewed-by: Stanislav Fomichev <sdf@google.com>
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH 2/2] bpf: cgroup: Fix problematic bounds check
2021-01-22 17:04 ` Stanislav Fomichev
@ 2021-01-22 17:10 ` Loris Reiff
0 siblings, 0 replies; 6+ messages in thread
From: Loris Reiff @ 2021-01-22 17:10 UTC (permalink / raw)
To: Stanislav Fomichev
Cc: bpf, Netdev, Alexei Starovoitov, Daniel Borkmann,
Andrii Nakryiko, Martin Lau, Song Liu, Yonghong Song,
John Fastabend, kpsingh
Excerpts from Stanislav Fomichev's message of January 22, 2021 18:04:
> Thanks! I assume this is only an issue if the BPF program is written
> incorrectly.
Yes exactly.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 1/2] bpf: cgroup: Fix optlen WARN_ON_ONCE toctou
2021-01-22 16:42 [PATCH 1/2] bpf: cgroup: Fix optlen WARN_ON_ONCE toctou Loris Reiff
2021-01-22 16:42 ` [PATCH 2/2] bpf: cgroup: Fix problematic bounds check Loris Reiff
@ 2021-01-22 17:04 ` Stanislav Fomichev
2021-01-22 22:20 ` patchwork-bot+netdevbpf
2 siblings, 0 replies; 6+ messages in thread
From: Stanislav Fomichev @ 2021-01-22 17:04 UTC (permalink / raw)
To: Loris Reiff
Cc: bpf, Netdev, Alexei Starovoitov, Daniel Borkmann,
Andrii Nakryiko, Martin Lau, Song Liu, Yonghong Song,
John Fastabend, kpsingh
On Fri, Jan 22, 2021 at 8:43 AM Loris Reiff <loris.reiff@liblor.ch> wrote:
>
> A toctou issue in `__cgroup_bpf_run_filter_getsockopt` can trigger a
> WARN_ON_ONCE in a check of `copy_from_user`.
> `*optlen` is checked to be non-negative in the individual getsockopt
> functions beforehand. Changing `*optlen` in a race to a negative value
> will result in a `copy_from_user(ctx.optval, optval, ctx.optlen)` with
> `ctx.optlen` being a negative integer.
>
> Fixes: 0d01da6afc54 ("bpf: implement getsockopt and setsockopt hooks")
> Signed-off-by: Loris Reiff <loris.reiff@liblor.ch>
> ---
> kernel/bpf/cgroup.c | 5 +++++
> 1 file changed, 5 insertions(+)
>
> diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c
> index 96555a8a2..6ec8f02f4 100644
> --- a/kernel/bpf/cgroup.c
> +++ b/kernel/bpf/cgroup.c
> @@ -1442,6 +1442,11 @@ int __cgroup_bpf_run_filter_getsockopt(struct sock *sk, int level,
> goto out;
> }
>
> + if (ctx.optlen < 0) {
> + ret = -EFAULT;
> + goto out;
> + }
> +
> if (copy_from_user(ctx.optval, optval,
> min(ctx.optlen, max_optlen)) != 0) {
> ret = -EFAULT;
> --
> 2.29.2
Good point, user's optlen can be concurrently changed after the kernel
updated it.
Reviewed-by: Stanislav Fomichev <sdf@google.com>
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH 1/2] bpf: cgroup: Fix optlen WARN_ON_ONCE toctou
2021-01-22 16:42 [PATCH 1/2] bpf: cgroup: Fix optlen WARN_ON_ONCE toctou Loris Reiff
2021-01-22 16:42 ` [PATCH 2/2] bpf: cgroup: Fix problematic bounds check Loris Reiff
2021-01-22 17:04 ` [PATCH 1/2] bpf: cgroup: Fix optlen WARN_ON_ONCE toctou Stanislav Fomichev
@ 2021-01-22 22:20 ` patchwork-bot+netdevbpf
2 siblings, 0 replies; 6+ messages in thread
From: patchwork-bot+netdevbpf @ 2021-01-22 22:20 UTC (permalink / raw)
To: Loris Reiff
Cc: bpf, netdev, ast, daniel, andrii, kafai, songliubraving, yhs,
john.fastabend, kpsingh, sdf
Hello:
This series was applied to bpf/bpf.git (refs/heads/master):
On Fri, 22 Jan 2021 17:42:31 +0100 you wrote:
> A toctou issue in `__cgroup_bpf_run_filter_getsockopt` can trigger a
> WARN_ON_ONCE in a check of `copy_from_user`.
> `*optlen` is checked to be non-negative in the individual getsockopt
> functions beforehand. Changing `*optlen` in a race to a negative value
> will result in a `copy_from_user(ctx.optval, optval, ctx.optlen)` with
> `ctx.optlen` being a negative integer.
>
> [...]
Here is the summary with links:
- [1/2] bpf: cgroup: Fix optlen WARN_ON_ONCE toctou
https://git.kernel.org/bpf/bpf/c/bb8b81e396f7
- [2/2] bpf: cgroup: Fix problematic bounds check
https://git.kernel.org/bpf/bpf/c/f4a2da755a7e
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2021-01-22 22:21 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-01-22 16:42 [PATCH 1/2] bpf: cgroup: Fix optlen WARN_ON_ONCE toctou Loris Reiff
2021-01-22 16:42 ` [PATCH 2/2] bpf: cgroup: Fix problematic bounds check Loris Reiff
2021-01-22 17:04 ` Stanislav Fomichev
2021-01-22 17:10 ` Loris Reiff
2021-01-22 17:04 ` [PATCH 1/2] bpf: cgroup: Fix optlen WARN_ON_ONCE toctou Stanislav Fomichev
2021-01-22 22:20 ` patchwork-bot+netdevbpf
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).