From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
	id S1751983AbbJFA2K (ORCPT <rfc822;w@1wt.eu>);
	Mon, 5 Oct 2015 20:28:10 -0400
Received: from mail-pa0-f48.google.com ([209.85.220.48]:34866 "EHLO
	mail-pa0-f48.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
	with ESMTP id S1751248AbbJFA2H (ORCPT
	<rfc822;linux-kernel@vger.kernel.org>);
	Mon, 5 Oct 2015 20:28:07 -0400
Subject: Re: [PATCH net-next 1/2] bpf: enable non-root eBPF programs
To: Kees Cook <keescook@chromium.org>
References: <1444078101-29060-1-git-send-email-ast@plumgrid.com>
 <1444078101-29060-2-git-send-email-ast@plumgrid.com>
 <CAGXu5j+s+3Z6=WKKNGouNijNKcrq5o_n9-BD85Nabd-_GtL+ag@mail.gmail.com>
 <5612E7C4.1010306@plumgrid.com>
 <CAGXu5jKTDzMXXYJdWdP=b4fABu_b5ifjv88RVMgBkiR=_JUAog@mail.gmail.com>
Cc: "David S. Miller" <davem@davemloft.net>,
        Andy Lutomirski <luto@amacapital.net>, Ingo Molnar <mingo@kernel.org>,
        Hannes Frederic Sowa <hannes@stressinduktion.org>,
        Eric Dumazet <edumazet@google.com>,
        Daniel Borkmann <daniel@iogearbox.net>,
        Linux API <linux-api@vger.kernel.org>,
        Network Development <netdev@vger.kernel.org>,
        LKML <linux-kernel@vger.kernel.org>
From: Alexei Starovoitov <ast@plumgrid.com>
Message-ID: <56131594.6080801@plumgrid.com>
Date: Mon, 5 Oct 2015 17:28:04 -0700
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:38.0)
 Gecko/20100101 Thunderbird/38.3.0
MIME-Version: 1.0
In-Reply-To: <CAGXu5jKTDzMXXYJdWdP=b4fABu_b5ifjv88RVMgBkiR=_JUAog@mail.gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On 10/5/15 3:02 PM, Kees Cook wrote:
>> the array maps that hold FDs (BPF_MAP_TYPE_PROG_ARRAY and
>> >BPF_MAP_TYPE_PERF_EVENT_ARRAY) don't have lookup/update accessors
>> >from the program side, so programs cannot see or manipulate
>> >those pointers.
>> >For the former only bpf_tail_call() is allowed that takes integer
>> >index and jumps to it. And the latter map accessed with
> Okay, so I can't take a pointer, put it on the stack, take it back any
> part of it as an integer and use it for a tail call?

not quite.
you can store a pointer to stack and read it as 8 byte load back into
another register, but reading <8 byte of it will be rejected.
That's the test:
unpriv: read pointer from stack in small chunks
we obviously want to avoid hiding pointer in integers.
After reading it back from stack as a pointer you cannnot use
this register to pass as index into bpf_tail_call().
That's the test:
unpriv: pass pointer to helper function

please keep shooting everything that comes to mind.