Re: [PATCH v3 bpf] bpf: introduce BPF_JIT_ALWAYS_ON config

[Daniel Borkmann <daniel@iogearbox.net>]

On 01/28/2018 03:45 PM, Greg KH wrote:
> On Wed, Jan 24, 2018 at 11:10:50AM +0100, Daniel Borkmann wrote:
>> On 01/24/2018 11:07 AM, David Woodhouse wrote:
>>> On Tue, 2018-01-09 at 22:39 +0100, Daniel Borkmann wrote:
>>>> On 01/09/2018 07:04 PM, Alexei Starovoitov wrote:
>>>>>
>>>>> The BPF interpreter has been used as part of the spectre 2 attack CVE-2017-5715.
>>>>>
>>>>> A quote from goolge project zero blog:
>>>>> "At this point, it would normally be necessary to locate gadgets in
>>>>> the host kernel code that can be used to actually leak data by reading
>>>>> from an attacker-controlled location, shifting and masking the result
>>>>> appropriately and then using the result of that as offset to an
>>>>> attacker-controlled address for a load. But piecing gadgets together
>>>>> and figuring out which ones work in a speculation context seems annoying.
>>>>> So instead, we decided to use the eBPF interpreter, which is built into
>>>>> the host kernel - while there is no legitimate way to invoke it from inside
>>>>> a VM, the presence of the code in the host kernel's text section is sufficient
>>>>> to make it usable for the attack, just like with ordinary ROP gadgets."
>>>>>
>>>>> To make attacker job harder introduce BPF_JIT_ALWAYS_ON config
>>>>> option that removes interpreter from the kernel in favor of JIT-only mode.
>>>>> So far eBPF JIT is supported by:
>>>>> x64, arm64, arm32, sparc64, s390, powerpc64, mips64
>>>>>
>>>>> The start of JITed program is randomized and code page is marked as read-only.
>>>>> In addition "constant blinding" can be turned on with net.core.bpf_jit_harden
>>>>>
>>>>> v2->v3:
>>>>> - move __bpf_prog_ret0 under ifdef (Daniel)
>>>>>
>>>>> v1->v2:
>>>>> - fix init order, test_bpf and cBPF (Daniel's feedback)
>>>>> - fix offloaded bpf (Jakub's feedback)
>>>>> - add 'return 0' dummy in case something can invoke prog->bpf_func
>>>>> - retarget bpf tree. For bpf-next the patch would need one extra hunk.
>>>>>   It will be sent when the trees are merged back to net-next
>>>>>
>>>>> Considered doing:
>>>>>   int bpf_jit_enable __read_mostly = BPF_EBPF_JIT_DEFAULT;
>>>>> but it seems better to land the patch as-is and in bpf-next remove
>>>>> bpf_jit_enable global variable from all JITs, consolidate in one place
>>>>> and remove this jit_init() function.
>>>>>
>>>>> Signed-off-by: Alexei Starovoitov <ast@kernel.org>
>>>>
>>>> Applied to bpf tree, thanks Alexei!
>>>
>>> For stable too?
>>
>> Yes, this will go into stable as well; batch of backports will come Thurs/Fri.
> 
> Any word on these?  Worse case, a simple list of git commit ids to
> backport is all I need.

Sorry for the delay! There are various conflicts all over the place, so I had
to backport manually. I just flushed out tested 4.14 batch, I'll see to get 4.9
out hopefully tonight as well, and the rest for 4.4 on Mon.