Daniel Borkmann
a386fceed7
bpf: Fix pointer arithmetic mask tightening under state pruning
...
commit e042aa532c upstream.
In 7fedb63a83 ("bpf: Tighten speculative pointer arithmetic mask") we
narrowed the offset mask for unprivileged pointer arithmetic in order to
mitigate a corner case where in the speculative domain it is possible to
advance, for example, the map value pointer by up to value_size-1 out-of-
bounds in order to leak kernel memory via side-channel to user space.
The verifier's state pruning for scalars leaves one corner case open
where in the first verification path R_x holds an unknown scalar with an
aux->alu_limit of e.g. 7, and in a second verification path that same
register R_x, here denoted as R_x', holds an unknown scalar which has
tighter bounds and would thus satisfy range_within(R_x, R_x') as well as
tnum_in(R_x, R_x') for state pruning, yielding an aux->alu_limit of 3:
Given the second path fits the register constraints for pruning, the final
generated mask from aux->alu_limit will remain at 7. While technically
not wrong for the non-speculative domain, it would however be possible
to craft similar cases where the mask would be too wide as in 7fedb63a83 .
One way to fix it is to detect the presence of unknown scalar map pointer
arithmetic and force a deeper search on unknown scalars to ensure that
we do not run into a masking mismatch.
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net >
Acked-by: Alexei Starovoitov <ast@kernel.org >
[OP: adjusted context for 4.19]
Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com >
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org >
2021-09-22 11:47:59 +02:00
..
2021-03-17 16:43:42 +01:00
2020-04-02 15:28:16 +02:00
2020-04-29 16:31:24 +02:00
2021-08-08 08:54:28 +02:00
2021-06-16 11:55:01 +02:00
2021-04-14 08:22:36 +02:00
2020-10-01 13:14:28 +02:00
2020-11-05 11:08:34 +01:00
2021-03-30 14:37:02 +02:00
2020-01-27 14:51:19 +01:00
2021-09-22 11:47:49 +02:00
2020-06-30 23:17:12 -04:00
2021-03-17 16:43:51 +01:00
2021-05-22 10:59:30 +02:00
2021-09-22 11:47:47 +02:00
2021-08-12 13:19:42 +02:00
2021-05-07 10:49:25 +02:00
2021-08-08 08:54:29 +02:00
2021-08-08 08:54:29 +02:00
2020-08-19 08:15:05 +02:00
2020-06-25 15:33:02 +02:00
2021-03-04 09:39:30 +01:00
2020-04-29 16:31:17 +02:00
2021-09-22 11:47:59 +02:00
2021-03-30 14:37:02 +02:00
2020-04-23 10:30:12 +02:00
2020-12-30 11:25:39 +01:00
2020-09-09 19:04:31 +02:00
2020-07-22 09:32:00 +02:00
2020-07-22 09:32:00 +02:00
2021-01-30 13:32:11 +01:00
2021-03-24 11:07:31 +01:00
2020-12-30 11:25:40 +01:00
2021-01-23 15:49:55 +01:00
2021-03-24 11:07:31 +01:00
2021-05-26 11:48:35 +02:00
2021-08-08 08:54:30 +02:00
2020-11-05 11:08:35 +01:00
2020-10-01 13:14:28 +02:00
2020-04-17 10:48:45 +02:00
2021-03-04 09:39:57 +01:00
2021-08-26 08:36:41 -04:00
2021-01-23 15:49:55 +01:00
2020-02-24 08:34:44 +01:00
2021-03-11 14:05:02 +01:00
2020-09-03 11:24:23 +02:00
2021-02-10 09:21:06 +01:00
2020-06-25 15:33:02 +02:00
2020-02-11 04:34:08 -08:00
2021-04-07 12:48:50 +02:00
2021-09-22 11:47:58 +02:00
2020-10-14 10:31:21 +02:00
2021-01-30 13:32:13 +01:00
2021-09-22 11:47:56 +02:00
2021-09-22 11:47:56 +02:00
2020-11-05 11:08:35 +01:00
2021-01-30 13:32:12 +01:00
2021-03-11 14:04:59 +01:00
2021-06-30 08:48:10 -04:00
2020-11-05 11:08:54 +01:00
2021-07-11 12:49:27 +02:00
2021-07-11 12:49:30 +02:00
2020-08-11 15:32:33 +02:00
2020-09-23 12:10:59 +02:00
2021-05-22 10:59:40 +02:00
2021-03-04 09:39:59 +01:00
2020-05-10 10:30:12 +02:00
2021-03-30 14:37:00 +02:00
2020-07-22 09:32:00 +02:00
2020-03-18 07:14:11 +01:00
2021-08-26 08:36:39 -04:00
2021-02-03 23:23:26 +01:00
2020-02-28 16:38:59 +01:00
2020-07-29 10:16:57 +02:00
2020-05-10 10:30:11 +02:00
2020-04-17 10:48:41 +02:00
2021-05-22 10:59:50 +02:00
2021-03-04 09:39:59 +01:00
2021-08-26 08:36:40 -04:00
2020-02-28 16:38:50 +01:00
2020-07-16 08:17:26 +02:00
2021-01-09 13:43:48 +01:00
2021-03-04 09:39:42 +01:00
2020-04-23 10:30:24 +02:00
2021-03-04 09:39:44 +01:00
2020-06-22 09:05:15 +02:00
2020-10-14 10:31:26 +02:00
2021-02-13 13:51:13 +01:00
2021-02-07 14:48:38 +01:00
2021-06-16 11:55:01 +02:00
2020-04-29 16:31:19 +02:00
2020-10-01 13:14:54 +02:00
2020-02-24 08:34:46 +01:00
2021-09-22 11:47:57 +02:00
2020-09-09 19:04:28 +02:00
2021-04-28 13:16:51 +02:00
2020-02-11 04:34:18 -08:00
2020-01-29 16:43:27 +01:00
2020-01-29 16:43:27 +01:00
2021-07-11 12:49:28 +02:00
2021-07-11 12:49:26 +02:00
2020-10-07 08:00:08 +02:00
2020-07-29 10:16:52 +02:00
2021-05-22 10:59:23 +02:00
2021-08-26 08:36:41 -04:00
2021-03-30 14:37:02 +02:00
2021-06-30 08:48:18 -04:00
2021-07-20 16:16:01 +02:00
2021-09-03 09:58:03 +02:00
2020-11-18 19:18:44 +01:00
2020-11-18 19:18:44 +01:00
2020-12-02 08:48:07 +01:00
2021-07-20 16:16:11 +02:00
2020-10-01 13:14:41 +02:00
2020-10-07 08:00:08 +02:00
2020-04-13 10:45:06 +02:00
2020-04-17 10:48:45 +02:00
2021-01-06 14:45:00 +01:00
2021-09-03 09:58:00 +02:00
2020-10-29 09:55:15 +01:00
2020-10-30 10:38:20 +01:00
2021-08-08 08:54:30 +02:00
2020-03-25 08:06:13 +01:00
2021-07-11 12:49:30 +02:00
2020-06-22 09:05:25 +02:00
2020-04-17 10:48:46 +02:00
2020-10-01 13:14:40 +02:00
2020-04-23 10:30:20 +02:00
2020-02-11 04:34:11 -08:00
2021-06-10 13:24:08 +02:00
2020-03-18 07:14:17 +01:00
2020-05-20 08:18:45 +02:00
2021-07-20 16:15:46 +02:00
2020-07-22 09:32:13 +02:00
2021-01-12 20:10:17 +01:00
2021-06-30 08:48:19 -04:00
2020-08-07 09:36:21 +02:00
2020-02-24 08:34:46 +01:00
2021-07-11 12:49:28 +02:00
2021-01-30 13:32:12 +01:00
2020-12-30 11:26:06 +01:00
2020-04-02 15:28:22 +02:00
2020-12-30 11:26:01 +01:00
2020-10-01 13:14:30 +02:00
2020-06-22 09:05:03 +02:00
2020-01-27 14:51:05 +01:00
2021-08-04 12:23:44 +02:00
2021-05-22 10:59:39 +02:00
2021-06-30 08:48:18 -04:00
2021-03-17 16:43:51 +01:00
2021-02-13 13:51:15 +01:00
2020-04-17 10:48:43 +02:00
2020-04-23 10:30:19 +02:00
2021-03-07 12:19:01 +01:00
2020-07-31 18:37:48 +02:00
2021-03-24 11:07:37 +01:00
2020-11-18 19:18:40 +01:00
2020-12-30 11:26:01 +01:00
2021-07-20 16:15:42 +02:00
2021-05-22 10:59:31 +02:00
2020-12-11 13:25:01 +01:00
2021-03-30 14:36:58 +02:00
2020-09-09 19:04:29 +02:00
2021-03-24 11:07:34 +01:00
2021-08-04 12:23:44 +02:00
2020-10-07 08:00:05 +02:00
2020-04-29 16:31:27 +02:00
2020-04-02 15:28:23 +02:00
2020-08-11 15:32:34 +02:00
2021-03-07 12:19:01 +01:00