Alexei Starovoitov
83b570c004
bpf: Prevent memory disambiguation attack
commit af86ca4e30 upstream.
Detect code patterns where malicious 'speculative store bypass' can be used
and sanitize such patterns.
39: (bf) r3 = r10
40: (07) r3 += -216
41: (79) r8 = *(u64 *)(r7 +0) // slow read
42: (7a) *(u64 *)(r10 -72) = 0 // verifier inserts this instruction
43: (7b) *(u64 *)(r8 +0) = r3 // this store becomes slow due to r8
44: (79) r1 = *(u64 *)(r6 +0) // cpu speculatively executes this load
45: (71) r2 = *(u8 *)(r1 +0) // speculatively arbitrary 'load byte'
// is now sanitized
Above code after x86 JIT becomes:
e5: mov %rbp,%rdx
e8: add $0xffffffffffffff28,%rdx
ef: mov 0x0(%r13),%r14
f3: movq $0x0,-0x48(%rbp)
fb: mov %rdx,0x0(%r14)
ff: mov 0x0(%rbx),%rdi
103: movzbq 0x0(%rdi),%rsi
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
[bwh: Backported to 4.14:
- Add bpf_verifier_env parameter to check_stack_write()
- Look up stack slot_types with state->stack_slot_type[] rather than
state->stack[].slot_type[]
- Drop bpf_verifier_env argument to verbose()
- Adjust context]
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2018-12-05 19:41:10 +01:00
..
2018-12-01 09:42:52 +01:00
2018-12-05 19:41:10 +01:00
2018-08-24 13:09:18 +02:00
2018-11-04 14:52:45 +01:00
2018-11-04 14:52:51 +01:00
2018-08-03 07:50:36 +02:00
2018-06-21 04:02:59 +09:00
2018-11-27 16:10:48 +01:00
2018-10-18 09:16:24 +02:00
2018-10-03 17:00:58 -07:00
2018-08-03 07:50:40 +02:00
2018-07-25 11:25:11 +02:00
2018-09-09 19:55:59 +02:00
2018-05-25 16:17:41 +02:00
2018-07-08 15:30:46 +02:00
2018-10-03 17:00:59 -07:00
2018-07-22 14:28:43 +02:00
2018-07-22 14:28:49 +02:00
2018-10-13 09:27:30 +02:00
2018-05-30 07:52:09 +02:00
2018-07-03 11:25:05 +02:00
2018-12-05 19:41:10 +01:00
2018-11-04 14:52:44 +01:00
2018-10-18 09:16:24 +02:00
2018-06-21 04:02:42 +09:00
2018-11-13 11:14:54 -08:00
2018-11-04 14:52:46 +01:00
2018-08-15 18:12:47 +02:00
2018-07-22 14:28:41 +02:00
2018-07-03 11:24:49 +02:00
2018-08-15 18:13:00 +02:00
2018-09-26 08:38:09 +02:00
2018-07-11 16:29:22 +02:00
2018-05-30 07:51:47 +02:00
2018-08-03 07:50:38 +02:00
2018-08-03 07:50:35 +02:00
2018-06-21 04:02:48 +09:00
2018-12-01 09:42:59 +01:00
2018-06-21 04:02:49 +09:00
2018-10-20 09:48:53 +02:00
2018-10-13 09:27:22 +02:00
2018-09-09 19:55:56 +02:00
2018-11-21 09:24:11 +01:00
2018-05-30 07:52:22 +02:00
2018-12-01 09:43:00 +01:00
2018-09-09 19:56:00 +02:00
2018-06-21 04:02:57 +09:00
2018-07-17 11:39:25 +02:00
2018-09-19 22:43:48 +02:00
2018-09-19 22:43:48 +02:00
2018-10-13 09:27:22 +02:00
2018-10-18 09:16:25 +02:00
2018-10-18 09:16:17 +02:00
2018-11-21 09:24:10 +01:00
2018-12-01 09:42:54 +01:00
2018-09-15 09:45:25 +02:00
2018-09-09 19:55:54 +02:00
2018-06-21 04:03:00 +09:00
2018-12-01 09:42:59 +01:00
2018-11-04 14:52:43 +01:00
2018-10-03 17:00:50 -07:00
2018-10-03 17:00:47 -07:00
2018-09-05 09:26:35 +02:00
2018-05-30 07:51:54 +02:00
2018-09-19 22:43:46 +02:00
2018-08-09 12:16:38 +02:00
2018-09-05 09:26:29 +02:00
2018-06-21 04:03:00 +09:00
2018-06-21 04:02:54 +09:00
2018-08-03 07:50:39 +02:00
2018-11-13 11:15:07 -08:00
2018-09-19 22:43:47 +02:00
2018-10-03 17:00:55 -07:00
2018-07-22 14:28:52 +02:00
2018-06-21 04:02:51 +09:00
2018-08-15 18:12:51 +02:00
2018-09-05 09:26:41 +02:00
2018-11-13 11:15:11 -08:00
2018-06-05 11:41:58 +02:00
2018-08-03 07:50:20 +02:00
2018-09-19 22:43:38 +02:00
2018-05-25 16:17:37 +02:00
2018-09-09 19:55:54 +02:00
2018-10-18 09:16:19 +02:00
2018-09-19 22:43:48 +02:00
2018-09-19 22:43:48 +02:00