Daniel Borkmann 6d4f151acf bpf: Fix passing modified ctx to ld/abs/ind instruction ... Anatoly has been fuzzing with kBdysch harness and reported a KASAN slab oob in one of the outcomes: [...] [ 77.359642] BUG: KASAN: slab-out-of-bounds in bpf_skb_load_helper_8_no_cache+0x71/0x130 [ 77.360463] Read of size 4 at addr ffff8880679bac68 by task bpf/406 [ 77.361119] [ 77.361289] CPU: 2 PID: 406 Comm: bpf Not tainted 5.5.0-rc2-xfstests-00157-g2187f215eba #1 [ 77.362134] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 77.362984] Call Trace: [ 77.363249] dump_stack+0x97/0xe0 [ 77.363603] print_address_description.constprop.0+0x1d/0x220 [ 77.364251] ? bpf_skb_load_helper_8_no_cache+0x71/0x130 [ 77.365030] ? bpf_skb_load_helper_8_no_cache+0x71/0x130 [ 77.365860] __kasan_report.cold+0x37/0x7b [ 77.366365] ? bpf_skb_load_helper_8_no_cache+0x71/0x130 [ 77.366940] kasan_report+0xe/0x20 [ 77.367295] bpf_skb_load_helper_8_no_cache+0x71/0x130 [ 77.367821] ? bpf_skb_load_helper_8+0xf0/0xf0 [ 77.368278] ? mark_lock+0xa3/0x9b0 [ 77.368641] ? kvm_sched_clock_read+0x14/0x30 [ 77.369096] ? sched_clock+0x5/0x10 [ 77.369460] ? sched_clock_cpu+0x18/0x110 [ 77.369876] ? bpf_skb_load_helper_8+0xf0/0xf0 [ 77.370330] ___bpf_prog_run+0x16c0/0x28f0 [ 77.370755] __bpf_prog_run32+0x83/0xc0 [ 77.371153] ? __bpf_prog_run64+0xc0/0xc0 [ 77.371568] ? match_held_lock+0x1b/0x230 [ 77.371984] ? rcu_read_lock_held+0xa1/0xb0 [ 77.372416] ? rcu_is_watching+0x34/0x50 [ 77.372826] sk_filter_trim_cap+0x17c/0x4d0 [ 77.373259] ? sock_kzfree_s+0x40/0x40 [ 77.373648] ? __get_filter+0x150/0x150 [ 77.374059] ? skb_copy_datagram_from_iter+0x80/0x280 [ 77.374581] ? do_raw_spin_unlock+0xa5/0x140 [ 77.375025] unix_dgram_sendmsg+0x33a/0xa70 [ 77.375459] ? do_raw_spin_lock+0x1d0/0x1d0 [ 77.375893] ? unix_peer_get+0xa0/0xa0 [ 77.376287] ? __fget_light+0xa4/0xf0 [ 77.376670] __sys_sendto+0x265/0x280 [ 77.377056] ? __ia32_sys_getpeername+0x50/0x50 [ 77.377523] ? lock_downgrade+0x350/0x350 [ 77.377940] ? __sys_setsockopt+0x2a6/0x2c0 [ 77.378374] ? sock_read_iter+0x240/0x240 [ 77.378789] ? __sys_socketpair+0x22a/0x300 [ 77.379221] ? __ia32_sys_socket+0x50/0x50 [ 77.379649] ? mark_held_locks+0x1d/0x90 [ 77.380059] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 77.380536] __x64_sys_sendto+0x74/0x90 [ 77.380938] do_syscall_64+0x68/0x2a0 [ 77.381324] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 77.381878] RIP: 0033:0x44c070 [...] After further debugging, turns out while in case of other helper functions we disallow passing modified ctx, the special case of ld/abs/ind instruction which has similar semantics (except r6 being the ctx argument) is missing such check. Modified ctx is impossible here as bpf_skb_load_helper_8_no_cache() and others are expecting skb fields in original position, hence, add check_ctx_reg() to reject any modified ctx. Issue was first introduced back in f1174f77b5 ("bpf/verifier: rework value tracking"). Fixes: f1174f77b5 ("bpf/verifier: rework value tracking") Reported-by: Anatoly Trosinenko <anatoly.trosinenko@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://lore.kernel.org/bpf/20200106215157.3553-1-daniel@iogearbox.net		2020-01-06 14:19:47 -08:00
..
bpf	bpf: Fix passing modified ctx to ld/abs/ind instruction	2020-01-06 14:19:47 -08:00
cgroup	Merge branch 'for-5.5' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup	2019-11-25 19:23:46 -08:00
configs
debug	kdb: Tweak escape handling for vi users	2019-10-28 12:08:29 +00:00
dma	lib/genalloc.c: rename addr_in_gen_pool to gen_pool_has_addr	2019-12-04 19:44:13 -08:00
events	perf/core: Add SRCU annotation for pmus list walk	2019-12-17 13:32:46 +01:00
gcov	um: Enable CONFIG_CONSTRUCTORS	2019-09-15 21:37:13 +02:00
irq	irqchip updates for Linux 5.5	2019-11-20 14:16:34 +01:00
livepatch	New tracing features:	2019-11-27 11:42:01 -08:00
locking	Revert "locking/mutex: Complain upon mutex API misuse in IRQ contexts"	2019-12-11 00:27:43 +01:00
power	Additional power management updates for 5.5-rc1	2019-12-04 10:48:09 -08:00
printk	Merge branch 'irq-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2019-12-03 09:29:50 -08:00
rcu	Merge branches 'doc.2019.10.29a', 'fixes.2019.10.30a', 'nohz.2019.10.28a', 'replace.2019.10.30a', 'torture.2019.10.05a' and 'lkmm.2019.10.05a' into HEAD	2019-10-30 08:47:13 -07:00
sched	Merge branch 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2019-12-21 10:52:10 -08:00
time	ptp: fix the race between the release of ptp_clock and cdev	2019-12-30 20:19:27 -08:00
trace	tracing: Fix endianness bug in histogram trigger	2019-12-21 16:08:59 -05:00
.gitignore	Provide in-kernel headers to make extending kernel easier	2019-04-29 16:48:03 +02:00
acct.c	acct_on(): don't mess with freeze protection	2019-04-04 21:04:13 -04:00
async.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 441	2019-06-05 17:37:17 +02:00
audit_fsnotify.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 157	2019-05-30 11:26:37 -07:00
audit_tree.c	fsnotify: switch send_to_group() and ->handle_event to const struct qstr *	2019-04-26 13:51:03 -04:00
audit_watch.c	audit_get_nd(): don't unlock parent too early	2019-11-10 11:56:55 -05:00
audit.c	audit: remove redundant condition check in kauditd_thread()	2019-10-25 11:48:14 -04:00
audit.h	audit/stable-5.3 PR 20190702	2019-07-08 18:55:42 -07:00
auditfilter.c	audit/stable-5.3 PR 20190702	2019-07-08 18:55:42 -07:00
auditsc.c	Revert "bpf: Emit audit messages upon successful prog load and unload"	2019-11-23 09:56:02 -08:00
backtracetest.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 441	2019-06-05 17:37:17 +02:00
bounds.c
capability.c	LSM: add SafeSetID module that gates setid calls	2019-01-25 11:22:43 -08:00
compat.c	y2038: itimer: compat handling to itimer.c	2019-11-15 14:38:30 +01:00
configs.c	kernel/configs: Replace GPL boilerplate code with SPDX identifier	2019-07-30 18:34:15 +02:00
context_tracking.c	context_tracking: Rename context_tracking_is_enabled() => context_tracking_enabled()	2019-10-29 10:01:12 +01:00
cpu_pm.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 282	2019-06-05 17:36:37 +02:00
cpu.c	Merge branch 'locking-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2019-11-26 16:02:40 -08:00
crash_core.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 230	2019-06-19 17:09:06 +02:00
crash_dump.c	treewide: Add SPDX license identifier for missed files	2019-05-21 10:50:45 +02:00
cred.c	Merge branch 'access-creds'	2019-07-25 08:36:29 -07:00
delayacct.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 25	2019-05-21 11:52:39 +02:00
dma.c
elfcore.c	kernel/elfcore.c: include proper prototypes	2019-09-25 17:51:39 -07:00
exec_domain.c
exit.c	Pipework for general notification queue	2019-11-30 14:12:13 -08:00
extable.c	bpf: Add support for BTF pointers to x86 JIT	2019-10-17 16:44:36 +02:00
fail_function.c	fail_function: no need to check return value of debugfs_create functions	2019-06-03 15:49:06 +02:00
fork.c	Merge branch 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2019-12-03 12:20:25 -08:00
freezer.c	Revert "libata, freezer: avoid block device removal while system is frozen"	2019-10-06 09:11:37 -06:00
futex.c	futex: Prevent exit livelock	2019-11-20 09:40:38 +01:00
gen_kheaders.sh	kheaders: explain why include/config/autoconf.h is excluded from md5sum	2019-11-11 20:10:01 +09:00
groups.c
hung_task.c	treewide: Add SPDX license identifier for missed files	2019-05-21 10:50:45 +02:00
iomem.c	mm/nvdimm: add is_ioremap_addr and use that to check ioremap address	2019-07-12 11:05:40 -07:00
irq_work.c	irq_work: Fix IRQ_WORK_BUSY bit clearing	2019-11-15 10:48:37 +01:00
jump_label.c	jump_label: Don't warn on __exit jump entries	2019-08-29 15:10:10 +01:00
kallsyms.c	kallsyms: Don't let kallsyms_lookup_size_offset() fail on retrieving the first symbol	2019-08-27 16:19:56 +01:00
kcmp.c
Kconfig.freezer	treewide: Add SPDX license identifier - Makefile/Kconfig	2019-05-21 10:50:46 +02:00
Kconfig.hz	treewide: Add SPDX license identifier - Makefile/Kconfig	2019-05-21 10:50:46 +02:00
Kconfig.locks	treewide: Add SPDX license identifier - Makefile/Kconfig	2019-05-21 10:50:46 +02:00
Kconfig.preempt	sched/Kconfig: Fix spelling mistake in user-visible help text	2019-11-12 11:35:32 +01:00
kcov.c	kcov: remote coverage support	2019-12-04 19:44:14 -08:00
kexec_core.c	kexec: bail out upon SIGKILL when allocating memory.	2019-09-25 17:51:40 -07:00
kexec_elf.c	kexec_elf: support 32 bit ELF files	2019-09-06 23:58:44 +02:00
kexec_file.c	kexec: Fix pointer-to-int-cast warnings	2019-11-01 21:42:58 +01:00
kexec_internal.h
kexec.c	kexec_load: Disable at runtime if the kernel is locked down	2019-08-19 21:54:15 -07:00
kheaders.c	kheaders: Move from proc to sysfs	2019-05-24 20:16:01 +02:00
kmod.c
kprobes.c	Tracing updates:	2019-09-20 11:19:48 -07:00
ksysfs.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 170	2019-05-30 11:26:39 -07:00
kthread.c	kthread: make __kthread_queue_delayed_work static	2019-10-16 09:20:58 -07:00
latencytop.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 441	2019-06-05 17:37:17 +02:00
Makefile	Kbuild updates for v5.5	2019-12-02 17:35:04 -08:00
module_signature.c	MODSIGN: Export module signature definitions	2019-08-05 18:39:56 -04:00
module_signing.c	MODSIGN: Export module signature definitions	2019-08-05 18:39:56 -04:00
module-internal.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 36	2019-05-24 17:27:11 +02:00
module.c	This contains 3 changes:	2019-12-11 12:22:38 -08:00
notifier.c	kernel/notifier.c: remove blocking_notifier_chain_cond_register()	2019-12-04 19:44:12 -08:00
nsproxy.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 441	2019-06-05 17:37:17 +02:00
padata.c	padata: remove cpu_index from the parallel_queue	2019-09-13 21:15:41 +10:00
panic.c	locking/refcount: Remove unused 'refcount_error_report()' function	2019-11-25 09:15:42 +01:00
params.c	lockdown: Lock down module params that specify hardware parameters (eg. ioport)	2019-08-19 21:54:16 -07:00
pid_namespace.c	fork: extend clone3() to support setting a PID	2019-11-15 23:49:22 +01:00
pid.c	fork: extend clone3() to support setting a PID	2019-11-15 23:49:22 +01:00
profile.c	kernel/profile.c: use cpumask_available to check for NULL cpumask	2019-12-04 19:44:12 -08:00
ptrace.c	ptrace: add PTRACE_GET_SYSCALL_INFO request	2019-07-16 19:23:24 -07:00
range.c
reboot.c	treewide: Add SPDX license identifier for missed files	2019-05-21 10:50:45 +02:00
relay.c	Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2019-03-12 13:27:20 -07:00
resource.c	mm/memory_hotplug.c: use PFN_UP / PFN_DOWN in walk_system_ram_range()	2019-09-24 15:54:09 -07:00
rseq.c	signal: Remove task parameter from force_sig	2019-05-27 09:36:28 -05:00
seccomp.c	seccomp: add SECCOMP_USER_NOTIF_FLAG_CONTINUE	2019-10-10 14:45:51 -07:00
signal.c	cgroup: freezer: call cgroup_enter_frozen() with preemption disabled in ptrace_stop()	2019-10-11 08:39:57 -07:00
smp.c	smp: Warn on function calls from softirq context	2019-07-20 11:27:16 +02:00
smpboot.c	treewide: Add SPDX license identifier for missed files	2019-05-21 10:50:45 +02:00
smpboot.h
softirq.c	Merge branch 'irq-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2019-07-08 11:01:13 -07:00
stackleak.c	stackleak: Mark stackleak_track_stack() as notrace	2018-12-05 19:31:44 -08:00
stacktrace.c	stacktrace: Get rid of unneeded '!!' pattern	2019-11-11 10:30:59 +01:00
stop_machine.c	Merge branch 'for-mingo' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu into core/rcu	2019-10-31 09:33:19 +01:00
sys_ni.c	y2038: allow disabling time32 system calls	2019-11-15 14:38:30 +01:00
sys.c	kernel/sys.c: avoid copying possible padding bytes in copy_to_user	2019-12-04 19:44:12 -08:00
sysctl_binary.c	sysctl: Remove the sysctl system call	2019-11-26 13:03:56 -06:00
sysctl-test.c	kernel/sysctl-test: Add null pointer test for sysctl.c:proc_dointvec()	2019-09-30 17:35:01 -06:00
sysctl.c	kernel: sysctl: make drop_caches write-only	2019-12-01 12:59:07 -08:00
task_work.c
taskstats.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 157	2019-05-30 11:26:37 -07:00
test_kprobes.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 25	2019-05-21 11:52:39 +02:00
torture.c	torture: Remove exporting of internal functions	2019-08-01 14:30:22 -07:00
tracepoint.c	The main changes in this release include:	2019-07-18 11:51:00 -07:00
tsacct.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 157	2019-05-30 11:26:37 -07:00
ucount.c	proc/sysctl: add shared variables for range check	2019-07-18 17:08:07 -07:00
uid16.c
uid16.h
umh.c	treewide: Add SPDX license identifier for missed files	2019-05-21 10:50:45 +02:00
up.c	smp: Remove smp_call_function() and on_each_cpu() return values	2019-06-23 14:26:26 +02:00
user_namespace.c	Keyrings namespacing	2019-07-08 19:36:47 -07:00
user-return-notifier.c	treewide: Add SPDX license identifier for missed files	2019-05-21 10:50:45 +02:00
user.c	Keyrings namespacing	2019-07-08 19:36:47 -07:00
utsname_sysctl.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 441	2019-06-05 17:37:17 +02:00
utsname.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 441	2019-06-05 17:37:17 +02:00
watchdog_hld.c	kernel/watchdog_hld.c: hard lockup message should end with a newline	2019-04-19 09:46:05 -07:00
watchdog.c	watchdog: Mark watchdog_hrtimer to expire in hard interrupt context	2019-08-01 20:51:20 +02:00
workqueue_internal.h	sched/core, workqueues: Distangle worker accounting from rq lock	2019-04-16 16:55:15 +02:00
workqueue.c	workqueue: Use pr_warn instead of pr_warning	2019-12-06 09:59:30 +01:00