Piotr Krysiuk c4d37eea1c bpf: Prohibit alu ops for pointer types not defining ptr_limit ... commit f232326f6966cf2a1d1db7bc917a4ce5f9f55f76 upstream. The purpose of this patch is to streamline error propagation and in particular to propagate retrieve_ptr_limit() errors for pointer types that are not defining a ptr_limit such that register-based alu ops against these types can be rejected. The main rationale is that a gap has been identified by Piotr in the existing protection against speculatively out-of-bounds loads, for example, in case of ctx pointers, unprivileged programs can still perform pointer arithmetic. This can be abused to execute speculatively out-of-bounds loads without restrictions and thus extract contents of kernel memory. Fix this by rejecting unprivileged programs that attempt any pointer arithmetic on unprotected pointer types. The two affected ones are pointer to ctx as well as pointer to map. Field access to a modified ctx' pointer is rejected at a later point in time in the verifier, and 7c69673262 ("bpf: Permit map_ptr arithmetic with opcode add and offset 0") only relevant for root-only use cases. Risk of unprivileged program breakage is considered very low. Fixes: 7c69673262 ("bpf: Permit map_ptr arithmetic with opcode add and offset 0") Fixes: b2157399cc ("bpf: prevent out-of-bounds speculation") Signed-off-by: Piotr Krysiuk <piotras@gmail.com> Co-developed-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Alexei Starovoitov <ast@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2021-03-20 10:43:43 +01:00
..
preload	bpf, preload: Fix build when $(O) points to a relative path	2021-02-10 09:29:13 +01:00
arraymap.c
bpf_inode_storage.c	bpf, inode_storage: Put file handler if no storage was found	2021-02-10 09:29:12 +01:00
bpf_iter.c	bpf: Fix an unitialized value in bpf_iter	2021-03-04 11:37:33 +01:00
bpf_local_storage.c
bpf_lru_list.c	bpf_lru_list: Read double-checked variable once without lock	2021-03-04 11:37:29 +01:00
bpf_lru_list.h
bpf_lsm.c
bpf_struct_ops_types.h
bpf_struct_ops.c
btf.c
cgroup.c	bpf, cgroup: Fix problematic bounds check	2021-02-10 09:29:12 +01:00
core.c
cpumap.c
devmap.c	bpf, devmap: Use GFP_KERNEL for xdp bulk queue allocation	2021-03-04 11:37:33 +01:00
disasm.c
disasm.h
dispatcher.c
hashtab.c
helpers.c	bpf: Fix helper bpf_map_peek_elem_proto pointing to wrong callback	2021-01-23 16:03:59 +01:00
inode.c
local_storage.c
lpm_trie.c
Makefile
map_in_map.c
map_in_map.h
map_iter.c
net_namespace.c
offload.c
percpu_freelist.c
percpu_freelist.h
prog_iter.c
queue_stack_maps.c
reuseport_array.c
ringbuf.c
stackmap.c	bpf: Check for integer overflow when using roundup_pow_of_two()	2021-02-17 11:02:25 +01:00
syscall.c	bpf: Prevent double bpf_prog_put call from bpf_tracing_prog_attach	2021-01-27 11:55:07 +01:00
sysfs_btf.c
task_iter.c
tnum.c
trampoline.c
verifier.c	bpf: Prohibit alu ops for pointer types not defining ptr_limit	2021-03-20 10:43:43 +01:00