Daniel Borkmann 7d3baf0afa bpf: Fix kernel address leakage in atomic fetch
The change in commit 37086bfdc737 ("bpf: Propagate stack bounds to registers
in atomics w/ BPF_FETCH") around check_mem_access() handling is buggy since
this would allow for unprivileged users to leak kernel pointers. For example,
an atomic fetch/and with -1 on a stack destination which holds a spilled
pointer will migrate the spilled register type into a scalar, which can then
be exported out of the program (since scalar != pointer) by dumping it into
a map value.

The original implementation of XADD was preventing this situation by using
a double call to check_mem_access() one with BPF_READ and a subsequent one
with BPF_WRITE, in both cases passing -1 as a placeholder value instead of
register as per XADD semantics since it didn't contain a value fetch. The
BPF_READ also included a check in check_stack_read_fixed_off() which rejects
the program if the stack slot is of __is_pointer_value() if dst_regno < 0.
The latter is to distinguish whether we're dealing with a regular stack spill/
fill or some arithmetical operation which is disallowed on non-scalars, see
also 6e7e63cbb023 ("bpf: Forbid XADD on spilled pointers for unprivileged
users") for more context on check_mem_access() and its handling of placeholder
value -1.

One minimally intrusive option to fix the leak is for the BPF_FETCH case to
initially check the BPF_READ case via check_mem_access() with -1 as register,
followed by the actual load case with non-negative load_reg to propagate
stack bounds to registers.

Fixes: 37086bfdc737 ("bpf: Propagate stack bounds to registers in atomics w/ BPF_FETCH")
Reported-by: <n4ke4mry@gmail.com>
Acked-by: Brendan Jackman <jackmanb@google.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2021-12-14 19:33:06 -08:00
..
2021-11-09 10:56:41 -08:00
2021-10-19 17:27:05 +02:00
2021-11-01 20:05:19 -07:00
2021-11-18 10:50:45 -08:00
2021-11-01 20:25:38 -07:00
2021-11-01 21:17:39 -07:00
\n
2021-11-06 16:43:20 -07:00
2021-11-01 21:17:39 -07:00
2021-11-01 21:17:39 -07:00
2021-08-11 13:11:12 -07:00
2021-09-08 15:32:35 -07:00
2021-11-09 10:02:51 -08:00
2021-06-18 11:43:08 +02:00
2021-09-08 15:32:34 -07:00
2021-05-07 00:26:33 -07:00
2021-11-01 20:05:19 -07:00
2021-10-14 13:29:18 +02:00
2021-06-18 11:43:09 +02:00
2021-10-07 13:51:11 +02:00
2021-05-07 00:26:34 -07:00