Re: [RFC v3 04/22] bpf: Set register type according to is_valid_access()
From: Daniel Borkmann <daniel@iogearbox.net>
Date: 2016-10-19 15:10:42
Also in:
cgroups, linux-api, lkml
On 10/19/2016 04:54 PM, Thomas Graf wrote:
On 09/14/16 at 09:23am, Mickaël Salaün wrote:quoted
This fix a pointer leak when an unprivileged eBPF program read a pointer value from the context. Even if is_valid_access() returns a pointer type, the eBPF verifier replace it with UNKNOWN_VALUE. The register value containing an address is then allowed to leak. Moreover, this prevented unprivileged eBPF programs to use functions with (legitimate) pointer arguments. This bug was not a problem until now because the only unprivileged eBPF program allowed is of type BPF_PROG_TYPE_SOCKET_FILTER and all the types from its context are UNKNOWN_VALUE. Signed-off-by: Mickaël Salaün <mic@digikod.net> Fixes: 969bf05eb3ce ("bpf: direct packet access") Cc: Alexei Starovoitov <ast@kernel.org> Cc: Daniel Borkmann <daniel@iogearbox.net>Can you post this fix separately? It's valid and needed outside of the scope of this series.
Yes, that one was already merged: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1955351da41caa1dbf4139191358fed84909d64b