Daniel Borkmann 6d4f151acf bpf: Fix passing modified ctx to ld/abs/ind instruction ... Anatoly has been fuzzing with kBdysch harness and reported a KASAN slab oob in one of the outcomes: [...] [ 77.359642] BUG: KASAN: slab-out-of-bounds in bpf_skb_load_helper_8_no_cache+0x71/0x130 [ 77.360463] Read of size 4 at addr ffff8880679bac68 by task bpf/406 [ 77.361119] [ 77.361289] CPU: 2 PID: 406 Comm: bpf Not tainted 5.5.0-rc2-xfstests-00157-g2187f215eba #1 [ 77.362134] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 [ 77.362984] Call Trace: [ 77.363249] dump_stack+0x97/0xe0 [ 77.363603] print_address_description.constprop.0+0x1d/0x220 [ 77.364251] ? bpf_skb_load_helper_8_no_cache+0x71/0x130 [ 77.365030] ? bpf_skb_load_helper_8_no_cache+0x71/0x130 [ 77.365860] __kasan_report.cold+0x37/0x7b [ 77.366365] ? bpf_skb_load_helper_8_no_cache+0x71/0x130 [ 77.366940] kasan_report+0xe/0x20 [ 77.367295] bpf_skb_load_helper_8_no_cache+0x71/0x130 [ 77.367821] ? bpf_skb_load_helper_8+0xf0/0xf0 [ 77.368278] ? mark_lock+0xa3/0x9b0 [ 77.368641] ? kvm_sched_clock_read+0x14/0x30 [ 77.369096] ? sched_clock+0x5/0x10 [ 77.369460] ? sched_clock_cpu+0x18/0x110 [ 77.369876] ? bpf_skb_load_helper_8+0xf0/0xf0 [ 77.370330] ___bpf_prog_run+0x16c0/0x28f0 [ 77.370755] __bpf_prog_run32+0x83/0xc0 [ 77.371153] ? __bpf_prog_run64+0xc0/0xc0 [ 77.371568] ? match_held_lock+0x1b/0x230 [ 77.371984] ? rcu_read_lock_held+0xa1/0xb0 [ 77.372416] ? rcu_is_watching+0x34/0x50 [ 77.372826] sk_filter_trim_cap+0x17c/0x4d0 [ 77.373259] ? sock_kzfree_s+0x40/0x40 [ 77.373648] ? __get_filter+0x150/0x150 [ 77.374059] ? skb_copy_datagram_from_iter+0x80/0x280 [ 77.374581] ? do_raw_spin_unlock+0xa5/0x140 [ 77.375025] unix_dgram_sendmsg+0x33a/0xa70 [ 77.375459] ? do_raw_spin_lock+0x1d0/0x1d0 [ 77.375893] ? unix_peer_get+0xa0/0xa0 [ 77.376287] ? __fget_light+0xa4/0xf0 [ 77.376670] __sys_sendto+0x265/0x280 [ 77.377056] ? __ia32_sys_getpeername+0x50/0x50 [ 77.377523] ? lock_downgrade+0x350/0x350 [ 77.377940] ? __sys_setsockopt+0x2a6/0x2c0 [ 77.378374] ? sock_read_iter+0x240/0x240 [ 77.378789] ? __sys_socketpair+0x22a/0x300 [ 77.379221] ? __ia32_sys_socket+0x50/0x50 [ 77.379649] ? mark_held_locks+0x1d/0x90 [ 77.380059] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 77.380536] __x64_sys_sendto+0x74/0x90 [ 77.380938] do_syscall_64+0x68/0x2a0 [ 77.381324] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 77.381878] RIP: 0033:0x44c070 [...] After further debugging, turns out while in case of other helper functions we disallow passing modified ctx, the special case of ld/abs/ind instruction which has similar semantics (except r6 being the ctx argument) is missing such check. Modified ctx is impossible here as bpf_skb_load_helper_8_no_cache() and others are expecting skb fields in original position, hence, add check_ctx_reg() to reject any modified ctx. Issue was first introduced back in f1174f77b5 ("bpf/verifier: rework value tracking"). Fixes: f1174f77b5 ("bpf/verifier: rework value tracking") Reported-by: Anatoly Trosinenko <anatoly.trosinenko@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://lore.kernel.org/bpf/20200106215157.3553-1-daniel@iogearbox.net		2020-01-06 14:19:47 -08:00
..
Makefile	bpf: Introduce BPF trampoline	2019-11-15 23:41:51 +01:00
arraymap.c	bpf: Simplify __bpf_arch_text_poke poke type handling	2019-11-24 17:12:11 -08:00
bpf_lru_list.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 206	2019-05-30 11:29:53 -07:00
bpf_lru_list.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 206	2019-05-30 11:29:53 -07:00
btf.c	bpf: Fix build in minimal configurations, again	2019-12-11 13:57:26 +01:00
cgroup.c	bpf: cgroup: prevent out-of-order release of cgroup bpf	2020-01-06 14:00:30 -08:00
core.c	bpf: Fix cgroup local storage prog tracking	2019-12-17 08:58:02 -08:00
cpumap.c	devmap/cpumap: Use flush list instead of bitmap	2019-06-29 01:31:08 +02:00
devmap.c	xdp: Fix cleanup on map free for devmap_hash map type	2019-11-24 16:58:46 -08:00
disasm.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 295	2019-06-05 17:36:38 +02:00
disasm.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 295	2019-06-05 17:36:38 +02:00
hashtab.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2019-06-17 20:20:36 -07:00
helpers.c	cgroup: use cgrp->kn->id as the cgroup ID	2019-11-12 08:18:04 -08:00
inode.c	bpf: Convert bpf_prog refcnt to atomic64_t	2019-11-18 11:41:59 +01:00
local_storage.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2019-12-22 09:54:33 -08:00
lpm_trie.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2019-06-22 08:59:24 -04:00
map_in_map.c	bpf: Move owner type, jited info into array auxiliary data	2019-11-24 17:04:11 -08:00
map_in_map.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 206	2019-05-30 11:29:53 -07:00
offload.c	bpf, offload: Unlock on error in bpf_offload_dev_create()	2019-11-07 00:20:27 +01:00
percpu_freelist.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 206	2019-05-30 11:29:53 -07:00
percpu_freelist.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 206	2019-05-30 11:29:53 -07:00
queue_stack_maps.c	bpf: move memory size checks to bpf_map_charge_init()	2019-05-31 16:52:56 -07:00
reuseport_array.c	bpf: move memory size checks to bpf_map_charge_init()	2019-05-31 16:52:56 -07:00
stackmap.c	Merge branch 'irq-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2019-12-03 09:29:50 -08:00
syscall.c	bpf: Add poke dependency tracking for prog array maps	2019-11-24 17:04:11 -08:00
sysfs_btf.c	btf: fix return value check in btf_vmlinux_init()	2019-08-15 22:18:17 -07:00
tnum.c	treewide: Add SPDX license identifier for missed files	2019-05-21 10:50:45 +02:00
trampoline.c	bpf: Make BPF trampoline use register_ftrace_direct() API	2019-12-11 15:18:08 -08:00
verifier.c	bpf: Fix passing modified ctx to ld/abs/ind instruction	2020-01-06 14:19:47 -08:00
xskmap.c	bpf: Switch bpf_map ref counter to atomic64_t so bpf_map_inc() never fails	2019-11-18 11:41:59 +01:00