On 1/12/24 7:20 AM, Hao Sun wrote:
> For PTR_TO_FLOW_KEYS, check_flow_keys_access() only uses fixed off
> for validation. However, variable offset ptr alu is not prohibited
> for this ptr kind. So the variable offset is not checked.
>
> The following prog is accepted:
> func#0 @0
> 0: R1=ctx() R10=fp0
> 0: (bf) r6 = r1 ; R1=ctx() R6_w=ctx()
> 1: (79) r7 = *(u64 *)(r6 +144) ; R6_w=ctx() R7_w=flow_keys()
> 2: (b7) r8 = 1024 ; R8_w=1024
> 3: (37) r8 /= 1 ; R8_w=scalar()
> 4: (57) r8 &= 1024 ; R8_w=scalar(smin=smin32=0,
> smax=umax=smax32=umax32=1024,var_off=(0x0; 0x400))
> 5: (0f) r7 += r8
> mark_precise: frame0: last_idx 5 first_idx 0 subseq_idx -1
> mark_precise: frame0: regs=r8 stack= before 4: (57) r8 &= 1024
> mark_precise: frame0: regs=r8 stack= before 3: (37) r8 /= 1
> mark_precise: frame0: regs=r8 stack= before 2: (b7) r8 = 1024
> 6: R7_w=flow_keys(smin=smin32=0,smax=umax=smax32=umax32=1024,var_off
> =(0x0; 0x400)) R8_w=scalar(smin=smin32=0,smax=umax=smax32=umax32=1024,
> var_off=(0x0; 0x400))
> 6: (79) r0 = *(u64 *)(r7 +0) ; R0_w=scalar()
> 7: (95) exit
>
> This prog loads flow_keys to r7, and adds the variable offset r8
> to r7, and finally causes out-of-bounds access:
>
> BUG: unable to handle page fault for address: ffffc90014c80038
> ...
> Call Trace:
> <TASK>
> bpf_dispatcher_nop_func include/linux/bpf.h:1231 [inline]
> __bpf_prog_run include/linux/filter.h:651 [inline]
> bpf_prog_run include/linux/filter.h:658 [inline]
> bpf_prog_run_pin_on_cpu include/linux/filter.h:675 [inline]
> bpf_flow_dissect+0x15f/0x350 net/core/flow_dissector.c:991
> bpf_prog_test_run_flow_dissector+0x39d/0x620 net/bpf/test_run.c:1359
> bpf_prog_test_run kernel/bpf/syscall.c:4107 [inline]
> __sys_bpf+0xf8f/0x4560 kernel/bpf/syscall.c:5475
> __do_sys_bpf kernel/bpf/syscall.c:5561 [inline]
> __se_sys_bpf kernel/bpf/syscall.c:5559 [inline]
> __x64_sys_bpf+0x73/0xb0 kernel/bpf/syscall.c:5559
> do_syscall_x64 arch/x86/entry/common.c:52 [inline]
> do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:83
> entry_SYSCALL_64_after_hwframe+0x63/0x6b
>
> Fix this by rejecting ptr alu with variable offset on flow_keys.
> Applying the patch makes the program rejected with "R7 pointer
> arithmetic on flow_keys prohibited"
>
> Fixes: d58e468b1112 ("flow_dissector: implements flow dissector BPF hook")
> Signed-off-by: Hao Sun <[email protected]>
Acked-by: Yonghong Song <[email protected]>
> ---
> kernel/bpf/verifier.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index adbf330d364b..65f598694d55 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -12826,6 +12826,10 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env,
> }
>
> switch (base_type(ptr_reg->type)) {
> + case PTR_TO_FLOW_KEYS:
> + if (known)
> + break;
> + fallthrough;
> case CONST_PTR_TO_MAP:
> /* smin_val represents the known value */
> if (known && smin_val == 0 && opcode == BPF_ADD)