Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Mon, 29 Jan 2018 13:31:10 +0100
From:   Greg KH <gregkh@linuxfoundation.org>
To:     Daniel Borkmann <daniel@iogearbox.net>
Cc:     David Woodhouse <dwmw2@infradead.org>,
        Alexei Starovoitov <ast@kernel.org>, davem@davemloft.net,
        netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
        kernel-team@fb.com,
        "stable@vger.kernel.org" <stable@vger.kernel.org>,
        "dave.hansen@linux.intel.com" <dave.hansen@linux.intel.com>
Subject: Re: [PATCH v3 bpf] bpf: introduce BPF_JIT_ALWAYS_ON config
Message-ID: <20180129123110.GB24544@kroah.com>
References: <20180109180429.1115005-1-ast@kernel.org>
 <606bf504-a39f-288d-11cd-56888ecbc165@iogearbox.net>
 <1516788431.13558.109.camel@infradead.org>
 <ef7bacfb-f233-ebd6-73d4-ba8501cafdba@iogearbox.net>
 <20180128144504.GB19937@kroah.com>
 <ed621015-cbe8-432c-82da-5b258d48ce1c@iogearbox.net>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <ed621015-cbe8-432c-82da-5b258d48ce1c@iogearbox.net>
User-Agent: Mutt/1.9.3 (2018-01-21)
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Mon, Jan 29, 2018 at 12:40:47AM +0100, Daniel Borkmann wrote:
> On 01/28/2018 03:45 PM, Greg KH wrote:
> > On Wed, Jan 24, 2018 at 11:10:50AM +0100, Daniel Borkmann wrote:
> >> On 01/24/2018 11:07 AM, David Woodhouse wrote:
> >>> On Tue, 2018-01-09 at 22:39 +0100, Daniel Borkmann wrote:
> >>>> On 01/09/2018 07:04 PM, Alexei Starovoitov wrote:
> >>>>>
> >>>>> The BPF interpreter has been used as part of the spectre 2 attack CVE-2017-5715.
> >>>>>
> >>>>> A quote from goolge project zero blog:
> >>>>> "At this point, it would normally be necessary to locate gadgets in
> >>>>> the host kernel code that can be used to actually leak data by reading
> >>>>> from an attacker-controlled location, shifting and masking the result
> >>>>> appropriately and then using the result of that as offset to an
> >>>>> attacker-controlled address for a load. But piecing gadgets together
> >>>>> and figuring out which ones work in a speculation context seems annoying.
> >>>>> So instead, we decided to use the eBPF interpreter, which is built into
> >>>>> the host kernel - while there is no legitimate way to invoke it from inside
> >>>>> a VM, the presence of the code in the host kernel's text section is sufficient
> >>>>> to make it usable for the attack, just like with ordinary ROP gadgets."
> >>>>>
> >>>>> To make attacker job harder introduce BPF_JIT_ALWAYS_ON config
> >>>>> option that removes interpreter from the kernel in favor of JIT-only mode.
> >>>>> So far eBPF JIT is supported by:
> >>>>> x64, arm64, arm32, sparc64, s390, powerpc64, mips64
> >>>>>
> >>>>> The start of JITed program is randomized and code page is marked as read-only.
> >>>>> In addition "constant blinding" can be turned on with net.core.bpf_jit_harden
> >>>>>
> >>>>> v2->v3:
> >>>>> - move __bpf_prog_ret0 under ifdef (Daniel)
> >>>>>
> >>>>> v1->v2:
> >>>>> - fix init order, test_bpf and cBPF (Daniel's feedback)
> >>>>> - fix offloaded bpf (Jakub's feedback)
> >>>>> - add 'return 0' dummy in case something can invoke prog->bpf_func
> >>>>> - retarget bpf tree. For bpf-next the patch would need one extra hunk.
> >>>>> ? It will be sent when the trees are merged back to net-next
> >>>>>
> >>>>> Considered doing:
> >>>>> ? int bpf_jit_enable __read_mostly = BPF_EBPF_JIT_DEFAULT;
> >>>>> but it seems better to land the patch as-is and in bpf-next remove
> >>>>> bpf_jit_enable global variable from all JITs, consolidate in one place
> >>>>> and remove this jit_init() function.
> >>>>>
> >>>>> Signed-off-by: Alexei Starovoitov <ast@kernel.org>
> >>>>
> >>>> Applied to bpf tree, thanks Alexei!
> >>>
> >>> For stable too?
> >>
> >> Yes, this will go into stable as well; batch of backports will come Thurs/Fri.
> > 
> > Any word on these?  Worse case, a simple list of git commit ids to
> > backport is all I need.
> 
> Sorry for the delay! There are various conflicts all over the place, so I had
> to backport manually. I just flushed out tested 4.14 batch, I'll see to get 4.9
> out hopefully tonight as well, and the rest for 4.4 on Mon.

Not a problem at all, wanted to make sure I didn't miss them having be
posted somewhere I missed :)

If you need/want help for the 4.4 stuff, just let me know, and I'll be
glad to work on it.

thanks,

greg k-h