Received: by 2002:a05:6a11:4021:0:0:0:0 with SMTP id ky33csp153237pxb; Mon, 13 Sep 2021 15:39:17 -0700 (PDT) X-Google-Smtp-Source: ABdhPJy8OdXw+rRKpXfbt6AWuC6VELmmS8wM+JCxiAq6oVko55/neJUph9s+9F45FWgAzaBuXg3K X-Received: by 2002:a5e:c609:: with SMTP id f9mr11283443iok.127.1631572757176; Mon, 13 Sep 2021 15:39:17 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1631572757; cv=none; d=google.com; s=arc-20160816; b=MVf7kzH4EMm49371UJMeRbeqmTHpPBnVjxAYujUQWT9GC87lef2PyixAZVXeYOV1dO YOGd7I/4QGDzZAJZAw45M3b3sdaVt5j1Fa+dDWeC/lS/seFomwDYsas3obkcLEjre8/q iDQlaPXS6fVBMLsXrAxlmkb3XFvzgrq512N/b84fZN37U5o1K9xFTzU20w4H8xvl/4JK WRocLgj0EXiTTOpVv4C4ALNcBoGdHFlf2SgukeDxos2Qb5y/AYAqE+M9PIuTO1TD6VFQ jYArrkraCSGiOai5sgO36Rvj5gcnri2P3fRaicjW0qvz3vci9c6Z8n+xHoVjAwDzrgGU sr1Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=uvEawz/NG0ZPkHkBEw6Lf+/PXlGa0Fu26SxFp+ISjO4=; b=dvV4dd+NG2hXqJ9BONkR7NYKcfskyxe8Ysz8lNvYe6BMgTGM7n3sIs/U8Y/s2K0uAI UBmWAGIZzyyPxvp/r7ZRIX7f491I6oW257SUMhgLpFsQ09f8KoiR+CZWObdGdJmaTwJV T3hY6FdOfR/M2UMfYi3HmTA4XPlrDL8zZmvRP0ZNCFTPA64bOCF6d+zSGmtPF03wztyh jZxWOhEKamO/i5gN7T1l/lUYOOGjp995k4KE41ulYsBNNkfKvQ2e+DxS7PEQP3WcyWN4 l51u85LmawUXRUJEyq4mnh5yJ+rz1gSuSGKoIR7/OANI02f+6IXoa/sqTx6FxNjSAvHk 5dKQ== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=hIQRQiv+; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id l5si9263718jaj.63.2021.09.13.15.39.06; Mon, 13 Sep 2021 15:39:17 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=hIQRQiv+; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242208AbhIMORu (ORCPT + 99 others); Mon, 13 Sep 2021 10:17:50 -0400 Received: from mail.kernel.org ([198.145.29.99]:59698 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344290AbhIMOLp (ORCPT ); Mon, 13 Sep 2021 10:11:45 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 6F1A161ABD; Mon, 13 Sep 2021 13:42:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1631540543; bh=W02HmIHpe4fzJ7zjhUqqj7bG4CUN2Dv7LhZEKUdEY1U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=hIQRQiv+dAJlW17PJFu5nEhe0oURZAHkH3Cv5ExLhc3MT+X6qQ9TUv+jg6fZKdeV3 84ahcAz4O0jADRHnAMLNxGUBlFGsD4nA4NlZ7s0OP9ZezdbmWguY3lo06U5jUSRzMj BhV4VIuVuBYEBYadKn2OM1DFGosaypcTCuvq8R1A= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Carpenter , Andrey Ignatov , Alexei Starovoitov , Sasha Levin Subject: [PATCH 5.13 229/300] bpf: Fix possible out of bound write in narrow load handling Date: Mon, 13 Sep 2021 15:14:50 +0200 Message-Id: <20210913131117.085088434@linuxfoundation.org> X-Mailer: git-send-email 2.33.0 In-Reply-To: <20210913131109.253835823@linuxfoundation.org> References: <20210913131109.253835823@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Andrey Ignatov [ Upstream commit d7af7e497f0308bc97809cc48b58e8e0f13887e1 ] Fix a verifier bug found by smatch static checker in [0]. This problem has never been seen in prod to my best knowledge. Fixing it still seems to be a good idea since it's hard to say for sure whether it's possible or not to have a scenario where a combination of convert_ctx_access() and a narrow load would lead to an out of bound write. When narrow load is handled, one or two new instructions are added to insn_buf array, but before it was only checked that cnt >= ARRAY_SIZE(insn_buf) And it's safe to add a new instruction to insn_buf[cnt++] only once. The second try will lead to out of bound write. And this is what can happen if `shift` is set. Fix it by making sure that if the BPF_RSH instruction has to be added in addition to BPF_AND then there is enough space for two more instructions in insn_buf. The full report [0] is below: kernel/bpf/verifier.c:12304 convert_ctx_accesses() warn: offset 'cnt' incremented past end of array kernel/bpf/verifier.c:12311 convert_ctx_accesses() warn: offset 'cnt' incremented past end of array kernel/bpf/verifier.c 12282 12283 insn->off = off & ~(size_default - 1); 12284 insn->code = BPF_LDX | BPF_MEM | size_code; 12285 } 12286 12287 target_size = 0; 12288 cnt = convert_ctx_access(type, insn, insn_buf, env->prog, 12289 &target_size); 12290 if (cnt == 0 || cnt >= ARRAY_SIZE(insn_buf) || ^^^^^^^^^^^^^^^^^^^^^^^^^^^ Bounds check. 12291 (ctx_field_size && !target_size)) { 12292 verbose(env, "bpf verifier is misconfigured\n"); 12293 return -EINVAL; 12294 } 12295 12296 if (is_narrower_load && size < target_size) { 12297 u8 shift = bpf_ctx_narrow_access_offset( 12298 off, size, size_default) * 8; 12299 if (ctx_field_size <= 4) { 12300 if (shift) 12301 insn_buf[cnt++] = BPF_ALU32_IMM(BPF_RSH, ^^^^^ increment beyond end of array 12302 insn->dst_reg, 12303 shift); --> 12304 insn_buf[cnt++] = BPF_ALU32_IMM(BPF_AND, insn->dst_reg, ^^^^^ out of bounds write 12305 (1 << size * 8) - 1); 12306 } else { 12307 if (shift) 12308 insn_buf[cnt++] = BPF_ALU64_IMM(BPF_RSH, 12309 insn->dst_reg, 12310 shift); 12311 insn_buf[cnt++] = BPF_ALU64_IMM(BPF_AND, insn->dst_reg, ^^^^^^^^^^^^^^^ Same. 12312 (1ULL << size * 8) - 1); 12313 } 12314 } 12315 12316 new_prog = bpf_patch_insn_data(env, i + delta, insn_buf, cnt); 12317 if (!new_prog) 12318 return -ENOMEM; 12319 12320 delta += cnt - 1; 12321 12322 /* keep walking new program and skip insns we just inserted */ 12323 env->prog = new_prog; 12324 insn = new_prog->insnsi + i + delta; 12325 } 12326 12327 return 0; 12328 } [0] https://lore.kernel.org/bpf/20210817050843.GA21456@kili/ v1->v2: - clarify that problem was only seen by static checker but not in prod; Fixes: 46f53a65d2de ("bpf: Allow narrow loads with offset > 0") Reported-by: Dan Carpenter Signed-off-by: Andrey Ignatov Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20210820163935.1902398-1-rdna@fb.com Signed-off-by: Sasha Levin --- kernel/bpf/verifier.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index c07126558bb7..d810f9e0ed9d 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -11982,6 +11982,10 @@ static int convert_ctx_accesses(struct bpf_verifier_env *env) if (is_narrower_load && size < target_size) { u8 shift = bpf_ctx_narrow_access_offset( off, size, size_default) * 8; + if (shift && cnt + 1 >= ARRAY_SIZE(insn_buf)) { + verbose(env, "bpf verifier narrow ctx load misconfigured\n"); + return -EINVAL; + } if (ctx_field_size <= 4) { if (shift) insn_buf[cnt++] = BPF_ALU32_IMM(BPF_RSH, -- 2.30.2