• Daniel Borkmann's avatar
    bpf: Tighten speculative pointer arithmetic mask · 7fedb63a
    Daniel Borkmann authored
    This work tightens the offset mask we use for unprivileged pointer arithmetic
    in order to mitigate a corner case reported by Piotr and Benedict where in
    the speculative domain it is possible to advance, for example, the map value
    pointer by up to value_size-1 out-of-bounds in order to leak kernel memory
    via side-channel to user space.
    
    Before this change, the computed ptr_limit for retrieve_ptr_limit() helper
    represents largest valid distance when moving pointer to the right or left
    which is then fed as aux->alu_limit to generate masking instructions against
    the offset register. After the change, the derived aux->alu_limit represents
    the largest potential value of the offset register which we mask against which
    is just a narrower subset of the former limit.
    
    For minimal complexity, we call sanitize_ptr_alu() from 2 observation points
    in adjust_ptr_min_max_vals(), that is, before and after the simulated alu
    operation. In the first step, we retieve the alu_state and alu_limit before
    the operation as well as we branch-off a verifier path and push it to the
    verification stack as we did before which checks the dst_reg under truncation,
    in other words, when the speculative domain would attempt to move the pointer
    out-of-bounds.
    
    In the second step, we retrieve the new alu_limit and calculate the absolute
    distance between both. Moreover, we commit the alu_state and final alu_limit
    via update_alu_sanitation_state() to the env's instruction aux data, and bail
    out from there if there is a mismatch due to coming from different verification
    paths with different states.
    Reported-by: default avatarPiotr Krysiuk <piotras@gmail.com>
    Reported-by: default avatarBenedict Schlueter <benedict.schlueter@rub.de>
    Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
    Reviewed-by: default avatarJohn Fastabend <john.fastabend@gmail.com>
    Acked-by: default avatarAlexei Starovoitov <ast@kernel.org>
    Tested-by: default avatarBenedict Schlueter <benedict.schlueter@rub.de>
    7fedb63a
verifier.c 366 KB