Files
linux/include/linux
Daniel Borkmann 32556ce93b bpf: Fix helper writes to read-only maps
Lonial found an issue that despite user- and BPF-side frozen BPF map
(like in case of .rodata), it was still possible to write into it from
a BPF program side through specific helpers having ARG_PTR_TO_{LONG,INT}
as arguments.

In check_func_arg() when the argument is as mentioned, the meta->raw_mode
is never set. Later, check_helper_mem_access(), under the case of
PTR_TO_MAP_VALUE as register base type, it assumes BPF_READ for the
subsequent call to check_map_access_type() and given the BPF map is
read-only it succeeds.

The helpers really need to be annotated as ARG_PTR_TO_{LONG,INT} | MEM_UNINIT
when results are written into them as opposed to read out of them. The
latter indicates that it's okay to pass a pointer to uninitialized memory
as the memory is written to anyway.

However, ARG_PTR_TO_{LONG,INT} is a special case of ARG_PTR_TO_FIXED_SIZE_MEM
just with additional alignment requirement. So it is better to just get
rid of the ARG_PTR_TO_{LONG,INT} special cases altogether and reuse the
fixed size memory types. For this, add MEM_ALIGNED to additionally ensure
alignment given these helpers write directly into the args via *<ptr> = val.
The .arg*_size has been initialized reflecting the actual sizeof(*<ptr>).

MEM_ALIGNED can only be used in combination with MEM_FIXED_SIZE annotated
argument types, since in !MEM_FIXED_SIZE cases the verifier does not know
the buffer size a priori and therefore cannot blindly write *<ptr> = val.

Fixes: 57c3bb725a ("bpf: Introduce ARG_PTR_TO_{INT,LONG} arg types")
Reported-by: Lonial Con <kongln9170@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: Shung-Hsi Yu <shung-hsi.yu@suse.com>
Link: https://lore.kernel.org/r/20240913191754.13290-3-daniel@iogearbox.net
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2024-09-13 13:17:55 -07:00
..
2024-03-19 16:11:42 +01:00
2024-01-18 15:21:00 -08:00
2024-05-27 13:39:51 +02:00
2024-04-24 11:06:26 -07:00
2024-04-25 20:55:49 -07:00
2023-12-20 19:26:32 -05:00
2024-05-02 20:35:57 +02:00
2024-03-11 15:37:23 -07:00
2024-09-13 13:17:55 -07:00
2024-04-29 16:28:07 -07:00
2024-07-03 19:29:59 -07:00
2024-07-08 01:51:05 -06:00
2023-12-15 16:25:55 -08:00
2024-06-24 18:29:20 +02:00
2024-04-23 09:03:37 +09:00
2024-06-11 12:57:49 -05:00
2024-02-20 14:22:55 -05:00
2024-02-20 14:22:51 -05:00
2024-03-12 23:08:29 -07:00
2024-05-27 11:08:31 +02:00
2024-04-15 16:03:24 -04:00
2024-08-12 22:03:27 +02:00
2024-05-19 14:36:17 -07:00
2024-07-03 19:29:52 -07:00
2024-05-27 16:50:03 +02:00
2024-02-28 19:36:39 -08:00
2024-02-14 11:14:40 +01:00
2023-12-20 19:26:31 -05:00
2023-12-20 19:26:31 -05:00
2024-06-24 22:24:56 -07:00
2024-07-03 19:30:23 -07:00
2024-02-17 16:20:41 +01:00
2024-06-05 19:19:26 -07:00
2023-12-20 19:26:30 -05:00
2024-05-03 10:44:42 +01:00
2024-07-10 12:14:54 -07:00
2024-07-31 09:57:18 -07:00
2024-08-15 22:16:14 -07:00
2024-07-08 13:47:27 -04:00
2024-06-24 22:25:02 -07:00
2024-03-26 11:07:20 -07:00
2024-06-28 09:52:05 +02:00
2023-12-20 19:26:31 -05:00
2024-03-13 12:53:53 -07:00
2024-03-13 12:53:53 -07:00
2023-12-20 19:26:31 -05:00
2023-12-20 19:26:31 -05:00
2023-12-20 19:26:30 -05:00
2024-07-10 17:52:47 +02:00
2023-12-20 19:26:32 -05:00
2024-04-02 18:03:32 -07:00
2023-12-27 11:49:56 -05:00
2023-12-20 19:26:31 -05:00
2024-03-08 12:05:10 +01:00
2024-04-03 09:59:38 +01:00
2023-12-20 19:26:32 -05:00
2023-12-20 19:26:32 -05:00
2023-12-20 19:26:32 -05:00
2024-02-15 12:17:28 -05:00
2024-04-09 10:53:44 +02:00
2024-07-02 18:59:33 -07:00
2024-05-04 18:57:21 +02:00
2024-07-10 07:59:03 +02:00
2024-04-08 11:49:02 +01:00
2023-12-20 19:26:31 -05:00
2023-12-08 12:02:37 +01:00
2024-05-06 12:05:00 +02:00
2023-12-20 19:26:30 -05:00
2024-04-07 02:42:36 -04:00
2024-08-15 22:16:14 -07:00
2024-06-24 18:16:44 +01:00
2024-02-09 12:07:48 +00:00
2024-04-25 20:55:48 -07:00