Alexei Starovoitov
a9bfac14cd
bpf: prevent out-of-bounds speculation ...
commit b2157399cc9898260d6031c5bfe45fe137c1fbe7 upstream.
Under speculation, CPUs may mis-predict branches in bounds checks. Thus,
memory accesses under a bounds check may be speculated even if the
bounds check fails, providing a primitive for building a side channel.
To avoid leaking kernel data round up array-based maps and mask the index
after bounds check, so speculated load with out of bounds index will load
either valid value from the array or zero from the padded area.
Unconditionally mask index for all array types even when max_entries
are not rounded to power of 2 for root user.
When map is created by unpriv user generate a sequence of bpf insns
that includes AND operation to make sure that JITed code includes
the same 'index & index_mask' operation.
If prog_array map is created by unpriv user replace
bpf_tail_call(ctx, map, index);
with
if (index >= max_entries) {
index &= map->index_mask;
bpf_tail_call(ctx, map, index);
}
(along with roundup to power 2) to prevent out-of-bounds speculation.
There is secondary redundant 'if (index >= max_entries)' in the interpreter
and in all JITs, but they can be optimized later if necessary.
Other array-like maps (cpumap, devmap, sockmap, perf_event_array, cgroup_array)
cannot be used by unpriv, so no changes there.
That fixes bpf side of "Variant 1: bounds check bypass (CVE-2017-5753)" on
all architectures with and without JIT.
v2->v3:
Daniel noticed that attack potentially can be crafted via syscall commands
without loading the program, so add masking to those paths as well.
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Cc: Jiri Slaby <jslaby@suse.cz>
[ Backported to 4.9 - gregkh ]
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-01-17 09:38:55 +01:00
bpf: prevent out-of-bounds speculation
2018-01-17 09:38:55 +01:00
config: android: enable CONFIG_SECCOMP
2016-10-11 15:06:32 -07:00
kdb: Fix handling of kallsyms_symbol_next() return value
2017-12-14 09:28:13 +01:00
perf/x86/intel: Account interrupts for PEBS errors
2017-12-09 22:01:52 +01:00
gcov: support GCC 7.1
2017-09-02 07:07:53 +02:00
genirq: Make sparse_irq_lock protect what it should protect
2017-10-05 09:43:58 +02:00
livepatch/module: make TAINT_LIVEPATCH module-specific
2016-08-26 14:42:08 +02:00
locking/lockdep: Add nest_lock integrity test
2017-10-21 17:21:33 +02:00
sched/cpuset/pm: Fix cpuset vs. suspend-resume bugs
2017-10-12 11:51:25 +02:00
printk: use rcuidle console tracepoint
2017-02-23 17:44:36 +01:00
rcu: Allow for page faults in NMI handlers
2017-10-18 09:35:38 +02:00
sched/deadline: Use deadline instead of period when calculating overflow
2017-12-20 10:07:23 +01:00
nohz: Prevent a timer interrupt storm in tick_nohz_stop_sched_tick()
2018-01-02 20:35:17 +01:00
ring-buffer: Mask out the info bits when returning buffer page length
2018-01-02 20:35:07 +01:00
kernel/acct.c: fix the acct->needcheck check in check_free_space()
2018-01-10 09:29:51 +01:00
audit: ensure that 'audit=1' actually enables audit for PID 1
2017-12-16 16:25:47 +01:00
Merge branch 'stable-4.8' of git://git.infradead.org/users/pcmoore/audit
2016-07-29 17:54:17 -07:00
wrappers for ->i_mutex access
2016-01-22 18:04:28 -05:00
audit: cleanup prune_tree_thread
2016-04-04 09:46:47 -04:00
audit: Fix use after free in audit_remove_watch_rule()
2017-08-24 17:12:18 -07:00
audit: add fields to exclude filter by reusing user filter
2016-06-27 11:01:00 -04:00
Merge branch 'stable-4.9' of git://git.infradead.org/users/pcmoore/audit
2016-10-04 14:21:41 -07:00
ptrace: Capture the ptracer's creds not PT_PTRACE_CAP
2017-01-06 10:40:13 +01:00
cgroup: fix error return value from cgroup_subtree_control()
2017-08-11 08:49:28 -07:00
cgroup/pids: remove spurious suspicious RCU usage warning
2017-03-26 13:05:58 +02:00
timers: Reinitialize per cpu bases on hotplug
2018-01-02 20:35:17 +01:00
sched/cpuset/pm: Fix cpuset vs. suspend-resume bugs
2017-10-12 11:51:25 +02:00
cred: Reject inodes with invalid ids in set_create_file_as()
2016-06-30 18:05:09 -05:00
kmemcg: account certain kmem allocations to memcg
2016-01-14 16:00:49 -08:00
sched/autogroup: Do not use autogroup->tg in zombie threads
2016-11-22 12:33:43 +01:00
kernel/extable.c: mark core_kernel_text notrace
2017-07-21 07:42:21 +02:00
kaiser: stack map PAGE_SIZE at THREAD_SIZE-PAGE_SIZE
2018-01-05 15:46:32 +01:00
freezer, oom: check TIF_MEMDIE on the correct task
2016-07-28 16:07:41 -07:00
futex: Remove unnecessary warning from get_futex_key
2017-08-16 13:43:15 -07:00
ptrace: use fsuid, fsgid, effective creds for fs access checks
2016-01-20 17:09:18 -08:00
kernel: make groups_sort calling a responsibility group_info allocators
2018-01-10 09:29:52 +01:00
hung_task: allow hung_task_panic when hung_task_warnings is 0
2016-10-11 15:06:33 -07:00
jump_label: Invoke jump_label_test() via early_initcall()
2017-12-14 09:28:24 +01:00
kallsyms: add support for relative offsets in kallsyms address table
2016-03-15 16:55:16 -07:00
ptrace: use fsuid, fsgid, effective creds for fs access checks
2016-01-20 17:09:18 -08:00
kcov: add missing #include <linux/sched.h>
2016-12-07 17:10:00 -08:00
kexec: allow architectures to override boot mapping
2016-08-02 19:35:27 -04:00
kexec: add restriction on kexec_load() segment sizes
2016-08-02 19:35:31 -04:00
kexec: fix double-free when failing to relocate the purgatory
2016-09-01 17:52:01 -07:00
kexec: move some memembers and definitions within the scope of CONFIG_KEXEC_FILE
2016-01-20 17:09:18 -08:00
tracing/kprobes: Enforce kprobes teardown after testing
2017-05-25 15:44:47 +02:00
kexec: add a kexec_crash_loaded() function
2016-08-02 19:35:30 -04:00
cgroup, kthread: close race window where new kthreads can be migrated to non-root cgroups
2017-04-21 09:31:18 +02:00
sched/debug: Make schedstats a runtime tunable that is disabled by default
2016-02-09 11:54:23 +01:00
kernel/watchdog.c: move hardlockup detector to separate file
2017-06-17 06:41:57 +02:00
Fix: Disable sys_membarrier when nohz_full is enabled
2017-03-12 06:41:45 +01:00
mm, devm_memremap_pages: hold device_hotplug lock over mem_hotplug_{begin, done}
2017-03-12 06:41:43 +01:00
Re-enable CONFIG_MODVERSIONS in a slightly weaker form
2016-11-29 16:01:30 -08:00
KEYS: Move the point of trust determination to __key_link()
2016-04-11 22:43:43 +01:00
cgroup: introduce cgroup namespaces
2016-02-16 13:04:58 -05:00
padata: free correct variable
2017-05-20 14:28:40 +02:00
kernel/panic.c: add missing \n
2017-07-05 14:40:24 +02:00
pids: make task_tgid_nr_ns() safe
2017-08-24 17:12:21 -07:00
pid_ns: Sleep in TASK_INTERRUPTIBLE in zap_pid_ns_processes
2017-05-25 15:44:38 +02:00
profile: Convert to hotplug state machine
2016-07-15 10:41:42 +02:00
ptrace: Properly initialize ptracer_cred on fork
2017-06-14 15:05:54 +02:00
relay: check array offset before using it
2017-01-12 11:39:30 +01:00
/proc/iomem: only expose physical resource addresses to privileged users
2016-04-14 12:56:09 -07:00
seccomp: fix the usage of get/put_seccomp_filter() in seccomp_get_filter()
2017-10-05 09:44:02 +02:00
kernel/signal.c: remove the no longer needed SIGNAL_UNKILLABLE check in complete_signal()
2018-01-10 09:29:53 +01:00
smp: Allocate smp_call_on_cpu() workqueue on stack too
2016-09-22 14:49:10 +02:00
kthread/smpboot: do not park in kthread_create_on_cpu()
2016-10-11 15:06:33 -07:00
cpu/hotplug: Create hotplug threads
2016-03-01 20:36:56 +01:00
softirq: Display IRQ_POLL for irq-poll statistics
2016-10-21 15:45:47 -06:00
stacktrace, lockdep: Fix address, newline ugliness
2017-02-14 15:25:42 -08:00
Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2016-10-03 13:39:00 -07:00
prctl: make PR_SET_THP_DISABLE wait for mmap_sem killable
2016-05-23 17:04:14 -07:00
x86/pkeys: Fix pkeys build breakage for some non-x86 arches
2016-09-13 14:41:36 +02:00
timer/sysclt: Restrict timer migration sysctl values to 0 and 1
2017-10-05 09:44:04 +02:00
kernel/sysctl_binary.c: use generic UUID library
2016-05-20 17:58:30 -07:00
task_work: use READ_ONCE/lockless_dereference, avoid pi_lock if !task_works
2016-08-02 19:35:02 -04:00
taskstats: fix the length of cgroupstats_cmd_get_policy
2016-11-03 16:55:58 -04:00
torture: Convert torture_shutdown() to hrtimer
2016-08-22 10:01:49 -07:00
kernel/...: convert pr_warning to pr_warn
2016-03-22 15:36:02 -07:00
time, acct: Drop irq save & restore from __acct_update_integrals()
2016-02-29 09:53:09 +01:00
kernel/ucount.c: mark user_header with kmemleak_ignore()
2017-06-17 06:41:51 +02:00
kernel: make groups_sort calling a responsibility group_info allocators
2018-01-10 09:29:52 +01:00
smp: Add function to execute a function synchronously on a CPU
2016-09-05 13:52:39 +02:00
Merge branch 'nsfs-ioctls' into HEAD
2016-09-22 20:00:36 -05:00
Merge branch 'nsfs-ioctls' into HEAD
2016-09-22 20:00:36 -05:00
kernel/watchdog: prevent false hardlockup on overloaded system
2017-06-17 06:41:57 +02:00
kernel/watchdog: prevent false hardlockup on overloaded system
2017-06-17 06:41:57 +02:00
workqueue: trigger WARN if queue_delayed_work() is called with NULL @wq
2017-12-14 09:28:19 +01:00
workqueue: Fix NULL pointer dereference
2017-11-15 15:53:17 +01:00
a9bfac14cd