[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 15 Jun 2021 19:51:07 +0100
From: Edward Cree <ecree.xilinx@...il.com>
To: Kurt Manucredo <fuzzybritches0@...il.com>, ebiggers@...nel.org,
syzbot+bed360704c521841c85d@...kaller.appspotmail.com
Cc: keescook@...omium.org, yhs@...com, dvyukov@...gle.com, andrii@...nel.org,
ast@...nel.org, bpf@...r.kernel.org, daniel@...earbox.net,
davem@...emloft.net, hawk@...nel.org, john.fastabend@...il.com,
kafai@...com, kpsingh@...nel.org, kuba@...nel.org,
linux-kernel@...r.kernel.org, netdev@...r.kernel.org, songliubraving@...com,
syzkaller-bugs@...glegroups.com, nathan@...nel.org, ndesaulniers@...gle.com,
clang-built-linux@...glegroups.com, kernel-hardening@...ts.openwall.com,
kasan-dev@...glegroups.com
Subject: Re: [PATCH v5] bpf: core: fix shift-out-of-bounds in ___bpf_prog_run
On 15/06/2021 17:42, Kurt Manucredo wrote:
> Syzbot detects a shift-out-of-bounds in ___bpf_prog_run()
> kernel/bpf/core.c:1414:2.
>
> The shift-out-of-bounds happens when we have BPF_X. This means we have
> to go the same way we go when we want to avoid a divide-by-zero. We do
> it in do_misc_fixups().
Shifts by more than insn_bitness are legal in the eBPF ISA; they are
implementation-defined behaviour, rather than UB, and have been made
legal for performance reasons. Each of the JIT backends compiles the
eBPF shift operations to machine instructions which produce
implementation-defined results in such a case; the resulting contents
of the register may be arbitrary but program behaviour as a whole
remains defined.
Guard checks in the fast path (i.e. affecting JITted code) will thus
not be accepted.
The case of division by zero is not truly analogous, as division
instructions on many of the JIT-targeted architectures will raise a
machine exception / fault on division by zero, whereas (to the best of
my knowledge) none will do so on an out-of-bounds shift.
(That said, it would be possible to record from the verifier division
instructions in the program which are known never to be passed zero as
divisor, and eliding the fixup patch in those cases. However, the
extra complexity may not be worthwhile.)
As I understand it, the UBSAN report is coming from the eBPF interpreter,
which is the *slow path* and indeed on many production systems is
compiled out for hardening reasons (CONFIG_BPF_JIT_ALWAYS_ON).
Perhaps a better approach to the fix would be to change the interpreter
to compute "DST = DST << (SRC & 63);" (and similar for other shifts and
bitnesses), thus matching the behaviour of most chips' shift opcodes.
This would shut up UBSAN, without affecting JIT code generation.
-ed
Powered by blists - more mailing lists
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
