Arm security updates as of 18th of January 2018
-----BEGIN PGP SIGNATURE-----

iQIzBAABCAAdFiEE5RElWfyWxS+3PLO2a9axLQDIXvEFAlpg6kYACgkQa9axLQDI
XvHVdA//Sbll+0CSN3nHrytJcAXtfBmSJZJbaJ2YKObYRGgHwVNb4O83di3NIRQ6
LmqUCHHFUSJofqNYUAaBJtUf+6bWTLILsGAQo6W0igUgGXD0ih7OCNthSLfRMJx+
xnC0DnL9B7iXoeCr7xgcYQvJksarXYDrlJ5MPmSnmpffzoHOamvf2QMb53aOeQ06
tcQtPt3+QAG8szTTfESnuBe/J/i/sOd7xaKMJISMSRpYz83E8cxL8frrDGv3Ikpq
YWn4KoXCLPH4oi/8V2pmI8m3LiLFn6s94Fl1tnx6LxTH3J3wiGFKMZTs0hOUU8h0
5bVZEo6J1XYPbUdWoIvkPiyXS+2JE1hXoYrdHinhiWcgraAlBAsudmfWcg3/DMQ6
iMxzR/bfEc74C1UTId6rCJcbF05DoRGYb3oqGoTcpZpMeelk+sdTaoZrYP6lo8Uo
mShz/Pn6dPM7udjud5NxcECh54YY26BaWPohgdHLN3Qco34saxa62eBH/Au+irQa
cpRiY0YNoWZBxp/AKz7UQApRAoLT9Tc31bf62UfBM2q/LkguCooQXbVzt/u+OpBp
3F5acmFIjwDI2E5Sm5RXea4zF+1PQTVkaOOWZR8ufvG+b1K9zF+AZnGvrXabWFQ+
Xxlpne5HtpLm7HXvfK9nCO8rb741xc+hWGKnrhIfvQKDtkRukDc=
=qTDl
-----END PGP SIGNATURE-----
bpf: prevent out-of-bounds speculation

Under speculation, CPUs may mis-predict branches in bounds checks. Thus,
memory accesses under a bounds check may be speculated even if the
bounds check fails, providing a primitive for building a side channel.

To avoid leaking kernel data round up array-based maps and mask the index
after bounds check, so speculated load with out of bounds index will load
either valid value from the array or zero from the padded area.

Unconditionally mask index for all array types even when max_entries
are not rounded to power of 2 for root user.
When map is created by unpriv user generate a sequence of bpf insns
that includes AND operation to make sure that JITed code includes
the same 'index & index_mask' operation.

If prog_array map is created by unpriv user replace
  bpf_tail_call(ctx, map, index);
with
  if (index >= max_entries) {
    index &= map->index_mask;
    bpf_tail_call(ctx, map, index);
  }
(along with roundup to power 2) to prevent out-of-bounds speculation.
There is secondary redundant 'if (index >= max_entries)' in the interpreter
and in all JITs, but they can be optimized later if necessary.

Other array-like maps (cpumap, devmap, sockmap, perf_event_array, cgroup_array)
cannot be used by unpriv, so no changes there.

That fixes bpf side of "Variant 1: bounds check bypass (CVE-2017-5753)" on
all architectures with and without JIT.

v2->v3:
Daniel noticed that attack potentially can be crafted via syscall commands
without loading the program, so add masking to those paths as well.

Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
3 files changed