| From 21788c5725ee84efb31c294df3ad991d61f5c8d2 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Wed, 16 Jun 2021 15:55:00 -0700 |
| Subject: bpf: Fix null ptr deref with mixed tail calls and subprogs |
| |
| From: John Fastabend <john.fastabend@gmail.com> |
| |
| [ Upstream commit 7506d211b932870155bcb39e3dd9e39fab45a7c7 ] |
| |
| The sub-programs prog->aux->poke_tab[] is populated in jit_subprogs() and |
| then used when emitting 'BPF_JMP|BPF_TAIL_CALL' insn->code from the |
| individual JITs. The poke_tab[] to use is stored in the insn->imm by |
| the code adding it to that array slot. The JIT then uses imm to find the |
| right entry for an individual instruction. In the x86 bpf_jit_comp.c |
| this is done by calling emit_bpf_tail_call_direct with the poke_tab[] |
| of the imm value. |
| |
| However, we observed the below null-ptr-deref when mixing tail call |
| programs with subprog programs. For this to happen we just need to |
| mix bpf-2-bpf calls and tailcalls with some extra calls or instructions |
| that would be patched later by one of the fixup routines. So whats |
| happening? |
| |
| Before the fixup_call_args() -- where the jit op is done -- various |
| code patching is done by do_misc_fixups(). This may increase the |
| insn count, for example when we patch map_lookup_up using map_gen_lookup |
| hook. This does two things. First, it means the instruction index, |
| insn_idx field, of a tail call instruction will move by a 'delta'. |
| |
| In verifier code, |
| |
| struct bpf_jit_poke_descriptor desc = { |
| .reason = BPF_POKE_REASON_TAIL_CALL, |
| .tail_call.map = BPF_MAP_PTR(aux->map_ptr_state), |
| .tail_call.key = bpf_map_key_immediate(aux), |
| .insn_idx = i + delta, |
| }; |
| |
| Then subprog start values subprog_info[i].start will be updated |
| with the delta and any poke descriptor index will also be updated |
| with the delta in adjust_poke_desc(). If we look at the adjust |
| subprog starts though we see its only adjusted when the delta |
| occurs before the new instructions, |
| |
| /* NOTE: fake 'exit' subprog should be updated as well. */ |
| for (i = 0; i <= env->subprog_cnt; i++) { |
| if (env->subprog_info[i].start <= off) |
| continue; |
| |
| Earlier subprograms are not changed because their start values |
| are not moved. But, adjust_poke_desc() does the offset + delta |
| indiscriminately. The result is poke descriptors are potentially |
| corrupted. |
| |
| Then in jit_subprogs() we only populate the poke_tab[] |
| when the above insn_idx is less than the next subprogram start. From |
| above we corrupted our insn_idx so we might incorrectly assume a |
| poke descriptor is not used in a subprogram omitting it from the |
| subprogram. And finally when the jit runs it does the deref of poke_tab |
| when emitting the instruction and crashes with below. Because earlier |
| step omitted the poke descriptor. |
| |
| The fix is straight forward with above context. Simply move same logic |
| from adjust_subprog_starts() into adjust_poke_descs() and only adjust |
| insn_idx when needed. |
| |
| [ 82.396354] bpf_testmod: version magic '5.12.0-rc2alu+ SMP preempt mod_unload ' should be '5.12.0+ SMP preempt mod_unload ' |
| [ 82.623001] loop10: detected capacity change from 0 to 8 |
| [ 88.487424] ================================================================== |
| [ 88.487438] BUG: KASAN: null-ptr-deref in do_jit+0x184a/0x3290 |
| [ 88.487455] Write of size 8 at addr 0000000000000008 by task test_progs/5295 |
| [ 88.487471] CPU: 7 PID: 5295 Comm: test_progs Tainted: G I 5.12.0+ #386 |
| [ 88.487483] Hardware name: Dell Inc. Precision 5820 Tower/002KVM, BIOS 1.9.2 01/24/2019 |
| [ 88.487490] Call Trace: |
| [ 88.487498] dump_stack+0x93/0xc2 |
| [ 88.487515] kasan_report.cold+0x5f/0xd8 |
| [ 88.487530] ? do_jit+0x184a/0x3290 |
| [ 88.487542] do_jit+0x184a/0x3290 |
| ... |
| [ 88.487709] bpf_int_jit_compile+0x248/0x810 |
| ... |
| [ 88.487765] bpf_check+0x3718/0x5140 |
| ... |
| [ 88.487920] bpf_prog_load+0xa22/0xf10 |
| |
| Fixes: a748c6975dea3 ("bpf: propagate poke descriptors to subprograms") |
| Reported-by: Jussi Maki <joamaki@gmail.com> |
| Signed-off-by: John Fastabend <john.fastabend@gmail.com> |
| Signed-off-by: Alexei Starovoitov <ast@kernel.org> |
| Reviewed-by: Daniel Borkmann <daniel@iogearbox.net> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| kernel/bpf/verifier.c | 6 ++++-- |
| 1 file changed, 4 insertions(+), 2 deletions(-) |
| |
| diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c |
| index e97724e36dfb..bf6798fb2331 100644 |
| --- a/kernel/bpf/verifier.c |
| +++ b/kernel/bpf/verifier.c |
| @@ -10532,7 +10532,7 @@ static void adjust_subprog_starts(struct bpf_verifier_env *env, u32 off, u32 len |
| } |
| } |
| |
| -static void adjust_poke_descs(struct bpf_prog *prog, u32 len) |
| +static void adjust_poke_descs(struct bpf_prog *prog, u32 off, u32 len) |
| { |
| struct bpf_jit_poke_descriptor *tab = prog->aux->poke_tab; |
| int i, sz = prog->aux->size_poke_tab; |
| @@ -10540,6 +10540,8 @@ static void adjust_poke_descs(struct bpf_prog *prog, u32 len) |
| |
| for (i = 0; i < sz; i++) { |
| desc = &tab[i]; |
| + if (desc->insn_idx <= off) |
| + continue; |
| desc->insn_idx += len - 1; |
| } |
| } |
| @@ -10560,7 +10562,7 @@ static struct bpf_prog *bpf_patch_insn_data(struct bpf_verifier_env *env, u32 of |
| if (adjust_insn_aux_data(env, new_prog, off, len)) |
| return NULL; |
| adjust_subprog_starts(env, off, len); |
| - adjust_poke_descs(new_prog, len); |
| + adjust_poke_descs(new_prog, off, len); |
| return new_prog; |
| } |
| |
| -- |
| 2.30.2 |
| |