| From foo@baz Wed May 28 21:03:54 PDT 2014 |
| From: Alexei Starovoitov <ast@plumgrid.com> |
| Date: Tue, 13 May 2014 15:05:55 -0700 |
| Subject: net: filter: x86: fix JIT address randomization |
| |
| From: Alexei Starovoitov <ast@plumgrid.com> |
| |
| [ Upstream commit 773cd38f40b8834be991dbfed36683acc1dd41ee ] |
| |
| bpf_alloc_binary() adds 128 bytes of room to JITed program image |
| and rounds it up to the nearest page size. If image size is close |
| to page size (like 4000), it is rounded to two pages: |
| round_up(4000 + 4 + 128) == 8192 |
| then 'hole' is computed as 8192 - (4000 + 4) = 4188 |
| If prandom_u32() % hole selects a number >= PAGE_SIZE - sizeof(*header) |
| then kernel will crash during bpf_jit_free(): |
| |
| kernel BUG at arch/x86/mm/pageattr.c:887! |
| Call Trace: |
| [<ffffffff81037285>] change_page_attr_set_clr+0x135/0x460 |
| [<ffffffff81694cc0>] ? _raw_spin_unlock_irq+0x30/0x50 |
| [<ffffffff810378ff>] set_memory_rw+0x2f/0x40 |
| [<ffffffffa01a0d8d>] bpf_jit_free_deferred+0x2d/0x60 |
| [<ffffffff8106bf98>] process_one_work+0x1d8/0x6a0 |
| [<ffffffff8106bf38>] ? process_one_work+0x178/0x6a0 |
| [<ffffffff8106c90c>] worker_thread+0x11c/0x370 |
| |
| since bpf_jit_free() does: |
| unsigned long addr = (unsigned long)fp->bpf_func & PAGE_MASK; |
| struct bpf_binary_header *header = (void *)addr; |
| to compute start address of 'bpf_binary_header' |
| and header->pages will pass junk to: |
| set_memory_rw(addr, header->pages); |
| |
| Fix it by making sure that &header->image[prandom_u32() % hole] and &header |
| are in the same page |
| |
| Fixes: 314beb9bcabfd ("x86: bpf_jit_comp: secure bpf jit against spraying attacks") |
| Signed-off-by: Alexei Starovoitov <ast@plumgrid.com> |
| Acked-by: Eric Dumazet <edumazet@google.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| arch/x86/net/bpf_jit_comp.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| --- a/arch/x86/net/bpf_jit_comp.c |
| +++ b/arch/x86/net/bpf_jit_comp.c |
| @@ -171,7 +171,7 @@ static struct bpf_binary_header *bpf_all |
| memset(header, 0xcc, sz); /* fill whole space with int3 instructions */ |
| |
| header->pages = sz / PAGE_SIZE; |
| - hole = sz - (proglen + sizeof(*header)); |
| + hole = min(sz - (proglen + sizeof(*header)), PAGE_SIZE - sizeof(*header)); |
| |
| /* insert a random number of int3 instructions before BPF code */ |
| *image_ptr = &header->image[prandom_u32() % hole]; |
