[bpf,v6,0/3] bpf: prevent userspace memory access

Message

Puranjay Mohan April 24, 2024, 10:02 a.m. UTC

V5: https://lore.kernel.org/bpf/[e-mail]/
Changes in V6:
- Disable the verifier's instrumentation in x86-64 and update the JIT to
  take care of vsyscall page in addition to userspace addresses.
- Update bpf_testmod to test for vsyscall addresses.

V4: https://lore.kernel.org/bpf/[e-mail]/
Changes in V5:
- Use TASK_SIZE_MAX + PAGE_SIZE, VSYSCALL_ADDR as userspace boundary in
  x86-64 JIT.
- Added Acked-by: Ilya Leoshkevich <[e-mail]>

V3: https://lore.kernel.org/bpf/[e-mail]/
Changes in V4:
- Disable this feature on architectures that don't define
  CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE.
- By doing the above, we don't need anything explicitly for s390x.

V2: https://lore.kernel.org/bpf/[e-mail]/
Changes in V3:
- Return 0 from bpf_arch_uaddress_limit() in disabled case because it
  returns u64.
- Modify the check in verifier to no do instrumentation when uaddress_limit
  is 0.

V1: https://lore.kernel.org/bpf/[e-mail]/
Changes in V2:
- Disable this feature on s390x.

With BPF_PROBE_MEM, BPF allows de-referencing an untrusted pointer. To
thwart invalid memory accesses, the JITs add an exception table entry for
all such accesses. But in case the src_reg + offset is a userspace address,
the BPF program might read that memory if the user has mapped it.

x86-64 JIT already instruments the BPF_PROBE_MEM based loads with checks to
skip loads from userspace addresses, but is doesn't check for vsyscall page
because it falls in the kernel address space but is considered a userspace
page. The second patch in this series fixes the x86-64 JIT to also skip
loads from the vsyscall page. The last patch updates the bpf_testmod so
this address can be checked as part of the selftests.

Other architectures don't have the complexity of the vsyscall address and
just need to skip loads from the userspace. To make this more scalable and
robust, the verifier is updated in the first patch to instrument
BPF_PROBE_MEM to skip loads from the userspace addresses.

Puranjay Mohan (3):
  bpf: verifier: prevent userspace memory access
  bpf, x86: Fix PROBE_MEM runtime load check
  selftests/bpf: Test PROBE_MEM of VSYSCALL_ADDR on x86-64

 arch/x86/net/bpf_jit_comp.c                   | 63 +++++++++----------
 include/linux/filter.h                        |  1 +
 kernel/bpf/core.c                             |  9 +++
 kernel/bpf/verifier.c                         | 30 +++++++++
 .../selftests/bpf/bpf_testmod/bpf_testmod.c   |  3 +
 5 files changed, 74 insertions(+), 32 deletions(-)

Comments

[e-mail] April 26, 2024, 5 p.m. UTC | #1

Hello:

This series was applied to bpf/bpf.git (master)
by Alexei Starovoitov <[e-mail]>:

On Wed, 24 Apr 2024 10:02:07 +0000 you wrote:
> V5: https://lore.kernel.org/bpf/[e-mail]/
> Changes in V6:
> - Disable the verifier's instrumentation in x86-64 and update the JIT to
>   take care of vsyscall page in addition to userspace addresses.
> - Update bpf_testmod to test for vsyscall addresses.
> 
> V4: https://lore.kernel.org/bpf/[e-mail]/
> Changes in V5:
> - Use TASK_SIZE_MAX + PAGE_SIZE, VSYSCALL_ADDR as userspace boundary in
>   x86-64 JIT.
> - Added Acked-by: Ilya Leoshkevich <[e-mail]>
> 
> [...]

Here is the summary with links:
  - [bpf,v6,1/3] bpf: verifier: prevent userspace memory access
    https://git.kernel.org/bpf/bpf/c/66e13b615a0c
  - [bpf,v6,2/3] bpf, x86: Fix PROBE_MEM runtime load check
    https://git.kernel.org/bpf/bpf/c/b599d7d26d6a
  - [bpf,v6,3/3] selftests/bpf: Test PROBE_MEM of VSYSCALL_ADDR on x86-64
    https://git.kernel.org/bpf/bpf/c/7cd6750d9a56

You are awesome, thank you!