Skip to content

Commit

Permalink
bpf: Take return from set_memory_rox() into account with bpf_jit_bina…
Browse files Browse the repository at this point in the history 
…ry_lock_ro()

mainline inclusion
from mainline-v6.10-rc1
commit e60adf513275c3a38e5cb67f7fd12387e43a3ff5
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGEOD
CVE: CVE-2024-42067

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e60adf513275

--------------------------------

set_memory_rox() can fail, leaving memory unprotected.

Check return and bail out when bpf_jit_binary_lock_ro() returns
an error.

Link: KSPP/linux#7
Signed-off-by: Christophe Leroy <[email protected]>
Cc: [email protected] <[email protected]>
Reviewed-by: Kees Cook <[email protected]>
Reviewed-by: Puranjay Mohan <[email protected]>
Reviewed-by: Ilya Leoshkevich <[email protected]>  # s390x
Acked-by: Tiezhu Yang <[email protected]>  # LoongArch
Reviewed-by: Johan Almbladh <[email protected]> # MIPS Part
Message-ID: <036b6393f23a2032ce75a1c92220b2afcb798d5d.1709850515.git.christophe.leroy@csgroup.eu>
Signed-off-by: Alexei Starovoitov <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
Conflicts:
        include/linux/filter.h
        arch/sparc/net/bpf_jit_comp_64.c
        arch/loongarch/net/bpf_jit.c
        arch/parisc/net/bpf_jit_core.c
        arch/arm/net/bpf_jit_32.c
        arch/mips/net/bpf_jit_comp.c
	arch/arm64/net/bpf_jit_comp.c
	arch/riscv/net/bpf_jit_core.c
	arch/x86/net/bpf_jit_comp.c
[some context conflict and unintroduced files on 5.10]
Signed-off-by: Yuan Can <[email protected]>
  • Loading branch information
@chleroy
chleroy authored and Yuan Can committed Oct 14, 2024
1 parent 748eeb7 commit 3462233
Show file tree
Hide file tree
Showing 10 changed files with 61 additions and 25 deletions.
25 changes: 12 additions & 13 deletions arch/arm/net/bpf_jit_32.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2003,28 +2003,21 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
/* If building the body of the JITed code fails somehow,
* we fall back to the interpretation.
*/
if (build_body(&ctx) < 0) {
image_ptr = NULL;
bpf_jit_binary_free(header);
prog = orig_prog;
goto out_imms;
}
if (build_body(&ctx) < 0)
goto out_free;
build_epilogue(&ctx);

/* 3.) Extra pass to validate JITed Code */
if (validate_code(&ctx)) {
image_ptr = NULL;
bpf_jit_binary_free(header);
prog = orig_prog;
goto out_imms;
}
if (validate_code(&ctx))
goto out_free;
flush_icache_range((u32)header, (u32)(ctx.target + ctx.idx));

if (bpf_jit_enable > 1)
/* there are 2 passes here */
bpf_jit_dump(prog->len, image_size, 2, ctx.target);

bpf_jit_binary_lock_ro(header);
if (bpf_jit_binary_lock_ro(header))
goto out_free;
prog->bpf_func = (void *)ctx.target;
prog->jited = 1;
prog->jited_len = image_size;
Expand All @@ -2041,5 +2034,11 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
bpf_jit_prog_release_other(prog, prog == orig_prog ?
tmp : orig_prog);
return prog;

out_free:
image_ptr = NULL;
bpf_jit_binary_free(header);
prog = orig_prog;
goto out_imms;
}

9 changes: 8 additions & 1 deletion arch/arm64/net/bpf_jit_comp.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1425,7 +1425,14 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
prog->jited_len = 0;
goto out_off;
}
bpf_jit_binary_lock_ro(header);
if (bpf_jit_binary_lock_ro(header)) {
bpf_jit_binary_free(header);
prog = orig_prog;
prog->bpf_func = NULL;
prog->jited = 0;
prog->jited_len = 0;
goto out_off;
}
} else {
jit_data->ctx = ctx;
jit_data->image = image_ptr;
Expand Down
3 changes: 2 additions & 1 deletion arch/mips/net/ebpf_jit.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1912,7 +1912,8 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
/* Dump JIT code */
bpf_jit_dump(prog->len, image_size, 2, ctx.target);

bpf_jit_binary_lock_ro(header);
if (bpf_jit_binary_lock_ro(header))
goto out_err;
prog->bpf_func = (void *)ctx.target;
prog->jited = 1;
prog->jited_len = image_size;
Expand Down
9 changes: 8 additions & 1 deletion arch/riscv/net/bpf_jit_core.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -163,7 +163,14 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
bpf_flush_icache(jit_data->header, ctx->insns + ctx->ninsns);

if (!prog->is_func || extra_pass) {
bpf_jit_binary_lock_ro(jit_data->header);
if (bpf_jit_binary_lock_ro(jit_data->header)) {
bpf_jit_binary_free(jit_data->header);
prog = orig_prog;
prog->bpf_func = NULL;
prog->jited = 0;
prog->jited_len = 0;
goto out_offset;
}
for (i = 0; i < prog->len; i++)
ctx->offset[i] = ninsns_rvoff(ctx->offset[i]);
bpf_prog_fill_jited_linfo(prog, ctx->offset);
Expand Down
6 changes: 5 additions & 1 deletion arch/s390/net/bpf_jit_comp.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1807,7 +1807,11 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp)
print_fn_code(jit.prg_buf, jit.size_prg);
}
if (!fp->is_func || extra_pass) {
bpf_jit_binary_lock_ro(header);
if (bpf_jit_binary_lock_ro(header)) {
bpf_jit_binary_free(header);
fp = orig_fp;
goto free_addrs;
}
} else {
jit_data->header = header;
jit_data->ctx = jit;
Expand Down
6 changes: 5 additions & 1 deletion arch/sparc/net/bpf_jit_comp_64.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1591,7 +1591,11 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
bpf_flush_icache(header, (u8 *)header + (header->pages * PAGE_SIZE));

if (!prog->is_func || extra_pass) {
bpf_jit_binary_lock_ro(header);
if (bpf_jit_binary_lock_ro(header)) {
bpf_jit_binary_free(header);
prog = orig_prog;
goto out_off;
}
} else {
jit_data->ctx = ctx;
jit_data->image = image_ptr;
Expand Down
6 changes: 5 additions & 1 deletion arch/sw_64/net/bpf_jit_comp.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1424,7 +1424,11 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
bpf_flush_icache(header, ctx.image + ctx.idx);

if (!prog->is_func || extra_pass) {
bpf_jit_binary_lock_ro(header);
if (bpf_jit_binary_lock_ro(header)) {
bpf_jit_binary_free(header);
prog = orig_prog;
goto out_off;
}
} else {
jit_data->ctx = ctx;
jit_data->image = image_ptr;
Expand Down
9 changes: 8 additions & 1 deletion arch/x86/net/bpf_jit_comp.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2127,7 +2127,14 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
if (image) {
if (!prog->is_func || extra_pass) {
bpf_tail_call_direct_fixup(prog);
bpf_jit_binary_lock_ro(header);
if (bpf_jit_binary_lock_ro(header)) {
bpf_jit_binary_free(header);
prog = orig_prog;
prog->bpf_func = NULL;
prog->jited = 0;
prog->jited_len = 0;
goto out_addrs;
}
} else {
jit_data->addrs = addrs;
jit_data->ctx = ctx;
Expand Down
3 changes: 1 addition & 2 deletions arch/x86/net/bpf_jit_comp32.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2409,8 +2409,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
if (bpf_jit_enable > 1)
bpf_jit_dump(prog->len, proglen, pass + 1, image);

if (image) {
bpf_jit_binary_lock_ro(header);
if (image && !bpf_jit_binary_lock_ro(header)) {
prog->bpf_func = (void *)image;
prog->jited = 1;
prog->jited_len = proglen;
Expand Down
10 changes: 7 additions & 3 deletions include/linux/filter.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -846,11 +846,15 @@ static inline int __must_check bpf_prog_lock_ro(struct bpf_prog *fp)
return 0;
}

static inline void bpf_jit_binary_lock_ro(struct bpf_binary_header *hdr)
static inline int __must_check
bpf_jit_binary_lock_ro(struct bpf_binary_header *hdr)
{
int ret = 0;
set_vm_flush_reset_perms(hdr);
set_memory_ro((unsigned long)hdr, hdr->pages);
set_memory_x((unsigned long)hdr, hdr->pages);
ret = set_memory_ro((unsigned long)hdr, hdr->pages);
if (ret)
return ret;
return set_memory_x((unsigned long)hdr, hdr->pages);
}

static inline struct bpf_binary_header *
Expand Down

0 comments on commit 3462233

Please sign in to comment.