Skip to content

Commit

Permalink
bpf: Take return from set_memory_rox() into account with bpf_jit_bina…
Browse files Browse the repository at this point in the history 
…ry_lock_ro()

stable inclusion
from stable-v6.6.37
commit e60adf513275c3a38e5cb67f7fd12387e43a3ff5
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAGEOD
CVE: CVE-2024-42067

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e60adf513275c3a38e5cb67f7fd12387e43a3ff5

--------------------------------

[ Upstream commit e60adf513275c3a38e5cb67f7fd12387e43a3ff5 ]

set_memory_rox() can fail, leaving memory unprotected.

Check return and bail out when bpf_jit_binary_lock_ro() returns
an error.

Link: KSPP/linux#7
Signed-off-by: Christophe Leroy <[email protected]>
Cc: [email protected] <[email protected]>
Reviewed-by: Kees Cook <[email protected]>
Reviewed-by: Puranjay Mohan <[email protected]>
Reviewed-by: Ilya Leoshkevich <[email protected]>  # s390x
Acked-by: Tiezhu Yang <[email protected]>  # LoongArch
Reviewed-by: Johan Almbladh <[email protected]> # MIPS Part
Message-ID: <036b6393f23a2032ce75a1c92220b2afcb798d5d.1709850515.git.christophe.leroy@csgroup.eu>
Signed-off-by: Alexei Starovoitov <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
Conflicts:
        arch/arm64/net/bpf_jit_comp.c
        arch/powerpc/net/bpf_jit_comp.c
        arch/sw_64/net/bpf_jit_comp.c
[Check return values of bpf_jit_binary_lock_ro() to avoid return values uncheck waring]
Signed-off-by: Yuan Can <[email protected]>
  • Loading branch information
@chleroy
chleroy authored and Yuan Can committed Sep 25, 2024
1 parent 81a41d2 commit 4c9174d
Show file tree
Hide file tree
Showing 11 changed files with 75 additions and 30 deletions.
25 changes: 12 additions & 13 deletions arch/arm/net/bpf_jit_32.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1982,28 +1982,21 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
/* If building the body of the JITed code fails somehow,
* we fall back to the interpretation.
*/
if (build_body(&ctx) < 0) {
image_ptr = NULL;
bpf_jit_binary_free(header);
prog = orig_prog;
goto out_imms;
}
if (build_body(&ctx) < 0)
goto out_free;
build_epilogue(&ctx);

/* 3.) Extra pass to validate JITed Code */
if (validate_code(&ctx)) {
image_ptr = NULL;
bpf_jit_binary_free(header);
prog = orig_prog;
goto out_imms;
}
if (validate_code(&ctx))
goto out_free;
flush_icache_range((u32)header, (u32)(ctx.target + ctx.idx));

if (bpf_jit_enable > 1)
/* there are 2 passes here */
bpf_jit_dump(prog->len, image_size, 2, ctx.target);

bpf_jit_binary_lock_ro(header);
if (bpf_jit_binary_lock_ro(header))
goto out_free;
prog->bpf_func = (void *)ctx.target;
prog->jited = 1;
prog->jited_len = image_size;
Expand All @@ -2020,5 +2013,11 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
bpf_jit_prog_release_other(prog, prog == orig_prog ?
tmp : orig_prog);
return prog;

out_free:
image_ptr = NULL;
bpf_jit_binary_free(header);
prog = orig_prog;
goto out_imms;
}

9 changes: 8 additions & 1 deletion arch/arm64/net/bpf_jit_comp.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1648,7 +1648,14 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
prog->jited_len = 0;
goto out_off;
}
bpf_jit_binary_lock_ro(header);
if (bpf_jit_binary_lock_ro(header)) {
bpf_jit_binary_free(header);
prog = orig_prog;
prog->bpf_func = NULL;
prog->jited = 0;
prog->jited_len = 0;
goto out_off;
}
} else {
jit_data->ctx = ctx;
jit_data->image = image_ptr;
Expand Down
22 changes: 16 additions & 6 deletions arch/loongarch/net/bpf_jit.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1206,16 +1206,19 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
flush_icache_range((unsigned long)header, (unsigned long)(ctx.image + ctx.idx));

if (!prog->is_func || extra_pass) {
int err;

if (extra_pass && ctx.idx != jit_data->ctx.idx) {
pr_err_once("multi-func JIT bug %d != %d\n",
ctx.idx, jit_data->ctx.idx);
bpf_jit_binary_free(header);
prog->bpf_func = NULL;
prog->jited = 0;
prog->jited_len = 0;
goto out_offset;
goto out_free;
}
err = bpf_jit_binary_lock_ro(header);
if (err) {
pr_err_once("bpf_jit_binary_lock_ro() returned %d\n",
err);
goto out_free;
}
bpf_jit_binary_lock_ro(header);
} else {
jit_data->ctx = ctx;
jit_data->image = image_ptr;
Expand Down Expand Up @@ -1246,6 +1249,13 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
out_offset = -1;

return prog;

out_free:
bpf_jit_binary_free(header);
prog->bpf_func = NULL;
prog->jited = 0;
prog->jited_len = 0;
goto out_offset;
}

/* Indicate the JIT backend supports mixing bpf2bpf and tailcalls. */
Expand Down
3 changes: 2 additions & 1 deletion arch/mips/net/bpf_jit_comp.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1012,7 +1012,8 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
bpf_prog_fill_jited_linfo(prog, &ctx.descriptors[1]);

/* Set as read-only exec and flush instruction cache */
bpf_jit_binary_lock_ro(header);
if (bpf_jit_binary_lock_ro(header))
goto out_err;
flush_icache_range((unsigned long)header,
(unsigned long)&ctx.target[ctx.jit_index]);

Expand Down
8 changes: 7 additions & 1 deletion arch/parisc/net/bpf_jit_core.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -167,7 +167,13 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
bpf_flush_icache(jit_data->header, ctx->insns + ctx->ninsns);

if (!prog->is_func || extra_pass) {
bpf_jit_binary_lock_ro(jit_data->header);
if (bpf_jit_binary_lock_ro(jit_data->header)) {
bpf_jit_binary_free(jit_data->header);
prog->bpf_func = NULL;
prog->jited = 0;
prog->jited_len = 0;
goto out_offset;
}
prologue_len = ctx->epilogue_offset - ctx->body_len;
for (i = 0; i < prog->len; i++)
ctx->offset[i] += prologue_len;
Expand Down
9 changes: 8 additions & 1 deletion arch/powerpc/net/bpf_jit_comp.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -205,7 +205,14 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp)

bpf_flush_icache(bpf_hdr, (u8 *)bpf_hdr + bpf_hdr->size);
if (!fp->is_func || extra_pass) {
bpf_jit_binary_lock_ro(bpf_hdr);
if (bpf_jit_binary_lock_ro(bpf_hdr)) {
bpf_jit_binary_free(bpf_hdr);
fp = org_fp;
fp->bpf_func = NULL;
fp->jited = 0;
fp->jited_len = 0;
goto out_addrs;
}
bpf_prog_fill_jited_linfo(fp, addrs);
out_addrs:
kfree(addrs);
Expand Down
6 changes: 5 additions & 1 deletion arch/s390/net/bpf_jit_comp.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1973,7 +1973,11 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *fp)
print_fn_code(jit.prg_buf, jit.size_prg);
}
if (!fp->is_func || extra_pass) {
bpf_jit_binary_lock_ro(header);
if (bpf_jit_binary_lock_ro(header)) {
bpf_jit_binary_free(header);
fp = orig_fp;
goto free_addrs;
}
} else {
jit_data->header = header;
jit_data->ctx = jit;
Expand Down
6 changes: 5 additions & 1 deletion arch/sparc/net/bpf_jit_comp_64.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1602,7 +1602,11 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
bpf_flush_icache(header, (u8 *)header + header->size);

if (!prog->is_func || extra_pass) {
bpf_jit_binary_lock_ro(header);
if (bpf_jit_binary_lock_ro(header)) {
bpf_jit_binary_free(header);
prog = orig_prog;
goto out_off;
}
} else {
jit_data->ctx = ctx;
jit_data->image = image_ptr;
Expand Down
9 changes: 8 additions & 1 deletion arch/sw_64/net/bpf_jit_comp.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1427,7 +1427,14 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
bpf_flush_icache(header, ctx.image + ctx.idx);

if (!prog->is_func || extra_pass) {
bpf_jit_binary_lock_ro(header);
if (bpf_jit_binary_lock_ro(header)) {
bpf_jit_binary_free(header);
prog = orig_prog;
prog->bpf_func = NULL;
prog->jited = 0;
prog->jited_len = 0;
goto out_off;
}
} else {
jit_data->ctx = ctx;
jit_data->image = image_ptr;
Expand Down
3 changes: 1 addition & 2 deletions arch/x86/net/bpf_jit_comp32.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2600,8 +2600,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
if (bpf_jit_enable > 1)
bpf_jit_dump(prog->len, proglen, pass + 1, image);

if (image) {
bpf_jit_binary_lock_ro(header);
if (image && !bpf_jit_binary_lock_ro(header)) {
prog->bpf_func = (void *)image;
prog->jited = 1;
prog->jited_len = proglen;
Expand Down
5 changes: 3 additions & 2 deletions include/linux/filter.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -853,10 +853,11 @@ static inline int __must_check bpf_prog_lock_ro(struct bpf_prog *fp)
return 0;
}

static inline void bpf_jit_binary_lock_ro(struct bpf_binary_header *hdr)
static inline int __must_check
bpf_jit_binary_lock_ro(struct bpf_binary_header *hdr)
{
set_vm_flush_reset_perms(hdr);
set_memory_rox((unsigned long)hdr, hdr->size >> PAGE_SHIFT);
return set_memory_rox((unsigned long)hdr, hdr->size >> PAGE_SHIFT);
}

int sk_filter_trim_cap(struct sock *sk, struct sk_buff *skb, unsigned int cap);
Expand Down

0 comments on commit 4c9174d

Please sign in to comment.