Skip to content

Commit 64620e0

Browse files
committed
bpf: Fix out of bounds access for ringbuf helpers
Both bpf_ringbuf_submit() and bpf_ringbuf_discard() have ARG_PTR_TO_ALLOC_MEM in their bpf_func_proto definition as their first argument. They both expect the result from a prior bpf_ringbuf_reserve() call which has a return type of RET_PTR_TO_ALLOC_MEM_OR_NULL. Meaning, after a NULL check in the code, the verifier will promote the register type in the non-NULL branch to a PTR_TO_MEM and in the NULL branch to a known zero scalar. Generally, pointer arithmetic on PTR_TO_MEM is allowed, so the latter could have an offset. The ARG_PTR_TO_ALLOC_MEM expects a PTR_TO_MEM register type. However, the non- zero result from bpf_ringbuf_reserve() must be fed into either bpf_ringbuf_submit() or bpf_ringbuf_discard() but with the original offset given it will then read out the struct bpf_ringbuf_hdr mapping. The verifier missed to enforce a zero offset, so that out of bounds access can be triggered which could be used to escalate privileges if unprivileged BPF was enabled (disabled by default in kernel). Fixes: 457f443 ("bpf: Implement BPF ring buffer and verifier support for it") Reported-by: <[email protected]> (SecCoder Security Lab) Signed-off-by: Daniel Borkmann <[email protected]> Acked-by: John Fastabend <[email protected]> Acked-by: Alexei Starovoitov <[email protected]>
1 parent 6788ab2 commit 64620e0

File tree

1 file changed

+6
-0
lines changed

1 file changed

+6
-0
lines changed

kernel/bpf/verifier.c

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5318,9 +5318,15 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
53185318
case PTR_TO_BUF:
53195319
case PTR_TO_BUF | MEM_RDONLY:
53205320
case PTR_TO_STACK:
5321+
/* Some of the argument types nevertheless require a
5322+
* zero register offset.
5323+
*/
5324+
if (arg_type == ARG_PTR_TO_ALLOC_MEM)
5325+
goto force_off_check;
53215326
break;
53225327
/* All the rest must be rejected: */
53235328
default:
5329+
force_off_check:
53245330
err = __check_ptr_off_reg(env, reg, regno,
53255331
type == PTR_TO_BTF_ID);
53265332
if (err < 0)

0 commit comments

Comments
 (0)