lkml.org 
[lkml]   [2014]   [Jun]   [17]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.13 052/212] net: filter: x86: fix JIT address randomization
    Date
    3.13.11.4 -stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Alexei Starovoitov <ast@plumgrid.com>

    [ Upstream commit 773cd38f40b8834be991dbfed36683acc1dd41ee ]

    bpf_alloc_binary() adds 128 bytes of room to JITed program image
    and rounds it up to the nearest page size. If image size is close
    to page size (like 4000), it is rounded to two pages:
    round_up(4000 + 4 + 128) == 8192
    then 'hole' is computed as 8192 - (4000 + 4) = 4188
    If prandom_u32() % hole selects a number >= PAGE_SIZE - sizeof(*header)
    then kernel will crash during bpf_jit_free():

    kernel BUG at arch/x86/mm/pageattr.c:887!
    Call Trace:
    [<ffffffff81037285>] change_page_attr_set_clr+0x135/0x460
    [<ffffffff81694cc0>] ? _raw_spin_unlock_irq+0x30/0x50
    [<ffffffff810378ff>] set_memory_rw+0x2f/0x40
    [<ffffffffa01a0d8d>] bpf_jit_free_deferred+0x2d/0x60
    [<ffffffff8106bf98>] process_one_work+0x1d8/0x6a0
    [<ffffffff8106bf38>] ? process_one_work+0x178/0x6a0
    [<ffffffff8106c90c>] worker_thread+0x11c/0x370

    since bpf_jit_free() does:
    unsigned long addr = (unsigned long)fp->bpf_func & PAGE_MASK;
    struct bpf_binary_header *header = (void *)addr;
    to compute start address of 'bpf_binary_header'
    and header->pages will pass junk to:
    set_memory_rw(addr, header->pages);

    Fix it by making sure that &header->image[prandom_u32() % hole] and &header
    are in the same page

    Fixes: 314beb9bcabfd ("x86: bpf_jit_comp: secure bpf jit against spraying attacks")
    Signed-off-by: Alexei Starovoitov <ast@plumgrid.com>
    Acked-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Kamal Mostafa <kamal@canonical.com>
    ---
    arch/x86/net/bpf_jit_comp.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
    index 4ed75dd..af2d431 100644
    --- a/arch/x86/net/bpf_jit_comp.c
    +++ b/arch/x86/net/bpf_jit_comp.c
    @@ -171,7 +171,7 @@ static struct bpf_binary_header *bpf_alloc_binary(unsigned int proglen,
    memset(header, 0xcc, sz); /* fill whole space with int3 instructions */

    header->pages = sz / PAGE_SIZE;
    - hole = sz - (proglen + sizeof(*header));
    + hole = min(sz - (proglen + sizeof(*header)), PAGE_SIZE - sizeof(*header));

    /* insert a random number of int3 instructions before BPF code */
    *image_ptr = &header->image[prandom_u32() % hole];
    --
    1.9.1


    \
     
     \ /
      Last update: 2014-06-18 05:01    [W:5.038 / U:0.128 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site