Messages in this thread | | | Date | Wed, 19 Oct 2016 17:10:29 +0200 | From | Daniel Borkmann <> | Subject | Re: [RFC v3 04/22] bpf: Set register type according to is_valid_access() |
| |
On 10/19/2016 04:54 PM, Thomas Graf wrote: > On 09/14/16 at 09:23am, Mickaël Salaün wrote: >> This fix a pointer leak when an unprivileged eBPF program read a pointer >> value from the context. Even if is_valid_access() returns a pointer >> type, the eBPF verifier replace it with UNKNOWN_VALUE. The register >> value containing an address is then allowed to leak. Moreover, this >> prevented unprivileged eBPF programs to use functions with (legitimate) >> pointer arguments. >> >> This bug was not a problem until now because the only unprivileged eBPF >> program allowed is of type BPF_PROG_TYPE_SOCKET_FILTER and all the types >> from its context are UNKNOWN_VALUE. >> >> Signed-off-by: Mickaël Salaün <mic@digikod.net> >> Fixes: 969bf05eb3ce ("bpf: direct packet access") >> Cc: Alexei Starovoitov <ast@kernel.org> >> Cc: Daniel Borkmann <daniel@iogearbox.net> > > Can you post this fix separately? It's valid and needed outside of the > scope of this series.
Yes, that one was already merged:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=1955351da41caa1dbf4139191358fed84909d64b
| |