From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:33220 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751302AbeBAIK0 (ORCPT ); Thu, 1 Feb 2018 03:10:26 -0500 Date: Thu, 1 Feb 2018 09:10:23 +0100 From: Greg Kroah-Hartman To: Ben Hutchings Cc: Alexei Starovoitov , Daniel Borkmann , stable@vger.kernel.org Subject: Re: [PATCH 4.4 1/3] bpf: fix branch pruning logic Message-ID: <20180201081023.GC15896@kroah.com> References: <20180131180345.iu37p527g3qiav2f@xylophone.i.decadent.org.uk> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20180131180345.iu37p527g3qiav2f@xylophone.i.decadent.org.uk> Sender: stable-owner@vger.kernel.org List-ID: On Wed, Jan 31, 2018 at 06:03:45PM +0000, Ben Hutchings wrote: > commit c131187db2d3fa2f8bf32fdf4e9a4ef805168467 upstream. > > when the verifier detects that register contains a runtime constant > and it's compared with another constant it will prune exploration > of the branch that is guaranteed not to be taken at runtime. > This is all correct, but malicious program may be constructed > in such a way that it always has a constant comparison and > the other branch is never taken under any conditions. > In this case such path through the program will not be explored > by the verifier. It won't be taken at run-time either, but since > all instructions are JITed the malicious program may cause JITs > to complain about using reserved fields, etc. > To fix the issue we have to track the instructions explored by > the verifier and sanitize instructions that are dead at run time > with NOPs. We cannot reject such dead code, since llvm generates > it for valid C code, since it doesn't do as much data flow > analysis as the verifier does. > > Fixes: 17a5267067f3 ("bpf: verifier (add verifier core)") > Signed-off-by: Alexei Starovoitov > Acked-by: Daniel Borkmann > Signed-off-by: Daniel Borkmann > [bwh: Backported to 4.4: > - s/bpf_verifier_env/verifier_env/ > - Adjust context] > Signed-off-by: Ben Hutchings > --- > kernel/bpf/verifier.c | 28 ++++++++++++++++++++++++++++ > 1 file changed, 28 insertions(+) Daniel already provided a backport of this, thanks. greg k-h