[MODERATED] Re: Generic eBPF hardening

[Dave Hansen <dave.hansen@linux.intel.com>]

On 05/17/2018 03:22 PM, speck for Alexei Starovoitov wrote:
> On Thu, May 17, 2018 at 01:55:38PM -0700, speck for Dave Hansen wrote:
>> I'm hoping Alexei is on the list now.
>>
>> Andi Kleen and I were talking about ways to generally harden eBPF.  We
>> were a bit concerned that eBPF could leave around attacker-controlled
>> values on the stack that might allow later, speculatively-executed
>> kernel code to be exploited.
>>
>> One thing I wanted to clarify: The eBPF stack (BPF_REG_FP) *is* the
>> kernel stack, correct?
> yes. bpf program stack is kernel stack,
> but I don't see how this is useful.
> There are plenty of ways to populate kernel stack with user controlled
> bytes. Ex: set_task_comm.

In most places in the kernel, it's hard to both get data on the stack
that you control *and* execute code that you (mostly) control.  For the
vast majority of the kernel, you are entirely at the mercy of the
compiler to give you the code and the stack layout.

BPF currently gives you pretty good control of both, though.

Zeroing the stack would at least take away one source of gadgets: kernel
code that speculatively consumes uninitialized data from the stack.