From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C33D5C433FE for ; Mon, 7 Nov 2022 10:33:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231216AbiKGKdz (ORCPT ); Mon, 7 Nov 2022 05:33:55 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41836 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231807AbiKGKdu (ORCPT ); Mon, 7 Nov 2022 05:33:50 -0500 Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id CD3B6EA6; Mon, 7 Nov 2022 02:33:49 -0800 (PST) Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id DDB7A1FB; Mon, 7 Nov 2022 02:33:54 -0800 (PST) Received: from FVFF77S0Q05N (unknown [10.57.69.132]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id 96A1D3F534; Mon, 7 Nov 2022 02:33:46 -0800 (PST) Date: Mon, 7 Nov 2022 10:33:25 +0000 From: Mark Rutland To: Alexander Potapenko Cc: Baisong Zhong , elver@google.com, Catalin Marinas , edumazet@google.com, keescook@chromium.org, kuba@kernel.org, ast@kernel.org, daniel@iogearbox.net, davem@davemloft.net, pabeni@redhat.com, linux-kernel@vger.kernel.org, bpf@vger.kernel.org, netdev@vger.kernel.org Subject: Re: [PATCH -next,v2] bpf, test_run: fix alignment problem in bpf_prog_test_run_skb() Message-ID: References: <20221102081620.1465154-1-zhongbaisong@huawei.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: Precedence: bulk List-ID: X-Mailing-List: bpf@vger.kernel.org On Fri, Nov 04, 2022 at 06:06:05PM +0100, Alexander Potapenko wrote: > On Wed, Nov 2, 2022 at 9:16 AM Baisong Zhong wrote: > > > > we got a syzkaller problem because of aarch64 alignment fault > > if KFENCE enabled. > > > > When the size from user bpf program is an odd number, like > > 399, 407, etc, it will cause the struct skb_shared_info's > > unaligned access. As seen below: > > > > BUG: KFENCE: use-after-free read in __skb_clone+0x23c/0x2a0 net/core/skbuff.c:1032 > > It's interesting that KFENCE is reporting a UAF without a deallocation > stack here. > > Looks like an unaligned access to 0xffff6254fffac077 causes the ARM > CPU to throw a fault handled by __do_kernel_fault() Importantly, an unaligned *atomic*, which is a bug regardless of KFENCE. > This isn't technically a page fault, but anyway the access address > gets passed to kfence_handle_page_fault(), which defaults to a > use-after-free, because the address belongs to the object page, not > the redzone page. > > Catalin, Mark, what is the right way to only handle traps caused by > reading/writing to a page for which `set_memory_valid(addr, 1, 0)` was > called? That should appear as a translation fault, so we could add an is_el1_translation_fault() helper for that. I can't immediately recall how misaligned atomics are presented, but I presume as something other than a translation fault. If the below works for you, I can go spin that as a real patch. Mark. ---->8---- diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c index 5b391490e045b..1de4b6afa8515 100644 --- a/arch/arm64/mm/fault.c +++ b/arch/arm64/mm/fault.c @@ -239,6 +239,11 @@ static bool is_el1_data_abort(unsigned long esr) return ESR_ELx_EC(esr) == ESR_ELx_EC_DABT_CUR; } +static bool is_el1_translation_fault(unsigned long esr) +{ + return (esr & ESR_ELx_FSC_TYPE) == ESR_ELx_FSC_FAULT; +} + static inline bool is_el1_permission_fault(unsigned long addr, unsigned long esr, struct pt_regs *regs) { @@ -385,7 +390,8 @@ static void __do_kernel_fault(unsigned long addr, unsigned long esr, } else if (addr < PAGE_SIZE) { msg = "NULL pointer dereference"; } else { - if (kfence_handle_page_fault(addr, esr & ESR_ELx_WNR, regs)) + if (is_el1_translation_fault(esr) && + kfence_handle_page_fault(addr, esr & ESR_ELx_WNR, regs)) return; msg = "paging request";