github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-28 01:55:51 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

Merge branch 'bpf-verifier-fix-ptr_to_flow_keys-constant-offset-oob'

Browse Source 
Nuoqi Gui says:

====================
bpf, verifier: fix PTR_TO_FLOW_KEYS constant-offset OOB

A constant offset added to a PTR_TO_FLOW_KEYS register lands in
reg->var_off, but check_flow_keys_access() bounds-checks only insn->off
and never folds reg->var_off.value.  A BPF_PROG_TYPE_FLOW_DISSECTOR
program can therefore do "flow_keys += 0x1000; *(flow_keys + 0)" and have
it accepted, then read/write kernel stack past struct bpf_flow_keys at
runtime.  Patch 1 folds reg->var_off.value into the offset (and rejects
non-constant offsets), mirroring check_ctx_access(); patch 2 adds verifier
selftests.

This is a regression introduced in the 7.1 development cycle by commit
022ac07508 ("bpf: use reg->var_off instead of reg->off for pointers"),
which moved the constant offset from reg->off (folded generically before
022ac07508) into reg->var_off without updating the flow_keys path.  No
released kernel is affected: v7.0.x rejects the program above, and the bug
reproduces only on v7.1-rc1..rc5, so no stable backport is needed.

It was first reported privately to security@kernel.org; per their guidance
it is handled in the open as a normal regression fix.  Found by manual
verifier audit and confirmed dynamically in a disposable QEMU/KVM guest:
the load above is accepted, a runtime read leaked a kernel-stack pointer
0x1000 past bpf_flow_keys, and a runtime write of a marker faulted the
guest in net_rx_action.

An alternative -- forbidding pointer arithmetic on PTR_TO_FLOW_KEYS
outright by dropping "if (known) break;" in adjust_ptr_min_max_vals() --
was rejected because v7.0.x accepted (and correctly bounds-checked)
constant arithmetic on the keys pointer; restoring the fold preserves that
behaviour while closing the divergence.

Signed-off-by: Nuoqi Gui <gnq25@mails.tsinghua.edu.cn>
---
v2 -> v3:
 - Pass existing reg/argno context into check_flow_keys_access(), avoiding
   a stale regno reference in check_mem_access().
 - Add a variable-offset selftest using bpf_get_prandom_u32().

v1 -> v2:
 - Target bpf-next instead of bpf (per reviewer feedback).
 - Base-commit updated to bpf-next/master.

v2: https://lore.kernel.org/bpf/20260604180730.2518088-1-gnq25@mails.tsinghua.edu.cn/
v1: https://lore.kernel.org/bpf/20260604150755.2487555-1-gnq25@mails.tsinghua.edu.cn/
====================

Link: https://patch.msgid.link/20260606-c3-01-v3-v3-0-97c51f592f15@mails.tsinghua.edu.cn
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
This commit is contained in:
Alexei Starovoitov 2026-06-06 16:44:47 -07:00
commit f6cd665c10
3 changed files with 114 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
kernel/bpf/verifier.c
View File

@ -4728,9 +4728,21 @@ static int check_ctx_access(struct bpf_verifier_env *env, int insn_idx, struct b
return err;
}
static int check_flow_keys_access(struct bpf_verifier_env *env, int off,
int size)
static int check_flow_keys_access(struct bpf_verifier_env *env,
struct bpf_reg_state *reg, argno_t argno,
int off, int size)
{
/* Only a constant offset is allowed here; fold it into off. */
if (!tnum_is_const(reg->var_off)) {
char tn_buf[48];
tnum_strn(tn_buf, sizeof(tn_buf), reg->var_off);
verbose(env, "%s invalid variable offset to flow keys: off=%d, var_off=%s\n",
reg_arg_name(env, argno), off, tn_buf);
return -EACCES;
}
off += reg->var_off.value;
if (size < 0 || off < 0 ||
(u64)off + size > sizeof(struct bpf_flow_keys)) {
verbose(env, "invalid access to flow keys off=%d size=%d\n",
@ -6239,7 +6251,7 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, struct b
return -EACCES;
}
err = check_flow_keys_access(env, off, size);
err = check_flow_keys_access(env, reg, argno, off, size);
if (!err && t == BPF_READ && value_regno >= 0)
mark_reg_unknown(env, regs, value_regno);
} else if (type_is_sk_pointer(reg->type)) {

2
tools/testing/selftests/bpf/prog_tests/verifier.c
View File

@ -38,6 +38,7 @@
#include "verifier_div0.skel.h"
#include "verifier_div_mod_bounds.skel.h"
#include "verifier_div_overflow.skel.h"
#include "verifier_flow_keys.skel.h"
#include "verifier_global_subprogs.skel.h"
#include "verifier_global_ptr_args.skel.h"
#include "verifier_gotol.skel.h"
@ -190,6 +191,7 @@ void test_verifier_direct_stack_access_wraparound(void) { RUN(verifier_direct_st
void test_verifier_div0(void) { RUN(verifier_div0); }
void test_verifier_div_mod_bounds(void) { RUN(verifier_div_mod_bounds); }
void test_verifier_div_overflow(void) { RUN(verifier_div_overflow); }
void test_verifier_flow_keys(void) { RUN(verifier_flow_keys); }
void test_verifier_global_subprogs(void) { RUN(verifier_global_subprogs); }
void test_verifier_global_ptr_args(void) { RUN(verifier_global_ptr_args); }
void test_verifier_gotol(void) { RUN(verifier_gotol); }

97
tools/testing/selftests/bpf/progs/verifier_flow_keys.c Normal file
View File

@ -0,0 +1,97 @@
// SPDX-License-Identifier: GPL-2.0
/* Bounds checks for PTR_TO_FLOW_KEYS pointer arithmetic. */
#include "vmlinux.h"
#include <bpf/bpf_helpers.h>
#include "bpf_misc.h"
/* sizeof(struct bpf_flow_keys) is well under 4096, so +0x1000 is OOB. */
SEC("flow_dissector")
__description("flow_keys: in-bounds constant pointer arithmetic accepted")
__success
__naked void flow_keys_const_inbounds(void)
{
asm volatile (" \
r1 = *(u64 *)(r1 + %[flow_keys]); \
r1 += 8; \
r0 = *(u64 *)(r1 + 0); \
r0 = 0; \
exit; \
" :
: __imm_const(flow_keys, offsetof(struct __sk_buff, flow_keys))
: __clobber_all);
}
SEC("flow_dissector")
__description("flow_keys: OOB via constant pointer arithmetic rejected")
__failure __msg("invalid access to flow keys off=4096 size=8")
__naked void flow_keys_const_oob_read(void)
{
asm volatile (" \
r1 = *(u64 *)(r1 + %[flow_keys]); \
r1 += 4096; \
r0 = *(u64 *)(r1 + 0); \
r0 = 0; \
exit; \
" :
: __imm_const(flow_keys, offsetof(struct __sk_buff, flow_keys))
: __clobber_all);
}
SEC("flow_dissector")
__description("flow_keys: OOB write via constant pointer arithmetic rejected")
__failure __msg("invalid access to flow keys off=4096 size=8")
__naked void flow_keys_const_oob_write(void)
{
asm volatile (" \
r1 = *(u64 *)(r1 + %[flow_keys]); \
r1 += 4096; \
r2 = 0; \
*(u64 *)(r1 + 0) = r2; \
r0 = 0; \
exit; \
" :
: __imm_const(flow_keys, offsetof(struct __sk_buff, flow_keys))
: __clobber_all);
}
/* Equivalent OOB expressed directly in insn->off; this form was always
* rejected and is kept to show both forms now share one diagnostic.
*/
SEC("flow_dissector")
__description("flow_keys: OOB via insn->off rejected")
__failure __msg("invalid access to flow keys off=4096 size=8")
__naked void flow_keys_insn_off_oob(void)
{
asm volatile (" \
r1 = *(u64 *)(r1 + %[flow_keys]); \
r0 = *(u64 *)(r1 + 4096); \
r0 = 0; \
exit; \
" :
: __imm_const(flow_keys, offsetof(struct __sk_buff, flow_keys))
: __clobber_all);
}
SEC("flow_dissector")
__description("flow_keys: variable pointer arithmetic rejected")
__failure __msg("R1 pointer arithmetic on flow_keys prohibited")
__naked void flow_keys_var_read(void)
{
asm volatile (" \
r6 = r1; \
call %[bpf_get_prandom_u32]; \
r0 &= 0xFFFF; \
r1 = *(u64 *)(r6 + %[flow_keys]); \
r1 += r0; \
r0 = *(u64 *)(r1 + 0); \
r0 = 0; \
exit; \
" :
: __imm_const(flow_keys, offsetof(struct __sk_buff, flow_keys)),
__imm(bpf_get_prandom_u32)
: __clobber_all);
}
char _license[] SEC("license") = "GPL";