In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: Reject load-acquire from pointers requiring fault protection<\/p>\n
A BPF_LOAD_ACQ is not rewritten to a BPF_PROBE_MEM load by the verifier,
\nunlike a regular BPF_LDX, so the JIT emits a plain load with no exception
\ntable entry and a fault panics the kernel instead of being handled.<\/p>\n
Reject the source pointer types that a BPF_LDX would have had that fault
\nprotection applied to, i.e. the ones bpf_convert_ctx_accesses() turns
\ninto BPF_PROBE_MEM: a bare PTR_TO_BTF_ID, PTR_TO_BTF_ID | PTR_UNTRUSTED,
\nPTR_TO_BTF_ID | MEM_ALLOC | PTR_UNTRUSTED and PTR_TO_MEM | MEM_RDONLY |
\nPTR_UNTRUSTED.<\/p>\n
This is reachable e.g. by loading ->mm out of a trusted task_struct
\nyields an untrusted pointer to mm_struct, and it is NULL for a kernel
\nthread:<\/p>\n
[…]
\n SEC(“tp_btf\/sched_switch”)
\n int BPF_PROG(demo, bool preempt, struct task_struct *prev,
\n struct task_struct *next)
\n {
\n struct mm_struct *mm = next->mm; \/* untrusted *\/<\/p>\n
out_ldx = (__u64)mm->pgd; \/* BPF_LDX *\/
\n out_acq = load_acquire(&mm->pgd); \/* BPF_LOAD_ACQ *\/
\n return 0;
\n }
\n […]<\/p>\n
Both dereference the same pointer, but only the BPF_LDX is protected
\n(x86-64 JIT, jump targets shown prog-relative):<\/p>\n
[…]
\n ; out_ldx = (__u64)mm->pgd;
\n 17: movq $-10485760, %r10
\n 1e: movq %rsi, %r11
\n 21: addq $184, %r11
\n 28: subq %r10, %r11
\n 2b: movabsq $140737498841088, %r10
\n 35: cmpq %r10, %r11
\n 38: ja 0x3e <– kernel addr?
\n 3a: xorl %edi, %edi <– no: dst = 0, skip the load
\n 3c: jmp 0x45
\n 3e: movq 184(%rsi), %rdi pgd)
\n 53:\tmovq %rsi, %rdi
\n 56:\tmovq 184(%rdi), %rax <– no check, no extable entry
\n […]<\/p>\n
Note that BPF_PROBE_MEM is not visible in a bpftool xlated dump, as
\nbpf_insn_prepare_dump() rewrites it back to BPF_MEM.<\/p>\n
A PTR_TRUSTED pointer is deliberately not on the list. Such a load is
\nnot converted either, but it does not need to be, since the pointer is
\nguaranteed live, so load-acquire from it stays allowed.<\/p>\n
The check is gated on BPF_LOAD_ACQ so that atomic RMW and store-release
\nerror messages are unchanged; writes (RMW \/ store-release) to such
\npointers are already rejected elsewhere, so only load-acquire needs this.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: Reject load-acquire from pointers requiring fault protection<\/p>\n
A BPF_LOAD_ACQ is not rewritten to a BPF_PROBE_MEM load by the v<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25678","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25678","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25678"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25678"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25678"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}