Alexei Starovoitov 9a7fad4c0e bpf: prevent out-of-bounds speculation ... commit b2157399cc9898260d6031c5bfe45fe137c1fbe7 upstream. Under speculation, CPUs may mis-predict branches in bounds checks. Thus, memory accesses under a bounds check may be speculated even if the bounds check fails, providing a primitive for building a side channel. To avoid leaking kernel data round up array-based maps and mask the index after bounds check, so speculated load with out of bounds index will load either valid value from the array or zero from the padded area. Unconditionally mask index for all array types even when max_entries are not rounded to power of 2 for root user. When map is created by unpriv user generate a sequence of bpf insns that includes AND operation to make sure that JITed code includes the same 'index & index_mask' operation. If prog_array map is created by unpriv user replace bpf_tail_call(ctx, map, index); with if (index >= max_entries) { index &= map->index_mask; bpf_tail_call(ctx, map, index); } (along with roundup to power 2) to prevent out-of-bounds speculation. There is secondary redundant 'if (index >= max_entries)' in the interpreter and in all JITs, but they can be optimized later if necessary. Other array-like maps (cpumap, devmap, sockmap, perf_event_array, cgroup_array) cannot be used by unpriv, so no changes there. That fixes bpf side of "Variant 1: bounds check bypass (CVE-2017-5753)" on all architectures with and without JIT. v2->v3: Daniel noticed that attack potentially can be crafted via syscall commands without loading the program, so add masking to those paths as well. Signed-off-by: Alexei Starovoitov <ast@kernel.org> Acked-by: John Fastabend <john.fastabend@gmail.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: Jiri Slaby <jslaby@suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2018-01-17 09:35:31 +01:00
..
bpf	bpf: prevent out-of-bounds speculation	2018-01-17 09:35:31 +01:00
configs	kconfig: tinyconfig: provide whole choice blocks to avoid warnings	2016-09-24 10:07:42 +02:00
debug	kdb: Fix handling of kallsyms_symbol_next() return value	2017-12-16 10:33:49 +01:00
events	bpf: one perf event close won't free bpf program attached by another perf event	2017-10-21 17:09:02 +02:00
gcov	gcov: support GCC 7.1	2017-09-02 07:06:51 +02:00
irq	genirq: Release resources in __setup_irq() error path	2017-06-26 07:13:10 +02:00
livepatch	livepatch: x86: fix relocation computation with kASLR	2015-11-11 17:36:04 +01:00
locking	locking/mutex: Allow next waiter lockless wakeup	2018-01-17 09:35:27 +01:00
power	sched/cpuset/pm: Fix cpuset vs. suspend-resume bugs	2017-10-12 11:27:35 +02:00
printk	printk: use rcuidle console tracepoint	2017-02-23 17:43:10 +01:00
rcu	rcu: Allow for page faults in NMI handlers	2017-10-18 09:20:41 +02:00
sched	sched/core: Idle_task_exit() shouldn't use switch_mm_irqs_off()	2017-12-25 14:22:09 +01:00
time	nohz: Prevent a timer interrupt storm in tick_nohz_stop_sched_tick()	2018-01-02 20:33:28 +01:00
trace	ring-buffer: Mask out the info bits when returning buffer page length	2018-01-02 20:33:22 +01:00
.gitignore	certs: add .gitignore to stop git nagging about x509_certificate_list	2015-10-21 15:18:35 +01:00
acct.c	kernel/acct.c: fix the acct->needcheck check in check_free_space()	2018-01-10 09:27:08 +01:00
async.c
audit.c	audit: ensure that 'audit=1' actually enables audit for PID 1	2017-12-16 10:33:56 +01:00
audit.h	audit: audit_tree_match can be boolean	2015-11-04 08:23:51 -05:00
audit_fsnotify.c	audit: clean simple fsnotify implementation	2015-08-06 16:14:53 -04:00
audit_tree.c	audit: audit_tree_match can be boolean	2015-11-04 08:23:51 -05:00
audit_watch.c	audit: Fix use after free in audit_remove_watch_rule()	2017-08-24 17:02:35 -07:00
auditfilter.c	audit: fix comment block whitespace	2015-11-04 08:23:51 -05:00
auditsc.c	audit: fix a double fetch in audit_log_single_execve_arg()	2016-08-20 18:09:22 +02:00
backtracetest.c
bounds.c
capability.c	exec: Ensure mm->user_ns contains the execed files	2017-01-06 11:16:14 +01:00
cgroup.c	cgroup, kthread: close race window where new kthreads can be migrated to non-root cgroups	2017-04-21 09:30:04 +02:00
cgroup_freezer.c	cgroup: fix handling of multi-destination migration from subtree_control enabling	2015-12-03 10:18:21 -05:00
cgroup_pids.c	cgroup_pids: don't account for the root cgroup	2015-12-03 10:18:21 -05:00
compat.c	compat: cleanup coding in compat_get_bitmap() and compat_put_bitmap()	2015-06-04 23:57:18 +02:00
configs.c
context_tracking.c	context_tracking: avoid irq_save/irq_restore on guest entry and exit	2015-11-10 12:06:23 +01:00
cpu.c	stable-fixup: hotplug: fix unused function warning	2017-01-12 11:22:48 +01:00
cpu_pm.c	kernel/cpu_pm: fix cpu_cluster_pm_exit comment	2015-09-03 02:42:20 +02:00
cpuset.c	sched/cpuset/pm: Fix cpuset vs. suspend-resume bugs	2017-10-12 11:27:35 +02:00
crash_dump.c
cred.c	cred: Reject inodes with invalid ids in set_create_file_as()	2016-09-15 08:27:49 +02:00
delayacct.c
dma.c
elfcore.c
exec_domain.c	Remove rest of exec domains.	2015-04-12 21:03:31 +02:00
exit.c	wait/ptrace: assume __WALL if the child is traced	2016-06-07 18:14:35 -07:00
extable.c	kernel/extable.c: mark core_kernel_text notrace	2017-07-21 07:44:56 +02:00
fork.c	kaiser: stack map PAGE_SIZE at THREAD_SIZE-PAGE_SIZE	2018-01-05 15:44:23 +01:00
freezer.c
futex.c	futex: Replace barrier() in unqueue_me() with READ_ONCE()	2018-01-17 09:35:27 +01:00
futex_compat.c	ptrace: use fsuid, fsgid, effective creds for fs access checks	2016-02-25 12:01:16 -08:00
groups.c	kernel: make groups_sort calling a responsibility group_info allocators	2018-01-10 09:27:10 +01:00
hung_task.c	kernel/hung_task.c: change hung_task.c to use for_each_process_thread()	2015-04-15 16:35:22 -07:00
irq_work.c	treewide: Remove old email address	2015-11-23 09:44:58 +01:00
jump_label.c	jump_label: Invoke jump_label_test() via early_initcall()	2017-12-16 10:33:55 +01:00
kallsyms.c
kcmp.c	ptrace: use fsuid, fsgid, effective creds for fs access checks	2016-02-25 12:01:16 -08:00
Kconfig.freezer
Kconfig.hz
Kconfig.locks	locking/qrwlock: Rename QUEUE_RWLOCK to QUEUED_RWLOCKS	2015-05-12 09:46:00 +02:00
Kconfig.preempt
kexec.c	kexec: use file name as the output message prefix	2015-11-06 17:50:42 -08:00
kexec_core.c	kexec: use file name as the output message prefix	2015-11-06 17:50:42 -08:00
kexec_file.c	kexec: fix double-free when failing to relocate the purgatory	2016-09-24 10:07:36 +02:00
kexec_internal.h	kexec: split kexec_file syscall code to kexec_file.c	2015-09-10 13:29:01 -07:00
kmod.c	kmod: don't run async usermode helper as a child of kworker thread	2015-10-23 17:55:10 +09:00
kprobes.c	tracing/kprobes: Enforce kprobes teardown after testing	2017-05-25 14:30:17 +02:00
ksysfs.c	kexec: split kexec_load syscall from kexec core code	2015-09-10 13:29:01 -07:00
kthread.c	cgroup, kthread: close race window where new kthreads can be migrated to non-root cgroups	2017-04-21 09:30:04 +02:00
latencytop.c
Makefile	sys_membarrier(): system-wide memory barrier (generic, x86)	2015-09-11 15:21:34 -07:00
membarrier.c	Fix: Disable sys_membarrier when nohz_full is enabled	2017-03-12 06:37:26 +01:00
memremap.c	mm: fix devm_memremap_pages crash, use mem_hotplug_{begin, done}	2017-01-19 20:17:18 +01:00
module-internal.h
module.c	module: Issue warnings when tainting kernel	2018-01-10 09:27:14 +01:00
module_signing.c	KEYS: Merge the type-specific data with the payload data	2015-10-21 15:18:36 +01:00
notifier.c	Merge branch 'x86-asm-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2015-09-01 08:40:25 -07:00
nsproxy.c
padata.c	padata: free correct variable	2017-05-20 14:27:02 +02:00
panic.c	kernel/panic.c: add missing \n	2017-07-05 14:37:19 +02:00
params.c	Nothing exciting, minor tweaks and cleanups.	2015-11-09 15:53:39 -08:00
pid.c	pids: make task_tgid_nr_ns() safe	2017-08-24 17:02:36 -07:00
pid_namespace.c	pid_ns: Sleep in TASK_INTERRUPTIBLE in zap_pid_ns_processes	2017-05-25 14:30:11 +02:00
profile.c	mm: rename alloc_pages_exact_node() to __alloc_pages_node()	2015-09-08 15:35:28 -07:00
ptrace.c	ptrace: Properly initialize ptracer_cred on fork	2017-06-14 13:16:20 +02:00
range.c
reboot.c	kexec: split kexec_load syscall from kexec core code	2015-09-10 13:29:01 -07:00
relay.c	kernel/relay.c: use kvfree() in relay_free_page_array()	2015-06-30 19:44:59 -07:00
resource.c	/proc/iomem: only expose physical resource addresses to privileged users	2017-08-06 19:19:42 -07:00
seccomp.c	seccomp: fix the usage of get/put_seccomp_filter() in seccomp_get_filter()	2017-10-05 09:41:46 +02:00
signal.c	kernel/signal.c: remove the no longer needed SIGNAL_UNKILLABLE check in complete_signal()	2018-01-10 09:27:11 +01:00
smp.c	mm, page_alloc: distinguish between being unable to sleep, unwilling to sleep and avoiding waking kswapd	2015-11-06 17:50:42 -08:00
smpboot.c	stop_machine: Kill smp_hotplug_thread->pre_unpark, introduce stop_machine_unpark()	2015-10-20 10:23:55 +02:00
smpboot.h
softirq.c
stacktrace.c
stop_machine.c	kernel: remove stop_machine() Kconfig dependency	2015-12-12 10:15:34 -08:00
sys.c	prctl: take mmap sem for writing to protect against others	2016-02-25 12:01:25 -08:00
sys_ni.c	mm: mlock: add new mlock system call	2015-11-05 19:34:48 -08:00
sysctl.c	timer/sysclt: Restrict timer migration sysctl values to 0 and 1	2017-10-05 09:41:47 +02:00
sysctl_binary.c	fs/coredump: prevent fsuid=0 dumps into user-controlled directories	2016-04-12 09:08:58 -07:00
task_work.c	task_work: remove fifo ordering guarantee	2015-09-05 13:46:58 -07:00
taskstats.c
test_kprobes.c
torture.c	torture: Consolidate cond_resched_rcu_qs() into stutter_wait()	2015-10-06 11:25:01 -07:00
tracepoint.c	tracepoint: Give priority to probes of tracepoints	2015-10-25 21:33:54 -04:00
tsacct.c
uid16.c	kernel: make groups_sort calling a responsibility group_info allocators	2018-01-10 09:27:10 +01:00
up.c
user-return-notifier.c
user.c
user_namespace.c	capabilities: ambient capabilities	2015-09-04 16:54:41 -07:00
utsname.c
utsname_sysctl.c
watchdog.c	kernel/watchdog: use nmi registers snapshot in hardlockup handler	2017-01-06 11:16:16 +01:00
workqueue.c	workqueue: trigger WARN if queue_delayed_work() is called with NULL @wq	2017-12-16 10:33:52 +01:00
workqueue_internal.h	workqueue: Fix NULL pointer dereference	2017-11-15 17:13:11 +01:00