From patchwork Thu May 27 00:11:49 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Thadeu Lima de Souza Cascardo X-Patchwork-Id: 1484351 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (no SPF record) smtp.mailfrom=lists.ubuntu.com (client-ip=91.189.94.19; helo=huckleberry.canonical.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=) Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 4Fr7Y04fspz9sVt; Thu, 27 May 2021 10:12:03 +1000 (AEST) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.86_2) (envelope-from ) id 1lm3d1-0001qL-Ec; Thu, 27 May 2021 00:11:59 +0000 Received: from youngberry.canonical.com ([91.189.89.112]) by huckleberry.canonical.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1lm3d0-0001q6-4c for kernel-team@lists.ubuntu.com; Thu, 27 May 2021 00:11:58 +0000 Received: from [177.198.111.192] (helo=mussarela..) by youngberry.canonical.com with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (Exim 4.93) (envelope-from ) id 1lm3cz-0002uV-DY for kernel-team@lists.ubuntu.com; Thu, 27 May 2021 00:11:57 +0000 From: Thadeu Lima de Souza Cascardo To: kernel-team@lists.ubuntu.com Subject: [SRU Groovy, Focal/linux-oem-5.10/Hirsute 1/2] UBUNTU: SAUCE: Revert "UBUNTU: SAUCE: bpf: prevent writable memory-mapping of read-only ringbuf pages" Date: Wed, 26 May 2021 21:11:49 -0300 Message-Id: <20210527001150.38562-2-cascardo@canonical.com> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20210527001150.38562-1-cascardo@canonical.com> References: <20210527001150.38562-1-cascardo@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" This reverts commit abcc616635230904054f511bf99ec5b4bc819239. Though the else is aligned to the first if, as there are no braces being used, it refers to the second if. There is no harm in the cases where !(vma->vm_flags & VM_WRITE), because kernel/bpf/syscall.c:bpf_map_mmap will already do it before calling our ringbuf mmap function. However, for the case of mapping the consumer pointer page, it will have its VM_MAYWRITE flag removed. This prevents mprotect(PROT_WRITE) from working. The following commit will apply the upstream version, which has this fixed, hence reverting this one. Reported-by: Kamal Mostafa CVE-2021-3489 Signed-off-by: Thadeu Lima de Souza Cascardo --- kernel/bpf/ringbuf.c | 19 ++++++++++++------- 1 file changed, 12 insertions(+), 7 deletions(-) diff --git a/kernel/bpf/ringbuf.c b/kernel/bpf/ringbuf.c index debe27564924..1619afe00ded 100644 --- a/kernel/bpf/ringbuf.c +++ b/kernel/bpf/ringbuf.c @@ -247,20 +247,25 @@ static int ringbuf_map_get_next_key(struct bpf_map *map, void *key, return -ENOTSUPP; } +static size_t bpf_ringbuf_mmap_page_cnt(const struct bpf_ringbuf *rb) +{ + size_t data_pages = (rb->mask + 1) >> PAGE_SHIFT; + + /* consumer page + producer page + 2 x data pages */ + return RINGBUF_POS_PAGES + 2 * data_pages; +} + static int ringbuf_map_mmap(struct bpf_map *map, struct vm_area_struct *vma) { struct bpf_ringbuf_map *rb_map; + size_t mmap_sz; rb_map = container_of(map, struct bpf_ringbuf_map, map); + mmap_sz = bpf_ringbuf_mmap_page_cnt(rb_map->rb) << PAGE_SHIFT; - if (vma->vm_flags & VM_WRITE) - /* allow writable mapping for the consumer_pos only */ - if (vma->vm_pgoff != 0 || vma->vm_end - vma->vm_start != PAGE_SIZE) - return -EPERM; - else - vma->vm_flags &= ~VM_MAYWRITE; + if (vma->vm_pgoff * PAGE_SIZE + (vma->vm_end - vma->vm_start) > mmap_sz) + return -EINVAL; - /* remap_vmalloc_range() checks size and offset constraints */ return remap_vmalloc_range(vma, rb_map->rb, vma->vm_pgoff + RINGBUF_PGOFF); }