bpf: Take return from set_memory_rox() into account with bpf_jit_binary_lock_ro()

set_memory_rox() can fail, leaving memory unprotected.

Check return and bail out when bpf_jit_binary_lock_ro() returns
an error.

Link: https://github.com/KSPP/linux/issues/7
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Cc: linux-hardening@vger.kernel.org <linux-hardening@vger.kernel.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Puranjay Mohan <puranjay12@gmail.com>
Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com>  # s390x
Acked-by: Tiezhu Yang <yangtiezhu@loongson.cn>  # LoongArch
Reviewed-by: Johan Almbladh <johan.almbladh@anyfinetworks.com> # MIPS Part
Message-ID: <036b6393f23a2032ce75a1c92220b2afcb798d5d.1709850515.git.christophe.leroy@csgroup.eu>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

diff --git a/arch/arm/net/bpf_jit_32.c b/arch/arm/net/bpf_jit_32.c
index 1d672457d02ff3fcdd849c57c9108f94a8563886..01516f83a95aca49b4223cc0b202bdc016abd1a8 100644 (file)
--- a/arch/arm/net/bpf_jit_32.c
+++ b/arch/arm/net/bpf_jit_32.c
@@ -2222,28 +2222,21 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
        /* If building the body of the JITed code fails somehow,
         * we fall back to the interpretation.
         */
-       if (build_body(&ctx) < 0) {
-               image_ptr = NULL;
-               bpf_jit_binary_free(header);
-               prog = orig_prog;
-               goto out_imms;
-       }
+       if (build_body(&ctx) < 0)
+               goto out_free;
        build_epilogue(&ctx);
 
        /* 3.) Extra pass to validate JITed Code */
-       if (validate_code(&ctx)) {
-               image_ptr = NULL;
-               bpf_jit_binary_free(header);
-               prog = orig_prog;
-               goto out_imms;
-       }
+       if (validate_code(&ctx))
+               goto out_free;
        flush_icache_range((u32)header, (u32)(ctx.target + ctx.idx));
 
        if (bpf_jit_enable > 1)
                /* there are 2 passes here */
                bpf_jit_dump(prog->len, image_size, 2, ctx.target);
 
-       bpf_jit_binary_lock_ro(header);
+       if (bpf_jit_binary_lock_ro(header))
+               goto out_free;
        prog->bpf_func = (void *)ctx.target;
        prog->jited = 1;
        prog->jited_len = image_size;
@@ -2260,5 +2253,11 @@ out:
                bpf_jit_prog_release_other(prog, prog == orig_prog ?
                                           tmp : orig_prog);
        return prog;
+
+out_free:
+       image_ptr = NULL;
+       bpf_jit_binary_free(header);
+       prog = orig_prog;
+       goto out_imms;
 }
 

diff --git a/arch/loongarch/net/bpf_jit.c b/arch/loongarch/net/bpf_jit.c
index e73323d759d0b85b275aa389fc684b74d12cb13e..7dbefd4ba21071ff5b7f3b606a9765a0a54ba604 100644 (file)
--- a/arch/loongarch/net/bpf_jit.c
+++ b/arch/loongarch/net/bpf_jit.c
@@ -1294,16 +1294,19 @@ skip_init_ctx:
        flush_icache_range((unsigned long)header, (unsigned long)(ctx.image + ctx.idx));
 
        if (!prog->is_func || extra_pass) {
+               int err;
+
                if (extra_pass && ctx.idx != jit_data->ctx.idx) {
                        pr_err_once("multi-func JIT bug %d != %d\n",
                                    ctx.idx, jit_data->ctx.idx);
-                       bpf_jit_binary_free(header);
-                       prog->bpf_func = NULL;
-                       prog->jited = 0;
-                       prog->jited_len = 0;
-                       goto out_offset;
+                       goto out_free;
+               }
+               err = bpf_jit_binary_lock_ro(header);
+               if (err) {
+                       pr_err_once("bpf_jit_binary_lock_ro() returned %d\n",
+                                   err);
+                       goto out_free;
                }
-               bpf_jit_binary_lock_ro(header);
        } else {
                jit_data->ctx = ctx;
                jit_data->image = image_ptr;
@@ -1334,6 +1337,13 @@ out:
        out_offset = -1;
 
        return prog;
+
+out_free:
+       bpf_jit_binary_free(header);
+       prog->bpf_func = NULL;
+       prog->jited = 0;
+       prog->jited_len = 0;
+       goto out_offset;
 }
 
 /* Indicate the JIT backend supports mixing bpf2bpf and tailcalls. */

diff --git a/arch/mips/net/bpf_jit_comp.c b/arch/mips/net/bpf_jit_comp.c
index a40d926b6513984623815b6e566d427260ccce22..e355dfca440087520182a8a12d5f832ba86f31b9 100644 (file)
--- a/arch/mips/net/bpf_jit_comp.c
+++ b/arch/mips/net/bpf_jit_comp.c
@@ -1012,7 +1012,8 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog)
        bpf_prog_fill_jited_linfo(prog, &ctx.descriptors[1]);
 
        /* Set as read-only exec and flush instruction cache */
-       bpf_jit_binary_lock_ro(header);
+       if (bpf_jit_binary_lock_ro(header))
+               goto out_err;
        flush_icache_range((unsigned long)header,
                           (unsigned long)&ctx.target[ctx.jit_index]);
 

diff --git a/arch/parisc/net/bpf_jit_core.c b/arch/parisc/net/bpf_jit_core.c
index d6ee2fd455503795e918c6f7cdd8d197eaca0eee..979f45d4d1fbeae5a60d92345409d413d352e7e1 100644 (file)
--- a/arch/parisc/net/bpf_jit_core.c
+++ b/arch/parisc/net/bpf_jit_core.c
@@ -167,7 +167,13 @@ skip_init_ctx:
        bpf_flush_icache(jit_data->header, ctx->insns + ctx->ninsns);
 
        if (!prog->is_func || extra_pass) {
-               bpf_jit_binary_lock_ro(jit_data->header);
+               if (bpf_jit_binary_lock_ro(jit_data->header)) {
+                       bpf_jit_binary_free(jit_data->header);
+                       prog->bpf_func = NULL;
+                       prog->jited = 0;
+                       prog->jited_len = 0;
+                       goto out_offset;
+               }
                prologue_len = ctx->epilogue_offset - ctx->body_len;
                for (i = 0; i < prog->len; i++)
                        ctx->offset[i] += prologue_len;

diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
index b418333bb08635304780933646e26f5ab9354e8e..e613eebfd3492fde3019780dcca19d72b3e0b492 100644 (file)
--- a/arch/s390/net/bpf_jit_comp.c
+++ b/arch/s390/net/bpf_jit_comp.c
@@ -2111,7 +2111,11 @@ skip_init_ctx:
                print_fn_code(jit.prg_buf, jit.size_prg);
        }
        if (!fp->is_func || extra_pass) {
-               bpf_jit_binary_lock_ro(header);
+               if (bpf_jit_binary_lock_ro(header)) {
+                       bpf_jit_binary_free(header);
+                       fp = orig_fp;
+                       goto free_addrs;
+               }
        } else {
                jit_data->header = header;
                jit_data->ctx = jit;

diff --git a/arch/sparc/net/bpf_jit_comp_64.c b/arch/sparc/net/bpf_jit_comp_64.c
index fa0759bfe498e917b0b215d2a24d1269d645161f..73bf0aea8baf14711c3d094d93aa782a65b382bf 100644 (file)
--- a/arch/sparc/net/bpf_jit_comp_64.c
+++ b/arch/sparc/net/bpf_jit_comp_64.c
@@ -1602,7 +1602,11 @@ skip_init_ctx:
        bpf_flush_icache(header, (u8 *)header + header->size);
 
        if (!prog->is_func || extra_pass) {
-               bpf_jit_binary_lock_ro(header);
+               if (bpf_jit_binary_lock_ro(header)) {
+                       bpf_jit_binary_free(header);
+                       prog = orig_prog;
+                       goto out_off;
+               }
        } else {
                jit_data->ctx = ctx;
                jit_data->image = image_ptr;

diff --git a/arch/x86/net/bpf_jit_comp32.c b/arch/x86/net/bpf_jit_comp32.c
index c10083a8e68e62df31960d724b3bc4c0baca6d06..de0f9e5f9f73a5b7a6eef778e41fde2c8a8e01e9 100644 (file)
--- a/arch/x86/net/bpf_jit_comp32.c
+++ b/arch/x86/net/bpf_jit_comp32.c
@@ -2600,8 +2600,7 @@ out_image:
        if (bpf_jit_enable > 1)
                bpf_jit_dump(prog->len, proglen, pass + 1, image);
 
-       if (image) {
-               bpf_jit_binary_lock_ro(header);
+       if (image && !bpf_jit_binary_lock_ro(header)) {
                prog->bpf_func = (void *)image;
                prog->jited = 1;
                prog->jited_len = proglen;

diff --git a/include/linux/filter.h b/include/linux/filter.h
index 9107ee1de66faa3b07a0451da72d397fca64c6ed..c0d51bff8f9652683dfaf33452f8e81a674f08e9 100644 (file)
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -898,10 +898,11 @@ static inline int __must_check bpf_prog_lock_ro(struct bpf_prog *fp)
        return 0;
 }
 
-static inline void bpf_jit_binary_lock_ro(struct bpf_binary_header *hdr)
+static inline int __must_check
+bpf_jit_binary_lock_ro(struct bpf_binary_header *hdr)
 {
        set_vm_flush_reset_perms(hdr);
-       set_memory_rox((unsigned long)hdr, hdr->size >> PAGE_SHIFT);
+       return set_memory_rox((unsigned long)hdr, hdr->size >> PAGE_SHIFT);
 }
 
 int sk_filter_trim_cap(struct sock *sk, struct sk_buff *skb, unsigned int cap);