[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAADnVQKaqKJA_PPLNggzt=BY6jqsCbgpA4MM9ikkP+qY4f8zSQ@mail.gmail.com>
Date: Wed, 8 Nov 2023 10:04:51 -0800
From: Alexei Starovoitov <alexei.starovoitov@...il.com>
To: Solar Designer <solar@...nwall.com>, Daniel Borkmann <daniel@...earbox.net>
Cc: oss-security@...ts.openwall.com, Hsin-Wei Hung <hsinweih@....edu>,
Alexei Starovoitov <ast@...nel.org>
Subject: Re: Linux: BPF: issues with copy_from_user_nofault()
On Sun, Nov 5, 2023 at 2:43 PM Solar Designer <solar@...nwall.com> wrote:
>
> Hi,
>
> Looks like the below wasn't brought to oss-security yet.
>
> As I understand from what was posted to the linux-distros thread, the
> issue was being fixed in:
>
> https://lore.kernel.org/bpf/20230118051443.78988-1-alexei.starovoitov@gmail.com/
>
> and actually fixed in:
>
> https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/commit/?id=d319f344561d
>
> and it should have been merged to stable "tomorrow or so" after June 27,
> at which point Hsin-Wei Hung was supposed to finally make the
> oss-security posting, but apparently that never happened.
>
> Of course, the delay from January 2 to June 28 was way in excess of the
> supposed maximum, and it is even more ridiculous we didn't post in here
> for even longer.
>
> This is what happens when no one in particular keeps tracking issues
> after they fall out of the attention span. This is also why we need to
> take care of the distros list statistics task in real time, not only
> retroactively like I'm doing for 2023 now.
As I tried to explain, the fix addresses two things:
- the WARN. By itself it's harmless and the severity is low.
- lockup with CONFIG_HARDENED_USERCOPY from bpf. That is a real bug
and backports are necessary.
But the 2nd part of the fix:
https://lore.kernel.org/bpf/20230118051443.78988-2-alexei.starovoitov@gmail.com/
was never merged.
Essentially perf (without any bpf) is broken on arm64 and others.
arch_perf_out_copy_user() might deadlock with CONFIG_HARDENED_USERCOPY.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
