[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CABcoxUYuVw4TC8WiiBWmt+22NmVj_TVuskSWP5Fj3NWBkvDrfA@mail.gmail.com>
Date: Wed, 8 Nov 2023 20:06:49 -0800
From: Hsin-Wei Hung <hsinweih@....edu>
To: Alexei Starovoitov <alexei.starovoitov@...il.com>
Cc: Solar Designer <solar@...nwall.com>, Daniel Borkmann <daniel@...earbox.net>,
oss-security@...ts.openwall.com, Alexei Starovoitov <ast@...nel.org>
Subject: Re: Linux: BPF: issues with copy_from_user_nofault()
On Wed, Nov 8, 2023 at 10:05 AM Alexei Starovoitov
<alexei.starovoitov@...il.com> wrote:
>
> On Sun, Nov 5, 2023 at 2:43 PM Solar Designer <solar@...nwall.com> wrote:
> >
> > Hi,
> >
> > Looks like the below wasn't brought to oss-security yet.
> >
> > As I understand from what was posted to the linux-distros thread, the
> > issue was being fixed in:
> >
> > https://urldefense.com/v3/__https://lore.kernel.org/bpf/20230118051443.78988-1-alexei.starovoitov@gmail.com/__;!!CzAuKJ42GuquVTTmVmPViYEvSg!LwWVuruWiTdoRoQltcxHLiuP59L6twXiH9K5vSXHjQAJ4Kt_PY4ZrsFacExuGA2KxoT2yqmwlLOpBauWKwhXcD6QvQ$
> >
> > and actually fixed in:
> >
> > https://urldefense.com/v3/__https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next.git/commit/?id=d319f344561d__;!!CzAuKJ42GuquVTTmVmPViYEvSg!LwWVuruWiTdoRoQltcxHLiuP59L6twXiH9K5vSXHjQAJ4Kt_PY4ZrsFacExuGA2KxoT2yqmwlLOpBauWKwj2mNm1bQ$
> >
> > and it should have been merged to stable "tomorrow or so" after June 27,
> > at which point Hsin-Wei Hung was supposed to finally make the
> > oss-security posting, but apparently that never happened.
> >
> > Of course, the delay from January 2 to June 28 was way in excess of the
> > supposed maximum, and it is even more ridiculous we didn't post in here
> > for even longer.
> >
> > This is what happens when no one in particular keeps tracking issues
> > after they fall out of the attention span. This is also why we need to
> > take care of the distros list statistics task in real time, not only
> > retroactively like I'm doing for 2023 now.
>
> As I tried to explain, the fix addresses two things:
> - the WARN. By itself it's harmless and the severity is low.
> - lockup with CONFIG_HARDENED_USERCOPY from bpf. That is a real bug
> and backports are necessary.
>
> But the 2nd part of the fix:
> https://urldefense.com/v3/__https://lore.kernel.org/bpf/20230118051443.78988-2-alexei.starovoitov@gmail.com/__;!!CzAuKJ42GuquVTTmVmPViYEvSg!LwWVuruWiTdoRoQltcxHLiuP59L6twXiH9K5vSXHjQAJ4Kt_PY4ZrsFacExuGA2KxoT2yqmwlLOpBauWKwiOE1xn7Q$
>
> was never merged.
> Essentially perf (without any bpf) is broken on arm64 and others.
> arch_perf_out_copy_user() might deadlock with CONFIG_HARDENED_USERCOPY.
Hey,
Sorry to put everyone in a tough situation. I can post it to
oss-security if Alexei agrees. I can also try to pick up the 2nd part
of the patch from where it is next week.
https://lore.kernel.org/bpf/CAADnVQJRd3r84yLcqH1Z-BYU76SRYuDMOCWRcvBfapsXs_w-rg@mail.gmail.com/
-Hsin-Wei
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
