Re: [PATCH bpf-next 1/5] bpf: Reject indirect var_off stack access in raw mode

Daniel Borkmann [Wed, 2019-04-03 16:19 -0700]: > On 04/03/2019 11:57 PM, Andrey Ignatov wrote: > > Daniel Borkmann [Wed, 2019-04-03 09:46 -0700]: > >> On 04/03/2019 06:21 PM, Daniel Borkmann wrote: > >>> On 04/02/2019 10:19 PM, Andrey Ignatov wrote: ... > >>> > min_off = reg

Re: [PATCH bpf-next 1/5] bpf: Reject indirect var_off stack access in raw mode

On 04/03/2019 11:57 PM, Andrey Ignatov wrote: > Daniel Borkmann [Wed, 2019-04-03 09:46 -0700]: >> On 04/03/2019 06:21 PM, Daniel Borkmann wrote: >>> On 04/02/2019 10:19 PM, Andrey Ignatov wrote: It's hard to guarantee that whole memory is marked as initialized on helper return if uniniti

Re: [PATCH bpf-next 1/5] bpf: Reject indirect var_off stack access in raw mode

On 04/03/2019 11:02 PM, Andrey Ignatov wrote: > Daniel Borkmann [Wed, 2019-04-03 09:22 -0700]: >> On 04/02/2019 10:19 PM, Andrey Ignatov wrote: >>> It's hard to guarantee that whole memory is marked as initialized on >>> helper return if uninitialized stack is accessed with variable offset >>> sin

Re: [PATCH bpf-next 1/5] bpf: Reject indirect var_off stack access in raw mode

Daniel Borkmann [Wed, 2019-04-03 09:46 -0700]: > On 04/03/2019 06:21 PM, Daniel Borkmann wrote: > > On 04/02/2019 10:19 PM, Andrey Ignatov wrote: > >> It's hard to guarantee that whole memory is marked as initialized on > >> helper return if uninitialized stack is accessed with variable offset > >

Re: [PATCH bpf-next 1/5] bpf: Reject indirect var_off stack access in raw mode

Daniel Borkmann [Wed, 2019-04-03 09:22 -0700]: > On 04/02/2019 10:19 PM, Andrey Ignatov wrote: > > It's hard to guarantee that whole memory is marked as initialized on > > helper return if uninitialized stack is accessed with variable offset > > since specific bounds are unknown to verifier. This

Re: [PATCH bpf-next 1/5] bpf: Reject indirect var_off stack access in raw mode

On 04/03/2019 06:21 PM, Daniel Borkmann wrote: > On 04/02/2019 10:19 PM, Andrey Ignatov wrote: >> It's hard to guarantee that whole memory is marked as initialized on >> helper return if uninitialized stack is accessed with variable offset >> since specific bounds are unknown to verifier. This may

Re: [PATCH bpf-next 1/5] bpf: Reject indirect var_off stack access in raw mode

On 04/02/2019 10:19 PM, Andrey Ignatov wrote: > It's hard to guarantee that whole memory is marked as initialized on > helper return if uninitialized stack is accessed with variable offset > since specific bounds are unknown to verifier. This may cause > uninitialized stack leaking. > > Reject suc

[PATCH bpf-next 1/5] bpf: Reject indirect var_off stack access in raw mode

It's hard to guarantee that whole memory is marked as initialized on helper return if uninitialized stack is accessed with variable offset since specific bounds are unknown to verifier. This may cause uninitialized stack leaking. Reject such an access in check_stack_boundary to prevent possible le