Re: [PATCH 2/3] Revert "bpf: Fix issue in verifying allow_ptr_leaks"

2023-09-28 Thread Luis Gerhorst
On Tue, 19 Sep 2023 01:57:21 -0700 Alexei Starovoitov wrote: > r9 is supposed to be available in the callee-saved register? :) > I think you're missing that it is _callee_ saved. I'm sorry I guess this was not clear enough, the idea was that this register is not used by the callee, and therefore

Re: [PATCH 2/3] Revert "bpf: Fix issue in verifying allow_ptr_leaks"

2023-09-19 Thread Alexei Starovoitov
On Mon, Sep 18, 2023 at 4:26 AM Luis Gerhorst wrote: > > It is true that this is not easily possible using the method most exploits > use, > at least to my knowledge (i.e., accessing the same address from another core). > However, it is still possible to evict the cacheline with

Re: [PATCH 2/3] Revert "bpf: Fix issue in verifying allow_ptr_leaks"

2023-09-19 Thread Daniel Borkmann
On 9/19/23 5:43 AM, Yafang Shao wrote: On Mon, Sep 18, 2023 at 7:52 PM Luis Gerhorst wrote: On 15/09/2023 04:26, Yafang Shao wrote: On Wed, Sep 13, 2023 at 8:30 PM Luis Gerhorst wrote: This reverts commit d75e30dddf73449bc2d10bb8e2f1a2c446bc67a2. To mitigate Spectre v1, the verifier

Re: [PATCH 2/3] Revert "bpf: Fix issue in verifying allow_ptr_leaks"

2023-09-18 Thread Yafang Shao
On Mon, Sep 18, 2023 at 7:52 PM Luis Gerhorst wrote: > > On 15/09/2023 04:26, Yafang Shao wrote: > > On Wed, Sep 13, 2023 at 8:30 PM Luis Gerhorst wrote: > >> > >> This reverts commit d75e30dddf73449bc2d10bb8e2f1a2c446bc67a2. > >> > >> To mitigate Spectre v1, the verifier relies on static

Re: [PATCH 2/3] Revert "bpf: Fix issue in verifying allow_ptr_leaks"

2023-09-18 Thread Luis Gerhorst
On 15/09/2023 04:26, Yafang Shao wrote: On Wed, Sep 13, 2023 at 8:30 PM Luis Gerhorst wrote: This reverts commit d75e30dddf73449bc2d10bb8e2f1a2c446bc67a2. To mitigate Spectre v1, the verifier relies on static analysis to deduct constant pointer bounds, which can then be enforced by rewriting

Re: [PATCH 2/3] Revert "bpf: Fix issue in verifying allow_ptr_leaks"

2023-09-18 Thread Luis Gerhorst
On Thu, 14 Sep 2023 12:47:16 -0700, Alexei Starovoitov wrote: > You mean since skb_shared_info is placed after skb->end > and in zero copy case destructor_arg may be initialized with the same > kernel pointer for multiple skb-s ? > The attacker cannot construct the address from data_end. > The

Re: [PATCH 2/3] Revert "bpf: Fix issue in verifying allow_ptr_leaks"

2023-09-14 Thread Yafang Shao
On Wed, Sep 13, 2023 at 8:30 PM Luis Gerhorst wrote: > > This reverts commit d75e30dddf73449bc2d10bb8e2f1a2c446bc67a2. > > To mitigate Spectre v1, the verifier relies on static analysis to deduct > constant pointer bounds, which can then be enforced by rewriting pointer > arithmetic [1] or index

Re: [PATCH 2/3] Revert "bpf: Fix issue in verifying allow_ptr_leaks"

2023-09-14 Thread Alexei Starovoitov
On Thu, Sep 14, 2023 at 10:24 AM Daniel Borkmann wrote: > > On 9/14/23 6:20 PM, Alexei Starovoitov wrote: > > On Wed, Sep 13, 2023 at 5:30 AM Luis Gerhorst wrote: > >> > >> This reverts commit d75e30dddf73449bc2d10bb8e2f1a2c446bc67a2. > >> > >> To mitigate Spectre v1, the verifier relies on

Re: [PATCH 2/3] Revert "bpf: Fix issue in verifying allow_ptr_leaks"

2023-09-14 Thread Daniel Borkmann
On 9/14/23 6:20 PM, Alexei Starovoitov wrote: On Wed, Sep 13, 2023 at 5:30 AM Luis Gerhorst wrote: This reverts commit d75e30dddf73449bc2d10bb8e2f1a2c446bc67a2. To mitigate Spectre v1, the verifier relies on static analysis to deduct constant pointer bounds, which can then be enforced by

Re: [PATCH 2/3] Revert "bpf: Fix issue in verifying allow_ptr_leaks"

2023-09-14 Thread Alexei Starovoitov
On Wed, Sep 13, 2023 at 5:30 AM Luis Gerhorst wrote: > > This reverts commit d75e30dddf73449bc2d10bb8e2f1a2c446bc67a2. > > To mitigate Spectre v1, the verifier relies on static analysis to deduct > constant pointer bounds, which can then be enforced by rewriting pointer > arithmetic [1] or index

[PATCH 2/3] Revert "bpf: Fix issue in verifying allow_ptr_leaks"

2023-09-13 Thread Luis Gerhorst
This reverts commit d75e30dddf73449bc2d10bb8e2f1a2c446bc67a2. To mitigate Spectre v1, the verifier relies on static analysis to deduct constant pointer bounds, which can then be enforced by rewriting pointer arithmetic [1] or index masking [2]. This relies on the fact that every memory region to