Re: [RFC v3 04/22] bpf: Set register type according to is_valid_access()

2016-10-19 Thread Daniel Borkmann
On 10/19/2016 04:54 PM, Thomas Graf wrote: On 09/14/16 at 09:23am, Mickaël Salaün wrote: This fix a pointer leak when an unprivileged eBPF program read a pointer value from the context. Even if is_valid_access() returns a pointer type, the eBPF verifier replace it with UNKNOWN_VALUE. The

Re: [RFC v3 04/22] bpf: Set register type according to is_valid_access()

2016-10-19 Thread Daniel Borkmann
On 10/19/2016 04:54 PM, Thomas Graf wrote: On 09/14/16 at 09:23am, Mickaël Salaün wrote: This fix a pointer leak when an unprivileged eBPF program read a pointer value from the context. Even if is_valid_access() returns a pointer type, the eBPF verifier replace it with UNKNOWN_VALUE. The

Re: [RFC v3 04/22] bpf: Set register type according to is_valid_access()

2016-10-19 Thread Thomas Graf
On 09/14/16 at 09:23am, Mickaël Salaün wrote: > This fix a pointer leak when an unprivileged eBPF program read a pointer > value from the context. Even if is_valid_access() returns a pointer > type, the eBPF verifier replace it with UNKNOWN_VALUE. The register > value containing an address is then

Re: [RFC v3 04/22] bpf: Set register type according to is_valid_access()

2016-10-19 Thread Thomas Graf
On 09/14/16 at 09:23am, Mickaël Salaün wrote: > This fix a pointer leak when an unprivileged eBPF program read a pointer > value from the context. Even if is_valid_access() returns a pointer > type, the eBPF verifier replace it with UNKNOWN_VALUE. The register > value containing an address is then

[RFC v3 04/22] bpf: Set register type according to is_valid_access()

2016-09-14 Thread Mickaël Salaün
This fix a pointer leak when an unprivileged eBPF program read a pointer value from the context. Even if is_valid_access() returns a pointer type, the eBPF verifier replace it with UNKNOWN_VALUE. The register value containing an address is then allowed to leak. Moreover, this prevented

[RFC v3 04/22] bpf: Set register type according to is_valid_access()

2016-09-14 Thread Mickaël Salaün
This fix a pointer leak when an unprivileged eBPF program read a pointer value from the context. Even if is_valid_access() returns a pointer type, the eBPF verifier replace it with UNKNOWN_VALUE. The register value containing an address is then allowed to leak. Moreover, this prevented