On Fri, Feb 1, 2019 at 3:45 PM Greg Kroah-Hartman gregkh@linuxfoundation.org wrote:
On Fri, Feb 01, 2019 at 03:08:52PM +0100, Greg Kroah-Hartman wrote:
On Fri, Feb 01, 2019 at 03:00:18PM +0100, Jann Horn wrote:
On Tue, Jan 29, 2019 at 12:47 PM Greg Kroah-Hartman gregkh@linuxfoundation.org wrote:
4.19-stable review patch. If anyone has any objections, please let me know.
[ commit 979d63d50c0c0f7bc537bf821e056cc9fe5abd38 upstream ]
Jann reported that the original commit back in b2157399cc98 ("bpf: prevent out-of-bounds speculation") was not sufficient to stop CPU from speculating out of bounds memory access: While b2157399cc98 only focussed on masking array map access for unprivileged users for tail calls and data access such that the user provided index gets sanitized from BPF program and syscall side, there is still a more generic form affected from BPF programs that applies to most maps that hold user data in relation to dynamic map access when dealing with unknown scalars or "slow" known scalars as access offset, for example:
Is this also going into 4.14 and 4.9? I don't see anything related in the stable queue or in stable-rc.
Ah, the original submitter did not send backported patches, but you are right, it should go further back. I'll see how hard it would be to do the backport, thanks for letting me know.
Ok, no, there's no way I can do this backport. It didn't apply cleanly, and trying to take the patches prior to this resulted in a huge mess.
So, it would be wonderful if someone who knows the bpf code stack could do this and send it in.
Daniel, Alexei: Can one of you do the backports to older stable kernels?
Given that the 4.19 and 4.20 stable kernels are out, I'm going to derestrict the entry in our bugtracker now.