bpf: CVE-2017-17856

bpf: force strict alignment checks for stack pointers

Reference:
https://nvd.nist.gov/vuln/detail/CVE-2017-17856
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-4.14.y&id=c90268f7cbee0781331b96d1423d0f28a6183889

Change-Id: Ie064962ab3e3bd59e79a919f530355e713e908f1
Signed-off-by: Andreas Wellving <andreas.wellving@enea.com>

1 files changed, 45 insertions, 0 deletions

diff --git a/patches/cve/CVE-2017-17856-bpf-force-strict-alignment-checks-for-stack-pointers.patch b/patches/cve/CVE-2017-17856-bpf-force-strict-alignment-checks-for-stack-pointers.patch
new file mode 100644
index 0000000..e440dc2
--- /dev/null
+++ b/patches/cve/CVE-2017-17856-bpf-force-strict-alignment-checks-for-stack-pointers.patch
@@ -0,0 +1,45 @@
+From c90268f7cbee0781331b96d1423d0f28a6183889 Mon Sep 17 00:00:00 2001
+From: Daniel Borkmann <daniel@iogearbox.net>
+Date: Fri, 22 Dec 2017 16:23:09 +0100
+Subject: [PATCH] bpf: force strict alignment checks for stack pointers
+
+From: Jann Horn <jannh@google.com>
+
+[ Upstream commit a5ec6ae161d72f01411169a938fa5f8baea16e8f ]
+
+Force strict alignment checks for stack pointers because the tracking of
+stack spills relies on it; unaligned stack accesses can lead to corruption
+of spilled registers, which is exploitable.
+
+CVE: CVE-2017-17856
+Upstream-Status: Backport [https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-4.14.y&id=c90268f7cbee0781331b96d1423d0f28a6183889]
+
+Fixes: f1174f77b50c ("bpf/verifier: rework value tracking")
+Signed-off-by: Jann Horn <jannh@google.com>
+Signed-off-by: Alexei Starovoitov <ast@kernel.org>
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Signed-off-by: Andreas Wellving <andreas.wellving@enea.com>
+---
+ kernel/bpf/verifier.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index 8aa98a0591d6..8c353554628e 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -1061,6 +1061,11 @@ static int check_ptr_alignment(struct bpf_verifier_env *env,
+                break;
+        case PTR_TO_STACK:
+                pointer_desc = "stack ";
++               /* The stack spill tracking logic in check_stack_write()
++                * and check_stack_read() relies on stack accesses being
++                * aligned.
++                */
++               strict = true;
+                break;
+        default:
+                break;
+-- 
+2.20.1
+