Re: [PATCH v2 bpf] bpf: introduce BPF_JIT_ALWAYS_ON config

[Daniel Borkmann]

On 01/09/2018 05:52 AM, Alexei Starovoitov wrote:
> The BPF interpreter has been used as part of the spectre 2 attack CVE-2017-5715.
> 
> A quote from goolge project zero blog:
> "At this point, it would normally be necessary to locate gadgets in
> the host kernel code that can be used to actually leak data by reading
> from an attacker-controlled location, shifting and masking the result
> appropriately and then using the result of that as offset to an
> attacker-controlled address for a load. But piecing gadgets together
> and figuring out which ones work in a speculation context seems annoying.
> So instead, we decided to use the eBPF interpreter, which is built into
> the host kernel - while there is no legitimate way to invoke it from inside
> a VM, the presence of the code in the host kernel's text section is sufficient
> to make it usable for the attack, just like with ordinary ROP gadgets."
> 
> To make attacker job harder introduce BPF_JIT_ALWAYS_ON config
> option that removes interpreter from the kernel in favor of JIT-only mode.
> So far eBPF JIT is supported by:
> x64, arm64, arm32, sparc64, s390, powerpc64, mips64
> 
> The start of JITed program is randomized and code page is marked as read-only.
> In addition "constant blinding" can be turned on with net.core.bpf_jit_harden
> 
> v1->v2:
> - fix init order, test_bpf and cBPF (Daniel's feedback)
> - fix offloaded bpf (Jakub's feedback)
> - add 'return 0' dummy in case something can invoke prog->bpf_func
> - retarget bpf tree. For bpf-next the patch would need one extra hunk.
>   It will be sent when the trees are merged back to net-next
> 
> Considered doing:
>   int bpf_jit_enable __read_mostly = BPF_EBPF_JIT_DEFAULT;
> but it seems better to land the patch as-is and in bpf-next remove
> bpf_jit_enable global variable from all JITs, consolidate in one place
> and remove this jit_init() function.

Ok, makes sense.

[...]

Still one minor thing left:

> @@ -1354,6 +1357,12 @@ static int bpf_check_tail_call(const struct bpf_prog *fp)
>  	return 0;
>  }
>  
> +static unsigned int __bpf_prog_ret0(const void *ctx,
> +				    const struct bpf_insn *insn)
> +{
> +	return 0;
> +}

When CONFIG_BPF_JIT_ALWAYS_ON is disabled, this will throw the following
warning:

[...]
  CC      kernel/bpf/core.o
kernel/bpf/core.c:1360:21: warning: â__bpf_prog_ret0â defined but not used [-Wunused-function]
 static unsigned int __bpf_prog_ret0(const void *ctx,
                     ^~~~~~~~~~~~~~~

Probably just best to wrap it under ifdef CONFIG_BPF_JIT_ALWAYS_ON.

>  /**
>   *	bpf_prog_select_runtime - select exec runtime for BPF program
>   *	@fp: bpf_prog populated with internal BPF program
> @@ -1364,9 +1373,13 @@ static int bpf_check_tail_call(const struct bpf_prog *fp)
>   */
>  struct bpf_prog *bpf_prog_select_runtime(struct bpf_prog *fp, int *err)
>  {
> +#ifndef CONFIG_BPF_JIT_ALWAYS_ON
>  	u32 stack_depth = max_t(u32, fp->aux->stack_depth, 1);
>  
>  	fp->bpf_func = interpreters[(round_up(stack_depth, 32) / 32) - 1];
> +#else
> +	fp->bpf_func = __bpf_prog_ret0;
> +#endif
>  
>  	/* eBPF JITs can rewrite the program in case constant
>  	 * blinding is active. However, in case of error during
> @@ -1376,6 +1389,12 @@ struct bpf_prog *bpf_prog_select_runtime(struct bpf_prog *fp, int *err)
>  	 */
>  	if (!bpf_prog_is_dev_bound(fp->aux)) {
>  		fp = bpf_int_jit_compile(fp);
> +#ifdef CONFIG_BPF_JIT_ALWAYS_ON
> +		if (!fp->jited) {
> +			*err = -ENOTSUPP;
> +			return fp;
> +		}
> +#endif
>  	} else {
>  		*err = bpf_prog_offload_compile(fp);
>  		if (*err)