bpf: Prevent mmap()'ing read-only maps as writable

As discussed in [0], it's dangerous to allow mapping BPF map, that's meant to
be frozen and is read-only on BPF program side, because that allows user-space
to actually store a writable view to the page even after it is frozen. This is
exacerbated by BPF verifier making a strong assumption that contents of such
frozen map will remain unchanged. To prevent this, disallow mapping
BPF_F_RDONLY_PROG mmap()'able BPF maps as writable, ever.

  [0] https://lore.kernel.org/bpf/CAEf4BzYGWYhXdp6BJ7_=9OQPJxQpgug080MMjdSB72i9R+5c6g@mail.gmail.com/

Fixes: fc9702273e2e ("bpf: Add mmap() support for BPF_MAP_TYPE_ARRAY")
Suggested-by: Jann Horn <jannh@google.com>
Signed-off-by: Andrii Nakryiko <andriin@fb.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Reviewed-by: Jann Horn <jannh@google.com>
Link: https://lore.kernel.org/bpf/20200519053824.1089415-1-andriin@fb.com

diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 2843bbba9ca10a30ac48359a8f4f1e4dfdc7c5db..4e6dee19a668f09ebab03d535a79b663c2b42ba5 100644 (file)
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -623,9 +623,20 @@ static int bpf_map_mmap(struct file *filp, struct vm_area_struct *vma)
 
        mutex_lock(&map->freeze_mutex);
 
-       if ((vma->vm_flags & VM_WRITE) && map->frozen) {
-               err = -EPERM;
-               goto out;
+       if (vma->vm_flags & VM_WRITE) {
+               if (map->frozen) {
+                       err = -EPERM;
+                       goto out;
+               }
+               /* map is meant to be read-only, so do not allow mapping as
+                * writable, because it's possible to leak a writable page
+                * reference and allows user-space to still modify it after
+                * freezing, while verifier will assume contents do not change
+                */
+               if (map->map_flags & BPF_F_RDONLY_PROG) {
+                       err = -EACCES;
+                       goto out;
+               }
        }
 
        /* set default open/close callbacks */

diff --git a/tools/testing/selftests/bpf/prog_tests/mmap.c b/tools/testing/selftests/bpf/prog_tests/mmap.c
index 6b9dce431d4165425981adbfc65f1ca4fde19328..43d0b5578f461fa1664c2f9160cb401d7a279f42 100644 (file)
--- a/tools/testing/selftests/bpf/prog_tests/mmap.c
+++ b/tools/testing/selftests/bpf/prog_tests/mmap.c
@@ -19,7 +19,7 @@ void test_mmap(void)
        const size_t map_sz = roundup_page(sizeof(struct map_data));
        const int zero = 0, one = 1, two = 2, far = 1500;
        const long page_size = sysconf(_SC_PAGE_SIZE);
-       int err, duration = 0, i, data_map_fd, data_map_id, tmp_fd;
+       int err, duration = 0, i, data_map_fd, data_map_id, tmp_fd, rdmap_fd;
        struct bpf_map *data_map, *bss_map;
        void *bss_mmaped = NULL, *map_mmaped = NULL, *tmp1, *tmp2;
        struct test_mmap__bss *bss_data;
@@ -37,6 +37,17 @@ void test_mmap(void)
        data_map = skel->maps.data_map;
        data_map_fd = bpf_map__fd(data_map);
 
+       rdmap_fd = bpf_map__fd(skel->maps.rdonly_map);
+       tmp1 = mmap(NULL, 4096, PROT_READ | PROT_WRITE, MAP_SHARED, rdmap_fd, 0);
+       if (CHECK(tmp1 != MAP_FAILED, "rdonly_write_mmap", "unexpected success\n")) {
+               munmap(tmp1, 4096);
+               goto cleanup;
+       }
+       /* now double-check if it's mmap()'able at all */
+       tmp1 = mmap(NULL, 4096, PROT_READ, MAP_SHARED, rdmap_fd, 0);
+       if (CHECK(tmp1 == MAP_FAILED, "rdonly_read_mmap", "failed: %d\n", errno))
+               goto cleanup;
+
        /* get map's ID */
        memset(&map_info, 0, map_info_sz);
        err = bpf_obj_get_info_by_fd(data_map_fd, &map_info, &map_info_sz);

diff --git a/tools/testing/selftests/bpf/progs/test_mmap.c b/tools/testing/selftests/bpf/progs/test_mmap.c
index 6239596cd14e635866829ff7f9668191b3b3f714..4eb42cff5fe966e8405770672daa6aaaf82457f4 100644 (file)
--- a/tools/testing/selftests/bpf/progs/test_mmap.c
+++ b/tools/testing/selftests/bpf/progs/test_mmap.c
@@ -7,6 +7,14 @@
 
 char _license[] SEC("license") = "GPL";
 
+struct {
+       __uint(type, BPF_MAP_TYPE_ARRAY);
+       __uint(max_entries, 4096);
+       __uint(map_flags, BPF_F_MMAPABLE | BPF_F_RDONLY_PROG);
+       __type(key, __u32);
+       __type(value, char);
+} rdonly_map SEC(".maps");
+
 struct {
        __uint(type, BPF_MAP_TYPE_ARRAY);
        __uint(max_entries, 512 * 4); /* at least 4 pages of data */