From: Josh Poimboeuf <jpoimboe@redhat.com>

Date: Fri, 18 Feb 2022 11:49:08 -0800

Subject: x86/speculation: Include unprivileged eBPF status in Spectre v2

 mitigation reporting

Git-commit: 44a3918c8245ab10c6c9719dd12e7a8d291980d8

Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git

Patch-mainline: Queued in a subsystem tree

References: bsc#1191580 CVE-2022-0001 CVE-2022-0002

With unprivileged eBPF enabled, eIBRS (without retpoline) is vulnerable

to Spectre v2 BHB-based attacks.

When both are enabled, print a warning message and report it in the

'spectre_v2' sysfs vulnerabilities file.

Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>

Signed-off-by: Borislav Petkov <bp@suse.de>

Reviewed-by: Thomas Gleixner <tglx@linutronix.de>

---

 arch/x86/kernel/cpu/bugs.c |   35 +++++++++++++++++++++++++++++------

 include/linux/bpf.h        |   11 +++++++++++

 kernel/sysctl.c            |    8 ++++++++

 3 files changed, 48 insertions(+), 6 deletions(-)

--- a/arch/x86/kernel/cpu/bugs.c

+++ b/arch/x86/kernel/cpu/bugs.c

@@ -14,6 +14,7 @@

 #include <linux/nospec.h>

 #include <linux/prctl.h>

 #include <linux/sched/smt.h>

+#include <linux/bpf.h>

 #include <asm/spec-ctrl.h>

 #include <asm/cmdline.h>

@@ -637,6 +638,16 @@ static inline const char *spectre_v2_mod

 static inline const char *spectre_v2_module_string(void) { return ""; }

 #endif

+#define SPECTRE_V2_EIBRS_EBPF_MSG "WARNING: Unprivileged eBPF is enabled with eIBRS on, data leaks possible via Spectre v2 BHB attacks!\n"

+

+#ifdef CONFIG_BPF_SYSCALL

+void unpriv_ebpf_notify(int new_state)

+{

+	if (spectre_v2_enabled == SPECTRE_V2_EIBRS && !new_state)

+		pr_err(SPECTRE_V2_EIBRS_EBPF_MSG);

+}

+#endif

+

 static inline bool match_option(const char *arg, int arglen, const char *opt)

 {

 	int len = strlen(opt);

@@ -971,6 +982,9 @@ static void __init spectre_v2_select_mit

 		break;

 	}

+	if (mode == SPECTRE_V2_EIBRS && unprivileged_ebpf_enabled())

+		pr_err(SPECTRE_V2_EIBRS_EBPF_MSG);

+

 	if (spectre_v2_in_eibrs_mode(mode)) {

 		/* Force it so VMEXIT will restore correctly */

 		x86_spec_ctrl_base |= SPEC_CTRL_IBRS;

@@ -1578,6 +1592,20 @@ static char *ibpb_state(void)

 	return "";

 }

+static ssize_t spectre_v2_show_state(char *buf)

+{

+	if (spectre_v2_enabled == SPECTRE_V2_EIBRS && unprivileged_ebpf_enabled())

+		return sprintf(buf, "Vulnerable: Unprivileged eBPF enabled\n");

+

+	return sprintf(buf, "%s%s%s%s%s%s\n",

+		       spectre_v2_strings[spectre_v2_enabled],

+		       ibpb_state(),

+		       boot_cpu_has(X86_FEATURE_USE_IBRS_FW) ? ", IBRS_FW" : "",

+		       stibp_state(),

+		       boot_cpu_has(X86_FEATURE_RSB_CTXSW) ? ", RSB filling" : "",

+		       spectre_v2_module_string());

+}

+

 static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr,

 			       char *buf, unsigned int bug)

 {

@@ -1599,12 +1627,7 @@ static ssize_t cpu_show_common(struct de

 		return sprintf(buf, "%s\n", spectre_v1_strings[spectre_v1_mitigation]);

 	case X86_BUG_SPECTRE_V2:

-		return sprintf(buf, "%s%s%s%s%s%s\n", spectre_v2_strings[spectre_v2_enabled],

-			       ibpb_state(),

-			       boot_cpu_has(X86_FEATURE_USE_IBRS_FW) ? ", IBRS_FW" : "",

-			       stibp_state(),

-			       boot_cpu_has(X86_FEATURE_RSB_CTXSW) ? ", RSB filling" : "",

-			       spectre_v2_module_string());

+		return spectre_v2_show_state(buf);

 	case X86_BUG_SPEC_STORE_BYPASS:

 		return sprintf(buf, "%s\n", ssb_strings[ssb_mode]);

--- a/include/linux/bpf.h

+++ b/include/linux/bpf.h

@@ -529,6 +529,11 @@ static inline int bpf_map_attr_numa_node

 struct bpf_prog *bpf_prog_get_type_path(const char *name, enum bpf_prog_type type);

+static inline bool unprivileged_ebpf_enabled(void)

+{

+	return !sysctl_unprivileged_bpf_disabled;

+}

+

 #else /* !CONFIG_BPF_SYSCALL */

 static inline struct bpf_prog *bpf_prog_get(u32 ufd)

 {

@@ -582,6 +587,12 @@ static inline struct net_device  *__dev_

 	return NULL;

 }

+static inline bool unprivileged_ebpf_enabled(void)

+{

+	return false;

+}

+

+

 static inline void __dev_map_insert_ctx(struct bpf_map *map, u32 index)

 {

 }

--- a/kernel/sysctl.c

+++ b/kernel/sysctl.c

@@ -307,6 +307,11 @@ static int max_extfrag_threshold = 1000;

 #endif

 #if defined(CONFIG_BPF_SYSCALL) && defined(CONFIG_SYSCTL)

+

+void __weak unpriv_ebpf_notify(int new_state)

+{

+}

+

 static int bpf_unpriv_handler(struct ctl_table *table, int write,

 			      void *buffer, size_t *lenp, loff_t *ppos)

 {

@@ -324,6 +329,9 @@ static int bpf_unpriv_handler(struct ctl

 			return -EPERM;

 		*(int *)table->data = unpriv_enable;

 	}

+

+	unpriv_ebpf_notify(unpriv_enable);

+

 	return ret;

 }

 #endif /* CONFIG_BPF_SYSCALL && CONFIG_SYSCTL */