From: "Naveen N. Rao" <naveen.n.rao@linux.vnet.ibm.com>
To: Alexei Starovoitov <alexei.starovoitov@gmail.com>,
Christophe Leroy <christophe.leroy@csgroup.eu>,
Daniel Borkmann <daniel@iogearbox.net>,
Johan Almbladh <johan.almbladh@anyfinetworks.com>,
Michael Ellerman <mpe@ellerman.id.au>,
Nicholas Piggin <npiggin@gmail.com>
Cc: bpf@vger.kernel.org, linuxppc-dev@lists.ozlabs.org
Subject: Re: [PATCH 2/9] powerpc/bpf: Validate branch ranges
Date: Mon, 04 Oct 2021 23:41:13 +0530 [thread overview]
Message-ID: <1633370629.guuynxq88g.naveen@linux.ibm.com> (raw)
In-Reply-To: <213cac08-b0d2-447f-8448-ab31cc7b1d47@csgroup.eu>
Christophe Leroy wrote:
>
>
> Le 01/10/2021 à 23:14, Naveen N. Rao a écrit :
>> Add checks to ensure that we never emit branch instructions with
>> truncated branch offsets.
>>
>> Suggested-by: Michael Ellerman <mpe@ellerman.id.au>
>> Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
>> ---
>> arch/powerpc/net/bpf_jit.h | 26 ++++++++++++++++++++------
>> arch/powerpc/net/bpf_jit_comp.c | 6 +++++-
>> arch/powerpc/net/bpf_jit_comp32.c | 8 ++++++--
>> arch/powerpc/net/bpf_jit_comp64.c | 8 ++++++--
>> 4 files changed, 37 insertions(+), 11 deletions(-)
>>
>> diff --git a/arch/powerpc/net/bpf_jit.h b/arch/powerpc/net/bpf_jit.h
>> index 935ea95b66359e..7e9b978b768ed9 100644
>> --- a/arch/powerpc/net/bpf_jit.h
>> +++ b/arch/powerpc/net/bpf_jit.h
>> @@ -24,16 +24,30 @@
>> #define EMIT(instr) PLANT_INSTR(image, ctx->idx, instr)
>>
>> /* Long jump; (unconditional 'branch') */
>> -#define PPC_JMP(dest) EMIT(PPC_INST_BRANCH | \
>> - (((dest) - (ctx->idx * 4)) & 0x03fffffc))
>> +#define PPC_JMP(dest) \
>> + do { \
>> + long offset = (long)(dest) - (ctx->idx * 4); \
>> + if (!is_offset_in_branch_range(offset)) { \
>> + pr_err_ratelimited("Branch offset 0x%lx (@%u) out of range\n", offset, ctx->idx); \
>
> Does it really deserves a KERN_ERR ?
The intent is to ensure that we handle this when JIT'ing the BPF
instruction. One of the subsequent patches fixes the only scenario where
we can hit this today. In practice, we should never hit this and if we
do see this, then it is a bug with the JIT.
> Isn't that something that can trigger with a userland request ?
This can't be triggered by unprivileged BPF programs since those are
limited to 4096 BPF instructions. You need root privileges to load large
enough BPF programs that can trigger out of range branches.
- Naveen
next prev parent reply other threads:[~2021-10-04 18:11 UTC|newest]
Thread overview: 65+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-10-01 21:14 [PATCH 0/9] powerpc/bpf: Various fixes Naveen N. Rao
2021-10-01 21:14 ` Naveen N. Rao
2021-10-01 21:14 ` [PATCH 1/9] powerpc/lib: Add helper to check if offset is within conditional branch range Naveen N. Rao
2021-10-01 21:14 ` Naveen N. Rao
2021-10-01 21:37 ` Song Liu
2021-10-01 21:37 ` Song Liu
2021-10-04 18:02 ` Naveen N. Rao
2021-10-04 18:02 ` Naveen N. Rao
2021-10-03 7:50 ` Christophe Leroy
2021-10-04 18:03 ` Naveen N. Rao
2021-10-01 21:14 ` [PATCH 2/9] powerpc/bpf: Validate branch ranges Naveen N. Rao
2021-10-01 21:14 ` Naveen N. Rao
2021-10-01 21:45 ` Song Liu
2021-10-01 21:45 ` Song Liu
2021-10-02 17:29 ` Johan Almbladh
2021-10-02 17:29 ` Johan Almbladh
2021-10-03 7:54 ` Christophe Leroy
2021-10-04 18:11 ` Naveen N. Rao [this message]
2021-10-01 21:14 ` [PATCH 3/9] powerpc/bpf: Remove unused SEEN_STACK Naveen N. Rao
2021-10-01 21:14 ` Naveen N. Rao
2021-10-01 21:47 ` Song Liu
2021-10-01 21:47 ` Song Liu
2021-10-02 17:30 ` Johan Almbladh
2021-10-02 17:30 ` Johan Almbladh
2021-10-03 7:55 ` Christophe Leroy
2021-10-04 18:11 ` Naveen N. Rao
2021-10-05 5:50 ` Christophe Leroy
2021-10-05 20:22 ` Naveen N. Rao
2021-10-01 21:14 ` [PATCH 4/9] powerpc/bpf: Handle large branch ranges with BPF_EXIT Naveen N. Rao
2021-10-01 21:14 ` Naveen N. Rao
2021-10-01 21:53 ` Song Liu
2021-10-01 21:53 ` Song Liu
2021-10-02 17:31 ` Johan Almbladh
2021-10-02 17:31 ` Johan Almbladh
2021-10-03 7:59 ` Christophe Leroy
2021-10-04 18:24 ` Naveen N. Rao
2021-10-05 5:46 ` Christophe Leroy
2022-01-07 11:46 ` Naveen N. Rao
2021-10-01 21:14 ` [PATCH 5/9] powerpc/bpf: Fix BPF_MOD when imm == 1 Naveen N. Rao
2021-10-01 21:14 ` Naveen N. Rao
2021-10-01 21:55 ` Song Liu
2021-10-01 21:55 ` Song Liu
2021-10-02 17:32 ` Johan Almbladh
2021-10-02 17:32 ` Johan Almbladh
2021-10-01 21:14 ` [PATCH 6/9] powerpc/bpf: Fix BPF_SUB when imm == 0x80000000 Naveen N. Rao
2021-10-01 21:14 ` Naveen N. Rao
2021-10-01 22:01 ` Song Liu
2021-10-01 22:01 ` Song Liu
2021-10-02 17:33 ` Johan Almbladh
2021-10-02 17:33 ` Johan Almbladh
2021-10-03 8:07 ` Christophe Leroy
2021-10-04 18:18 ` Naveen N. Rao
2021-10-05 5:40 ` Christophe Leroy
2021-10-01 21:14 ` [PATCH 7/9] powerpc/bpf: Limit 'ldbrx' to processors compliant with ISA v2.06 Naveen N. Rao
2021-10-01 21:14 ` Naveen N. Rao
2021-10-02 17:35 ` Johan Almbladh
2021-10-02 17:35 ` Johan Almbladh
2021-10-01 21:14 ` [PATCH 8/9] powerpc/security: Add a helper to query stf_barrier type Naveen N. Rao
2021-10-01 21:14 ` Naveen N. Rao
2021-10-01 21:14 ` [PATCH 9/9] powerpc/bpf: Emit stf barrier instruction sequences for BPF_NOSPEC Naveen N. Rao
2021-10-01 21:14 ` Naveen N. Rao
2021-10-02 17:41 ` [PATCH 0/9] powerpc/bpf: Various fixes Johan Almbladh
2021-10-02 17:41 ` Johan Almbladh
2021-10-04 18:19 ` Naveen N. Rao
2021-10-04 18:19 ` Naveen N. Rao
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1633370629.guuynxq88g.naveen@linux.ibm.com \
--to=naveen.n.rao@linux.vnet.ibm.com \
--cc=alexei.starovoitov@gmail.com \
--cc=bpf@vger.kernel.org \
--cc=christophe.leroy@csgroup.eu \
--cc=daniel@iogearbox.net \
--cc=johan.almbladh@anyfinetworks.com \
--cc=linuxppc-dev@lists.ozlabs.org \
--cc=mpe@ellerman.id.au \
--cc=npiggin@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.