bpf.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH bpf-next v2] bpf: Detect jumping to reserved code during check_cfg()
@ 2023-10-10 12:03 Hao Sun
  2023-10-10 14:46 ` Eduard Zingerman
  0 siblings, 1 reply; 3+ messages in thread
From: Hao Sun @ 2023-10-10 12:03 UTC (permalink / raw)
  To: Alexei Starovoitov, Daniel Borkmann, John Fastabend,
	Andrii Nakryiko, Martin KaFai Lau, Song Liu, Yonghong Song,
	KP Singh, Stanislav Fomichev, Hao Luo, Jiri Olsa
  Cc: bpf, linux-kernel, Hao Sun

Currently, we don't check if the branch-taken of a jump is reserved code of
ld_imm64. Instead, such a issue is captured in check_ld_imm(). The verifier
gives the following log in such case:

func#0 @0
0: R1=ctx(off=0,imm=0) R10=fp0
0: (18) r4 = 0xffff888103436000       ; R4_w=map_ptr(off=0,ks=4,vs=128,imm=0)
2: (18) r1 = 0x1d                     ; R1_w=29
4: (55) if r4 != 0x0 goto pc+4        ; R4_w=map_ptr(off=0,ks=4,vs=128,imm=0)
5: (1c) w1 -= w1                      ; R1_w=0
6: (18) r5 = 0x32                     ; R5_w=50
8: (56) if w5 != 0xfffffff4 goto pc-2
mark_precise: frame0: last_idx 8 first_idx 0 subseq_idx -1
mark_precise: frame0: regs=r5 stack= before 6: (18) r5 = 0x32
7: R5_w=50
7: BUG_ld_00
invalid BPF_LD_IMM insn

Here the verifier rejects the program because it thinks insn at 7 is an
invalid BPF_LD_IMM, but such a error log is not accurate since the issue
is jumping to reserved code not because the program contains invalid insn.
Therefore, make the verifier check the jump target during check_cfg(). For
the same program, the verifier reports the following log:

func#0 @0
jump to reserved code from insn 8 to 7

Also adjust existing tests in ld_imm64.c, testing forward/back jump to
reserved code.

Signed-off-by: Hao Sun <sunhao.th@gmail.com>
---
Changes in v2:
- Adjust existing test cases
- Link to v1: https://lore.kernel.org/bpf/20231009-jmp-into-reserved-fields-v1-1-d8006e2ac1f6@gmail.com/
---
 kernel/bpf/verifier.c                           | 7 +++++++
 tools/testing/selftests/bpf/verifier/ld_imm64.c | 8 +++-----
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index eed7350e15f4..725ac0b464cf 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -14980,6 +14980,7 @@ static int push_insn(int t, int w, int e, struct bpf_verifier_env *env,
 {
 	int *insn_stack = env->cfg.insn_stack;
 	int *insn_state = env->cfg.insn_state;
+	struct bpf_insn *insns = env->prog->insnsi;
 
 	if (e == FALLTHROUGH && insn_state[t] >= (DISCOVERED | FALLTHROUGH))
 		return DONE_EXPLORING;
@@ -14993,6 +14994,12 @@ static int push_insn(int t, int w, int e, struct bpf_verifier_env *env,
 		return -EINVAL;
 	}
 
+	if (e == BRANCH && insns[w].code == 0) {
+		verbose_linfo(env, t, "%d", t);
+		verbose(env, "jump to reserved code from insn %d to %d\n", t, w);
+		return -EINVAL;
+	}
+
 	if (e == BRANCH) {
 		/* mark branch target for state pruning */
 		mark_prune_point(env, w);
diff --git a/tools/testing/selftests/bpf/verifier/ld_imm64.c b/tools/testing/selftests/bpf/verifier/ld_imm64.c
index f9297900cea6..c34aa78f1877 100644
--- a/tools/testing/selftests/bpf/verifier/ld_imm64.c
+++ b/tools/testing/selftests/bpf/verifier/ld_imm64.c
@@ -9,22 +9,20 @@
 	BPF_MOV64_IMM(BPF_REG_0, 2),
 	BPF_EXIT_INSN(),
 	},
-	.errstr = "invalid BPF_LD_IMM insn",
-	.errstr_unpriv = "R1 pointer comparison",
+	.errstr = "jump to reserved code",
 	.result = REJECT,
 },
 {
 	"test2 ld_imm64",
 	.insns = {
-	BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
 	BPF_LD_IMM64(BPF_REG_0, 0),
+	BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, -2),
 	BPF_LD_IMM64(BPF_REG_0, 0),
 	BPF_LD_IMM64(BPF_REG_0, 1),
 	BPF_LD_IMM64(BPF_REG_0, 1),
 	BPF_EXIT_INSN(),
 	},
-	.errstr = "invalid BPF_LD_IMM insn",
-	.errstr_unpriv = "R1 pointer comparison",
+	.errstr = "jump to reserved code",
 	.result = REJECT,
 },
 {

---
base-commit: 3157b7ce14bbf468b0ca8613322a05c37b5ae25d
change-id: 20231009-jmp-into-reserved-fields-fc1a98a8e7dc

Best regards,
-- 
Hao Sun <sunhao.th@gmail.com>


^ permalink raw reply related	[flat|nested] 3+ messages in thread
* Re: [PATCH bpf-next v2] bpf: Detect jumping to reserved code during check_cfg()
  2023-10-10 12:03 [PATCH bpf-next v2] bpf: Detect jumping to reserved code during check_cfg() Hao Sun
@ 2023-10-10 14:46 ` Eduard Zingerman
  2023-10-10 15:27   ` Daniel Borkmann
  0 siblings, 1 reply; 3+ messages in thread
From: Eduard Zingerman @ 2023-10-10 14:46 UTC (permalink / raw)
  To: Hao Sun, Alexei Starovoitov, Daniel Borkmann, John Fastabend,
	Andrii Nakryiko, Martin KaFai Lau, Song Liu, Yonghong Song,
	KP Singh, Stanislav Fomichev, Hao Luo, Jiri Olsa
  Cc: bpf, linux-kernel

On Tue, 2023-10-10 at 14:03 +0200, Hao Sun wrote:
> Currently, we don't check if the branch-taken of a jump is reserved code of
> ld_imm64. Instead, such a issue is captured in check_ld_imm(). The verifier
> gives the following log in such case:
> 
> func#0 @0
> 0: R1=ctx(off=0,imm=0) R10=fp0
> 0: (18) r4 = 0xffff888103436000       ; R4_w=map_ptr(off=0,ks=4,vs=128,imm=0)
> 2: (18) r1 = 0x1d                     ; R1_w=29
> 4: (55) if r4 != 0x0 goto pc+4        ; R4_w=map_ptr(off=0,ks=4,vs=128,imm=0)
> 5: (1c) w1 -= w1                      ; R1_w=0
> 6: (18) r5 = 0x32                     ; R5_w=50
> 8: (56) if w5 != 0xfffffff4 goto pc-2
> mark_precise: frame0: last_idx 8 first_idx 0 subseq_idx -1
> mark_precise: frame0: regs=r5 stack= before 6: (18) r5 = 0x32
> 7: R5_w=50
> 7: BUG_ld_00
> invalid BPF_LD_IMM insn
> 
> Here the verifier rejects the program because it thinks insn at 7 is an
> invalid BPF_LD_IMM, but such a error log is not accurate since the issue
> is jumping to reserved code not because the program contains invalid insn.
> Therefore, make the verifier check the jump target during check_cfg(). For
> the same program, the verifier reports the following log:
> 
> func#0 @0
> jump to reserved code from insn 8 to 7
> 
> Also adjust existing tests in ld_imm64.c, testing forward/back jump to
> reserved code.
> 
> Signed-off-by: Hao Sun <sunhao.th@gmail.com>

Please see a nitpick below.

Acked-by: Eduard Zingerman <eddyz87@gmail.com>

> ---
> Changes in v2:
> - Adjust existing test cases
> - Link to v1: https://lore.kernel.org/bpf/20231009-jmp-into-reserved-fields-v1-1-d8006e2ac1f6@gmail.com/
> ---
>  kernel/bpf/verifier.c                           | 7 +++++++
>  tools/testing/selftests/bpf/verifier/ld_imm64.c | 8 +++-----
>  2 files changed, 10 insertions(+), 5 deletions(-)
> 
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index eed7350e15f4..725ac0b464cf 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -14980,6 +14980,7 @@ static int push_insn(int t, int w, int e, struct bpf_verifier_env *env,
>  {
>  	int *insn_stack = env->cfg.insn_stack;
>  	int *insn_state = env->cfg.insn_state;
> +	struct bpf_insn *insns = env->prog->insnsi;
>  
>  	if (e == FALLTHROUGH && insn_state[t] >= (DISCOVERED | FALLTHROUGH))
>  		return DONE_EXPLORING;
> @@ -14993,6 +14994,12 @@ static int push_insn(int t, int w, int e, struct bpf_verifier_env *env,
>  		return -EINVAL;
>  	}
>  
> +	if (e == BRANCH && insns[w].code == 0) {
> +		verbose_linfo(env, t, "%d", t);
> +		verbose(env, "jump to reserved code from insn %d to %d\n", t, w);
> +		return -EINVAL;
> +	}
> +
>  	if (e == BRANCH) {
>  		/* mark branch target for state pruning */
>  		mark_prune_point(env, w);
> diff --git a/tools/testing/selftests/bpf/verifier/ld_imm64.c b/tools/testing/selftests/bpf/verifier/ld_imm64.c
> index f9297900cea6..c34aa78f1877 100644
> --- a/tools/testing/selftests/bpf/verifier/ld_imm64.c
> +++ b/tools/testing/selftests/bpf/verifier/ld_imm64.c
> @@ -9,22 +9,20 @@
>  	BPF_MOV64_IMM(BPF_REG_0, 2),
>  	BPF_EXIT_INSN(),
>  	},
> -	.errstr = "invalid BPF_LD_IMM insn",
> -	.errstr_unpriv = "R1 pointer comparison",
> +	.errstr = "jump to reserved code",
>  	.result = REJECT,
>  },
>  {
>  	"test2 ld_imm64",
>  	.insns = {
> -	BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
>  	BPF_LD_IMM64(BPF_REG_0, 0),
> +	BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, -2),

This change is not really necessary, the test reports same error
either way.

>  	BPF_LD_IMM64(BPF_REG_0, 0),
>  	BPF_LD_IMM64(BPF_REG_0, 1),
>  	BPF_LD_IMM64(BPF_REG_0, 1),
>  	BPF_EXIT_INSN(),
>  	},
> -	.errstr = "invalid BPF_LD_IMM insn",
> -	.errstr_unpriv = "R1 pointer comparison",
> +	.errstr = "jump to reserved code",
>  	.result = REJECT,
>  },
>  {
> 
> ---
> base-commit: 3157b7ce14bbf468b0ca8613322a05c37b5ae25d
> change-id: 20231009-jmp-into-reserved-fields-fc1a98a8e7dc
> 
> Best regards,


^ permalink raw reply	[flat|nested] 3+ messages in thread
* Re: [PATCH bpf-next v2] bpf: Detect jumping to reserved code during check_cfg()
  2023-10-10 14:46 ` Eduard Zingerman
@ 2023-10-10 15:27   ` Daniel Borkmann
  0 siblings, 0 replies; 3+ messages in thread
From: Daniel Borkmann @ 2023-10-10 15:27 UTC (permalink / raw)
  To: Eduard Zingerman, Hao Sun, Alexei Starovoitov, John Fastabend,
	Andrii Nakryiko, Martin KaFai Lau, Song Liu, Yonghong Song,
	KP Singh, Stanislav Fomichev, Hao Luo, Jiri Olsa
  Cc: bpf, linux-kernel

On 10/10/23 4:46 PM, Eduard Zingerman wrote:
> On Tue, 2023-10-10 at 14:03 +0200, Hao Sun wrote:
>> Currently, we don't check if the branch-taken of a jump is reserved code of
>> ld_imm64. Instead, such a issue is captured in check_ld_imm(). The verifier
>> gives the following log in such case:
>>
>> func#0 @0
>> 0: R1=ctx(off=0,imm=0) R10=fp0
>> 0: (18) r4 = 0xffff888103436000       ; R4_w=map_ptr(off=0,ks=4,vs=128,imm=0)
>> 2: (18) r1 = 0x1d                     ; R1_w=29
>> 4: (55) if r4 != 0x0 goto pc+4        ; R4_w=map_ptr(off=0,ks=4,vs=128,imm=0)
>> 5: (1c) w1 -= w1                      ; R1_w=0
>> 6: (18) r5 = 0x32                     ; R5_w=50
>> 8: (56) if w5 != 0xfffffff4 goto pc-2
>> mark_precise: frame0: last_idx 8 first_idx 0 subseq_idx -1
>> mark_precise: frame0: regs=r5 stack= before 6: (18) r5 = 0x32
>> 7: R5_w=50
>> 7: BUG_ld_00
>> invalid BPF_LD_IMM insn
>>
>> Here the verifier rejects the program because it thinks insn at 7 is an
>> invalid BPF_LD_IMM, but such a error log is not accurate since the issue
>> is jumping to reserved code not because the program contains invalid insn.
>> Therefore, make the verifier check the jump target during check_cfg(). For
>> the same program, the verifier reports the following log:
>>
>> func#0 @0
>> jump to reserved code from insn 8 to 7
>>
>> Also adjust existing tests in ld_imm64.c, testing forward/back jump to
>> reserved code.
>>
>> Signed-off-by: Hao Sun <sunhao.th@gmail.com>
> 
> Please see a nitpick below.
> 
> Acked-by: Eduard Zingerman <eddyz87@gmail.com>
> 
>> ---
>> Changes in v2:
>> - Adjust existing test cases
>> - Link to v1: https://lore.kernel.org/bpf/20231009-jmp-into-reserved-fields-v1-1-d8006e2ac1f6@gmail.com/
>> ---
>>   kernel/bpf/verifier.c                           | 7 +++++++
>>   tools/testing/selftests/bpf/verifier/ld_imm64.c | 8 +++-----
>>   2 files changed, 10 insertions(+), 5 deletions(-)
>>
>> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
>> index eed7350e15f4..725ac0b464cf 100644
>> --- a/kernel/bpf/verifier.c
>> +++ b/kernel/bpf/verifier.c
>> @@ -14980,6 +14980,7 @@ static int push_insn(int t, int w, int e, struct bpf_verifier_env *env,
>>   {
>>   	int *insn_stack = env->cfg.insn_stack;
>>   	int *insn_state = env->cfg.insn_state;
>> +	struct bpf_insn *insns = env->prog->insnsi;
>>   
>>   	if (e == FALLTHROUGH && insn_state[t] >= (DISCOVERED | FALLTHROUGH))
>>   		return DONE_EXPLORING;
>> @@ -14993,6 +14994,12 @@ static int push_insn(int t, int w, int e, struct bpf_verifier_env *env,
>>   		return -EINVAL;
>>   	}
>>   
>> +	if (e == BRANCH && insns[w].code == 0) {
>> +		verbose_linfo(env, t, "%d", t);
>> +		verbose(env, "jump to reserved code from insn %d to %d\n", t, w);
>> +		return -EINVAL;
>> +	}
>> +
>>   	if (e == BRANCH) {
>>   		/* mark branch target for state pruning */
>>   		mark_prune_point(env, w);
>> diff --git a/tools/testing/selftests/bpf/verifier/ld_imm64.c b/tools/testing/selftests/bpf/verifier/ld_imm64.c
>> index f9297900cea6..c34aa78f1877 100644
>> --- a/tools/testing/selftests/bpf/verifier/ld_imm64.c
>> +++ b/tools/testing/selftests/bpf/verifier/ld_imm64.c
>> @@ -9,22 +9,20 @@
>>   	BPF_MOV64_IMM(BPF_REG_0, 2),
>>   	BPF_EXIT_INSN(),
>>   	},
>> -	.errstr = "invalid BPF_LD_IMM insn",
>> -	.errstr_unpriv = "R1 pointer comparison",
>> +	.errstr = "jump to reserved code",
>>   	.result = REJECT,
>>   },
>>   {
>>   	"test2 ld_imm64",
>>   	.insns = {
>> -	BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
>>   	BPF_LD_IMM64(BPF_REG_0, 0),
>> +	BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, -2),
> 
> This change is not really necessary, the test reports same error
> either way.

If we don't have a backward jump covered, we could probably also make this
a new test case rather than modifying an existing one. Aside from that it
would probably also make sense to make this a separate commit, so it eases
backporting a bit.

>>   	BPF_LD_IMM64(BPF_REG_0, 0),
>>   	BPF_LD_IMM64(BPF_REG_0, 1),
>>   	BPF_LD_IMM64(BPF_REG_0, 1),
>>   	BPF_EXIT_INSN(),
>>   	},
>> -	.errstr = "invalid BPF_LD_IMM insn",
>> -	.errstr_unpriv = "R1 pointer comparison",
>> +	.errstr = "jump to reserved code",
>>   	.result = REJECT,
>>   },
>>   {
>>
>> ---
>> base-commit: 3157b7ce14bbf468b0ca8613322a05c37b5ae25d
>> change-id: 20231009-jmp-into-reserved-fields-fc1a98a8e7dc
>>
>> Best regards,
> 


^ permalink raw reply	[flat|nested] 3+ messages in thread
end of thread, other threads:[~2023-10-10 15:27 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-10-10 12:03 [PATCH bpf-next v2] bpf: Detect jumping to reserved code during check_cfg() Hao Sun
2023-10-10 14:46 ` Eduard Zingerman
2023-10-10 15:27   ` Daniel Borkmann

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).