From: Daniel Borkmann <daniel@iogearbox.net>
To: Eduard Zingerman <eddyz87@gmail.com>,
Hao Sun <sunhao.th@gmail.com>,
Alexei Starovoitov <ast@kernel.org>,
John Fastabend <john.fastabend@gmail.com>,
Andrii Nakryiko <andrii@kernel.org>,
Martin KaFai Lau <martin.lau@linux.dev>,
Song Liu <song@kernel.org>,
Yonghong Song <yonghong.song@linux.dev>,
KP Singh <kpsingh@kernel.org>,
Stanislav Fomichev <sdf@google.com>, Hao Luo <haoluo@google.com>,
Jiri Olsa <jolsa@kernel.org>
Cc: bpf@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH bpf-next v2] bpf: Detect jumping to reserved code during check_cfg()
Date: Tue, 10 Oct 2023 17:27:05 +0200 [thread overview]
Message-ID: <edec9c1b-b181-d9b9-02b5-1f2ee4050022@iogearbox.net> (raw)
In-Reply-To: <a2a875ca30b2629afe6f9804eb43572ac81dcf42.camel@gmail.com>
On 10/10/23 4:46 PM, Eduard Zingerman wrote:
> On Tue, 2023-10-10 at 14:03 +0200, Hao Sun wrote:
>> Currently, we don't check if the branch-taken of a jump is reserved code of
>> ld_imm64. Instead, such a issue is captured in check_ld_imm(). The verifier
>> gives the following log in such case:
>>
>> func#0 @0
>> 0: R1=ctx(off=0,imm=0) R10=fp0
>> 0: (18) r4 = 0xffff888103436000 ; R4_w=map_ptr(off=0,ks=4,vs=128,imm=0)
>> 2: (18) r1 = 0x1d ; R1_w=29
>> 4: (55) if r4 != 0x0 goto pc+4 ; R4_w=map_ptr(off=0,ks=4,vs=128,imm=0)
>> 5: (1c) w1 -= w1 ; R1_w=0
>> 6: (18) r5 = 0x32 ; R5_w=50
>> 8: (56) if w5 != 0xfffffff4 goto pc-2
>> mark_precise: frame0: last_idx 8 first_idx 0 subseq_idx -1
>> mark_precise: frame0: regs=r5 stack= before 6: (18) r5 = 0x32
>> 7: R5_w=50
>> 7: BUG_ld_00
>> invalid BPF_LD_IMM insn
>>
>> Here the verifier rejects the program because it thinks insn at 7 is an
>> invalid BPF_LD_IMM, but such a error log is not accurate since the issue
>> is jumping to reserved code not because the program contains invalid insn.
>> Therefore, make the verifier check the jump target during check_cfg(). For
>> the same program, the verifier reports the following log:
>>
>> func#0 @0
>> jump to reserved code from insn 8 to 7
>>
>> Also adjust existing tests in ld_imm64.c, testing forward/back jump to
>> reserved code.
>>
>> Signed-off-by: Hao Sun <sunhao.th@gmail.com>
>
> Please see a nitpick below.
>
> Acked-by: Eduard Zingerman <eddyz87@gmail.com>
>
>> ---
>> Changes in v2:
>> - Adjust existing test cases
>> - Link to v1: https://lore.kernel.org/bpf/20231009-jmp-into-reserved-fields-v1-1-d8006e2ac1f6@gmail.com/
>> ---
>> kernel/bpf/verifier.c | 7 +++++++
>> tools/testing/selftests/bpf/verifier/ld_imm64.c | 8 +++-----
>> 2 files changed, 10 insertions(+), 5 deletions(-)
>>
>> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
>> index eed7350e15f4..725ac0b464cf 100644
>> --- a/kernel/bpf/verifier.c
>> +++ b/kernel/bpf/verifier.c
>> @@ -14980,6 +14980,7 @@ static int push_insn(int t, int w, int e, struct bpf_verifier_env *env,
>> {
>> int *insn_stack = env->cfg.insn_stack;
>> int *insn_state = env->cfg.insn_state;
>> + struct bpf_insn *insns = env->prog->insnsi;
>>
>> if (e == FALLTHROUGH && insn_state[t] >= (DISCOVERED | FALLTHROUGH))
>> return DONE_EXPLORING;
>> @@ -14993,6 +14994,12 @@ static int push_insn(int t, int w, int e, struct bpf_verifier_env *env,
>> return -EINVAL;
>> }
>>
>> + if (e == BRANCH && insns[w].code == 0) {
>> + verbose_linfo(env, t, "%d", t);
>> + verbose(env, "jump to reserved code from insn %d to %d\n", t, w);
>> + return -EINVAL;
>> + }
>> +
>> if (e == BRANCH) {
>> /* mark branch target for state pruning */
>> mark_prune_point(env, w);
>> diff --git a/tools/testing/selftests/bpf/verifier/ld_imm64.c b/tools/testing/selftests/bpf/verifier/ld_imm64.c
>> index f9297900cea6..c34aa78f1877 100644
>> --- a/tools/testing/selftests/bpf/verifier/ld_imm64.c
>> +++ b/tools/testing/selftests/bpf/verifier/ld_imm64.c
>> @@ -9,22 +9,20 @@
>> BPF_MOV64_IMM(BPF_REG_0, 2),
>> BPF_EXIT_INSN(),
>> },
>> - .errstr = "invalid BPF_LD_IMM insn",
>> - .errstr_unpriv = "R1 pointer comparison",
>> + .errstr = "jump to reserved code",
>> .result = REJECT,
>> },
>> {
>> "test2 ld_imm64",
>> .insns = {
>> - BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
>> BPF_LD_IMM64(BPF_REG_0, 0),
>> + BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, -2),
>
> This change is not really necessary, the test reports same error
> either way.
If we don't have a backward jump covered, we could probably also make this
a new test case rather than modifying an existing one. Aside from that it
would probably also make sense to make this a separate commit, so it eases
backporting a bit.
>> BPF_LD_IMM64(BPF_REG_0, 0),
>> BPF_LD_IMM64(BPF_REG_0, 1),
>> BPF_LD_IMM64(BPF_REG_0, 1),
>> BPF_EXIT_INSN(),
>> },
>> - .errstr = "invalid BPF_LD_IMM insn",
>> - .errstr_unpriv = "R1 pointer comparison",
>> + .errstr = "jump to reserved code",
>> .result = REJECT,
>> },
>> {
>>
>> ---
>> base-commit: 3157b7ce14bbf468b0ca8613322a05c37b5ae25d
>> change-id: 20231009-jmp-into-reserved-fields-fc1a98a8e7dc
>>
>> Best regards,
>
prev parent reply other threads:[~2023-10-10 15:27 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-10-10 12:03 [PATCH bpf-next v2] bpf: Detect jumping to reserved code during check_cfg() Hao Sun
2023-10-10 14:46 ` Eduard Zingerman
2023-10-10 15:27 ` Daniel Borkmann [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=edec9c1b-b181-d9b9-02b5-1f2ee4050022@iogearbox.net \
--to=daniel@iogearbox.net \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=eddyz87@gmail.com \
--cc=haoluo@google.com \
--cc=john.fastabend@gmail.com \
--cc=jolsa@kernel.org \
--cc=kpsingh@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=martin.lau@linux.dev \
--cc=sdf@google.com \
--cc=song@kernel.org \
--cc=sunhao.th@gmail.com \
--cc=yonghong.song@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).