* [PATCH bpf-next 1/2] selftests/bpf: Add reproducer for decl_tag in func_proto return type
@ 2022-10-15 0:24 Stanislav Fomichev
2022-10-15 0:24 ` [PATCH bpf-next 2/2] bpf: prevent decl_tag from being referenced in func_proto Stanislav Fomichev
` (2 more replies)
0 siblings, 3 replies; 6+ messages in thread
From: Stanislav Fomichev @ 2022-10-15 0:24 UTC (permalink / raw)
To: bpf
Cc: ast, daniel, andrii, martin.lau, song, yhs, john.fastabend,
kpsingh, sdf, haoluo, jolsa, Martin KaFai Lau
It should trigger a WARN_ON_ONCE in btf_type_id_size.
btf_func_proto_check kernel/bpf/btf.c:4447 [inline]
btf_check_all_types kernel/bpf/btf.c:4723 [inline]
btf_parse_type_sec kernel/bpf/btf.c:4752 [inline]
btf_parse kernel/bpf/btf.c:5026 [inline]
btf_new_fd+0x1926/0x1e70 kernel/bpf/btf.c:6892
bpf_btf_load kernel/bpf/syscall.c:4324 [inline]
__sys_bpf+0xb7d/0x4cf0 kernel/bpf/syscall.c:5010
__do_sys_bpf kernel/bpf/syscall.c:5069 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5067 [inline]
__x64_sys_bpf+0x75/0xb0 kernel/bpf/syscall.c:5067
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Cc: Yonghong Song <yhs@fb.com>
Cc: Martin KaFai Lau <martin.lau@kernel.org>
Signed-off-by: Stanislav Fomichev <sdf@google.com>
---
tools/testing/selftests/bpf/prog_tests/btf.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/tools/testing/selftests/bpf/prog_tests/btf.c b/tools/testing/selftests/bpf/prog_tests/btf.c
index 127b8caa3dc1..24dd6214394e 100644
--- a/tools/testing/selftests/bpf/prog_tests/btf.c
+++ b/tools/testing/selftests/bpf/prog_tests/btf.c
@@ -3935,6 +3935,19 @@ static struct btf_raw_test raw_tests[] = {
.btf_load_err = true,
.err_str = "Invalid type_id",
},
+{
+ .descr = "decl_tag test #16, func proto, return type",
+ .raw_types = {
+ BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4), /* [1] */
+ BTF_VAR_ENC(NAME_TBD, 1, 0), /* [2] */
+ BTF_TYPE_ENC(NAME_TBD, BTF_INFO_ENC(BTF_KIND_DECL_TAG, 0, 0), 2), (-1), /* [3] */
+ BTF_FUNC_PROTO_ENC(3, 0), /* [4] */
+ BTF_END_RAW,
+ },
+ BTF_STR_SEC("\0local\0tag1"),
+ .btf_load_err = true,
+ .err_str = "Invalid return type",
+},
{
.descr = "type_tag test #1",
.raw_types = {
--
2.38.0.413.g74048e4d9e-goog
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH bpf-next 2/2] bpf: prevent decl_tag from being referenced in func_proto
2022-10-15 0:24 [PATCH bpf-next 1/2] selftests/bpf: Add reproducer for decl_tag in func_proto return type Stanislav Fomichev
@ 2022-10-15 0:24 ` Stanislav Fomichev
2022-10-17 5:33 ` Yonghong Song
2022-10-17 18:32 ` Martin KaFai Lau
2022-10-17 5:33 ` [PATCH bpf-next 1/2] selftests/bpf: Add reproducer for decl_tag in func_proto return type Yonghong Song
2022-10-17 18:30 ` patchwork-bot+netdevbpf
2 siblings, 2 replies; 6+ messages in thread
From: Stanislav Fomichev @ 2022-10-15 0:24 UTC (permalink / raw)
To: bpf
Cc: ast, daniel, andrii, martin.lau, song, yhs, john.fastabend,
kpsingh, sdf, haoluo, jolsa, Martin KaFai Lau,
syzbot+d8bd751aef7c6b39a344
Syzkaller was able to hit the following issue:
------------[ cut here ]------------
WARNING: CPU: 0 PID: 3609 at kernel/bpf/btf.c:1946
btf_type_id_size+0x2d5/0x9d0 kernel/bpf/btf.c:1946
Modules linked in:
CPU: 0 PID: 3609 Comm: syz-executor361 Not tainted
6.0.0-syzkaller-02734-g0326074ff465 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 09/22/2022
RIP: 0010:btf_type_id_size+0x2d5/0x9d0 kernel/bpf/btf.c:1946
Code: ef e8 7f 8e e4 ff 41 83 ff 0b 77 28 f6 44 24 10 18 75 3f e8 6d 91
e4 ff 44 89 fe bf 0e 00 00 00 e8 20 8e e4 ff e8 5b 91 e4 ff <0f> 0b 45
31 f6 e9 98 02 00 00 41 83 ff 12 74 18 e8 46 91 e4 ff 44
RSP: 0018:ffffc90003cefb40 EFLAGS: 00010293
RAX: 0000000000000000 RBX: 0000000000000002 RCX: 0000000000000000
RDX: ffff8880259c0000 RSI: ffffffff81968415 RDI: 0000000000000005
RBP: ffff88801270ca00 R08: 0000000000000005 R09: 000000000000000e
R10: 0000000000000011 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000011 R14: ffff888026ee6424 R15: 0000000000000011
FS: 000055555641b300(0000) GS:ffff8880b9a00000(0000)
knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000f2e258 CR3: 000000007110e000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
btf_func_proto_check kernel/bpf/btf.c:4447 [inline]
btf_check_all_types kernel/bpf/btf.c:4723 [inline]
btf_parse_type_sec kernel/bpf/btf.c:4752 [inline]
btf_parse kernel/bpf/btf.c:5026 [inline]
btf_new_fd+0x1926/0x1e70 kernel/bpf/btf.c:6892
bpf_btf_load kernel/bpf/syscall.c:4324 [inline]
__sys_bpf+0xb7d/0x4cf0 kernel/bpf/syscall.c:5010
__do_sys_bpf kernel/bpf/syscall.c:5069 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5067 [inline]
__x64_sys_bpf+0x75/0xb0 kernel/bpf/syscall.c:5067
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f0fbae41c69
Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89
f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01
f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc8aeb6228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f0fbae41c69
RDX: 0000000000000020 RSI: 0000000020000140 RDI: 0000000000000012
RBP: 00007f0fbae05e10 R08: 0000000000000000 R09: 0000000000000000
R10: 00000000ffffffff R11: 0000000000000246 R12: 00007f0fbae05ea0
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
</TASK>
Looks like it tries to create a func_proto which return type is
decl_tag. For the details, see Martin's spot on analysis in [0].
0: https://lore.kernel.org/bpf/CAKH8qBuQDLva_hHxxBuZzyAcYNO4ejhovz6TQeVSk8HY-2SO6g@mail.gmail.com/T/#mea6524b3fcd6298347432226e81b1e6155efc62c
Cc: Yonghong Song <yhs@fb.com>
Cc: Martin KaFai Lau <martin.lau@kernel.org>
Fixes: bd16dee66ae4 ("bpf: Add BTF_KIND_DECL_TAG typedef support")
Reported-by: syzbot+d8bd751aef7c6b39a344@syzkaller.appspotmail.com
Signed-off-by: Stanislav Fomichev <sdf@google.com>
---
kernel/bpf/btf.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
index eba603cec2c5..35c07afac924 100644
--- a/kernel/bpf/btf.c
+++ b/kernel/bpf/btf.c
@@ -4436,6 +4436,11 @@ static int btf_func_proto_check(struct btf_verifier_env *env,
return -EINVAL;
}
+ if (btf_type_is_resolve_source_only(ret_type)) {
+ btf_verifier_log_type(env, t, "Invalid return type");
+ return -EINVAL;
+ }
+
if (btf_type_needs_resolve(ret_type) &&
!env_type_is_resolved(env, ret_type_id)) {
err = btf_resolve(env, ret_type, ret_type_id);
--
2.38.0.413.g74048e4d9e-goog
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH bpf-next 1/2] selftests/bpf: Add reproducer for decl_tag in func_proto return type
2022-10-15 0:24 [PATCH bpf-next 1/2] selftests/bpf: Add reproducer for decl_tag in func_proto return type Stanislav Fomichev
2022-10-15 0:24 ` [PATCH bpf-next 2/2] bpf: prevent decl_tag from being referenced in func_proto Stanislav Fomichev
@ 2022-10-17 5:33 ` Yonghong Song
2022-10-17 18:30 ` patchwork-bot+netdevbpf
2 siblings, 0 replies; 6+ messages in thread
From: Yonghong Song @ 2022-10-17 5:33 UTC (permalink / raw)
To: Stanislav Fomichev, bpf
Cc: ast, daniel, andrii, martin.lau, song, yhs, john.fastabend,
kpsingh, haoluo, jolsa, Martin KaFai Lau
On 10/14/22 5:24 PM, Stanislav Fomichev wrote:
> It should trigger a WARN_ON_ONCE in btf_type_id_size.
>
> btf_func_proto_check kernel/bpf/btf.c:4447 [inline]
> btf_check_all_types kernel/bpf/btf.c:4723 [inline]
> btf_parse_type_sec kernel/bpf/btf.c:4752 [inline]
> btf_parse kernel/bpf/btf.c:5026 [inline]
> btf_new_fd+0x1926/0x1e70 kernel/bpf/btf.c:6892
> bpf_btf_load kernel/bpf/syscall.c:4324 [inline]
> __sys_bpf+0xb7d/0x4cf0 kernel/bpf/syscall.c:5010
> __do_sys_bpf kernel/bpf/syscall.c:5069 [inline]
> __se_sys_bpf kernel/bpf/syscall.c:5067 [inline]
> __x64_sys_bpf+0x75/0xb0 kernel/bpf/syscall.c:5067
> do_syscall_x64 arch/x86/entry/common.c:50 [inline]
> do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
> entry_SYSCALL_64_after_hwframe+0x63/0xcd
>
> Cc: Yonghong Song <yhs@fb.com>
> Cc: Martin KaFai Lau <martin.lau@kernel.org>
> Signed-off-by: Stanislav Fomichev <sdf@google.com>
Acked-by: Yonghong Song <yhs@fb.com>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH bpf-next 2/2] bpf: prevent decl_tag from being referenced in func_proto
2022-10-15 0:24 ` [PATCH bpf-next 2/2] bpf: prevent decl_tag from being referenced in func_proto Stanislav Fomichev
@ 2022-10-17 5:33 ` Yonghong Song
2022-10-17 18:32 ` Martin KaFai Lau
1 sibling, 0 replies; 6+ messages in thread
From: Yonghong Song @ 2022-10-17 5:33 UTC (permalink / raw)
To: Stanislav Fomichev, bpf
Cc: ast, daniel, andrii, martin.lau, song, yhs, john.fastabend,
kpsingh, haoluo, jolsa, Martin KaFai Lau,
syzbot+d8bd751aef7c6b39a344
On 10/14/22 5:24 PM, Stanislav Fomichev wrote:
> Syzkaller was able to hit the following issue:
>
> ------------[ cut here ]------------
> WARNING: CPU: 0 PID: 3609 at kernel/bpf/btf.c:1946
> btf_type_id_size+0x2d5/0x9d0 kernel/bpf/btf.c:1946
> Modules linked in:
> CPU: 0 PID: 3609 Comm: syz-executor361 Not tainted
> 6.0.0-syzkaller-02734-g0326074ff465 #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
> Google 09/22/2022
> RIP: 0010:btf_type_id_size+0x2d5/0x9d0 kernel/bpf/btf.c:1946
> Code: ef e8 7f 8e e4 ff 41 83 ff 0b 77 28 f6 44 24 10 18 75 3f e8 6d 91
> e4 ff 44 89 fe bf 0e 00 00 00 e8 20 8e e4 ff e8 5b 91 e4 ff <0f> 0b 45
> 31 f6 e9 98 02 00 00 41 83 ff 12 74 18 e8 46 91 e4 ff 44
> RSP: 0018:ffffc90003cefb40 EFLAGS: 00010293
> RAX: 0000000000000000 RBX: 0000000000000002 RCX: 0000000000000000
> RDX: ffff8880259c0000 RSI: ffffffff81968415 RDI: 0000000000000005
> RBP: ffff88801270ca00 R08: 0000000000000005 R09: 000000000000000e
> R10: 0000000000000011 R11: 0000000000000000 R12: 0000000000000000
> R13: 0000000000000011 R14: ffff888026ee6424 R15: 0000000000000011
> FS: 000055555641b300(0000) GS:ffff8880b9a00000(0000)
> knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 0000000000f2e258 CR3: 000000007110e000 CR4: 00000000003506f0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> Call Trace:
> <TASK>
> btf_func_proto_check kernel/bpf/btf.c:4447 [inline]
> btf_check_all_types kernel/bpf/btf.c:4723 [inline]
> btf_parse_type_sec kernel/bpf/btf.c:4752 [inline]
> btf_parse kernel/bpf/btf.c:5026 [inline]
> btf_new_fd+0x1926/0x1e70 kernel/bpf/btf.c:6892
> bpf_btf_load kernel/bpf/syscall.c:4324 [inline]
> __sys_bpf+0xb7d/0x4cf0 kernel/bpf/syscall.c:5010
> __do_sys_bpf kernel/bpf/syscall.c:5069 [inline]
> __se_sys_bpf kernel/bpf/syscall.c:5067 [inline]
> __x64_sys_bpf+0x75/0xb0 kernel/bpf/syscall.c:5067
> do_syscall_x64 arch/x86/entry/common.c:50 [inline]
> do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
> entry_SYSCALL_64_after_hwframe+0x63/0xcd
> RIP: 0033:0x7f0fbae41c69
> Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89
> f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01
> f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007ffc8aeb6228 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
> RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f0fbae41c69
> RDX: 0000000000000020 RSI: 0000000020000140 RDI: 0000000000000012
> RBP: 00007f0fbae05e10 R08: 0000000000000000 R09: 0000000000000000
> R10: 00000000ffffffff R11: 0000000000000246 R12: 00007f0fbae05ea0
> R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
> </TASK>
>
> Looks like it tries to create a func_proto which return type is
> decl_tag. For the details, see Martin's spot on analysis in [0].
>
> 0: https://lore.kernel.org/bpf/CAKH8qBuQDLva_hHxxBuZzyAcYNO4ejhovz6TQeVSk8HY-2SO6g@mail.gmail.com/T/#mea6524b3fcd6298347432226e81b1e6155efc62c
>
> Cc: Yonghong Song <yhs@fb.com>
> Cc: Martin KaFai Lau <martin.lau@kernel.org>
> Fixes: bd16dee66ae4 ("bpf: Add BTF_KIND_DECL_TAG typedef support")
> Reported-by: syzbot+d8bd751aef7c6b39a344@syzkaller.appspotmail.com
> Signed-off-by: Stanislav Fomichev <sdf@google.com>
Acked-by: Yonghong Song <yhs@fb.com>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH bpf-next 1/2] selftests/bpf: Add reproducer for decl_tag in func_proto return type
2022-10-15 0:24 [PATCH bpf-next 1/2] selftests/bpf: Add reproducer for decl_tag in func_proto return type Stanislav Fomichev
2022-10-15 0:24 ` [PATCH bpf-next 2/2] bpf: prevent decl_tag from being referenced in func_proto Stanislav Fomichev
2022-10-17 5:33 ` [PATCH bpf-next 1/2] selftests/bpf: Add reproducer for decl_tag in func_proto return type Yonghong Song
@ 2022-10-17 18:30 ` patchwork-bot+netdevbpf
2 siblings, 0 replies; 6+ messages in thread
From: patchwork-bot+netdevbpf @ 2022-10-17 18:30 UTC (permalink / raw)
To: Stanislav Fomichev
Cc: bpf, ast, daniel, andrii, martin.lau, song, yhs, john.fastabend,
kpsingh, haoluo, jolsa, martin.lau
Hello:
This series was applied to bpf/bpf.git (master)
by Martin KaFai Lau <martin.lau@kernel.org>:
On Fri, 14 Oct 2022 17:24:43 -0700 you wrote:
> It should trigger a WARN_ON_ONCE in btf_type_id_size.
>
> btf_func_proto_check kernel/bpf/btf.c:4447 [inline]
> btf_check_all_types kernel/bpf/btf.c:4723 [inline]
> btf_parse_type_sec kernel/bpf/btf.c:4752 [inline]
> btf_parse kernel/bpf/btf.c:5026 [inline]
> btf_new_fd+0x1926/0x1e70 kernel/bpf/btf.c:6892
> bpf_btf_load kernel/bpf/syscall.c:4324 [inline]
> __sys_bpf+0xb7d/0x4cf0 kernel/bpf/syscall.c:5010
> __do_sys_bpf kernel/bpf/syscall.c:5069 [inline]
> __se_sys_bpf kernel/bpf/syscall.c:5067 [inline]
> __x64_sys_bpf+0x75/0xb0 kernel/bpf/syscall.c:5067
> do_syscall_x64 arch/x86/entry/common.c:50 [inline]
> do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
> entry_SYSCALL_64_after_hwframe+0x63/0xcd
>
> [...]
Here is the summary with links:
- [bpf-next,1/2] selftests/bpf: Add reproducer for decl_tag in func_proto return type
https://git.kernel.org/bpf/bpf/c/35cc9d622e8c
- [bpf-next,2/2] bpf: prevent decl_tag from being referenced in func_proto
https://git.kernel.org/bpf/bpf/c/ea68376c8bed
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH bpf-next 2/2] bpf: prevent decl_tag from being referenced in func_proto
2022-10-15 0:24 ` [PATCH bpf-next 2/2] bpf: prevent decl_tag from being referenced in func_proto Stanislav Fomichev
2022-10-17 5:33 ` Yonghong Song
@ 2022-10-17 18:32 ` Martin KaFai Lau
1 sibling, 0 replies; 6+ messages in thread
From: Martin KaFai Lau @ 2022-10-17 18:32 UTC (permalink / raw)
To: Stanislav Fomichev
Cc: ast, daniel, andrii, song, yhs, john.fastabend, kpsingh, haoluo,
jolsa, Martin KaFai Lau, syzbot+d8bd751aef7c6b39a344, bpf
On 10/14/22 5:24 PM, Stanislav Fomichev wrote:
> diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
> index eba603cec2c5..35c07afac924 100644
> --- a/kernel/bpf/btf.c
> +++ b/kernel/bpf/btf.c
> @@ -4436,6 +4436,11 @@ static int btf_func_proto_check(struct btf_verifier_env *env,
> return -EINVAL;
> }
>
> + if (btf_type_is_resolve_source_only(ret_type)) {
> + btf_verifier_log_type(env, t, "Invalid return type");
> + return -EINVAL;
> + }
Thanks for the fix. It is applied to the bpf tree.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2022-10-17 18:33 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-10-15 0:24 [PATCH bpf-next 1/2] selftests/bpf: Add reproducer for decl_tag in func_proto return type Stanislav Fomichev
2022-10-15 0:24 ` [PATCH bpf-next 2/2] bpf: prevent decl_tag from being referenced in func_proto Stanislav Fomichev
2022-10-17 5:33 ` Yonghong Song
2022-10-17 18:32 ` Martin KaFai Lau
2022-10-17 5:33 ` [PATCH bpf-next 1/2] selftests/bpf: Add reproducer for decl_tag in func_proto return type Yonghong Song
2022-10-17 18:30 ` patchwork-bot+netdevbpf
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.