* [PATCH v2 6/7] bpf: Make use of alignment information in check_val_ptr_alignment().
@ 2017-05-11 16:06 David Miller
2017-05-11 16:49 ` Daniel Borkmann
0 siblings, 1 reply; 4+ messages in thread
From: David Miller @ 2017-05-11 16:06 UTC (permalink / raw)
To: daniel; +Cc: ast, alexei.starovoitov, netdev
We can validate PTR_TO_MAP_VALUE_ADJ accesses in the same way that we
do for PTR_TO_PACKET. The only difference is that we don't plug
NET_IP_ALIGN into the equation.
Signed-off-by: David S. Miller <davem@davemloft.net>
---
kernel/bpf/verifier.c | 25 +++++++++++++++++++++----
1 file changed, 21 insertions(+), 4 deletions(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index e74fb1b..cdbf282 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -823,10 +823,27 @@ static int check_pkt_ptr_alignment(const struct bpf_reg_state *reg,
}
static int check_val_ptr_alignment(const struct bpf_reg_state *reg,
- int size, bool strict)
+ int off, int size, bool strict)
{
- if (strict && size != 1) {
- verbose("Unknown alignment. Only byte-sized access allowed in value access.\n");
+ int reg_off;
+
+ /* Byte size accesses are always allowed. */
+ if (!strict || size == 1)
+ return 0;
+
+ reg_off = reg->off;
+ if (reg->id) {
+ if (reg->aux_off_align % size) {
+ verbose("Value access is only %u byte aligned, %d byte access not allowed\n",
+ reg->aux_off_align, size);
+ return -EACCES;
+ }
+ reg_off += reg->aux_off;
+ }
+
+ if ((reg_off + off) % size != 0) {
+ verbose("misaligned value access off %d+%d size %d\n",
+ reg_off, off, size);
return -EACCES;
}
@@ -846,7 +863,7 @@ static int check_ptr_alignment(struct bpf_verifier_env *env,
case PTR_TO_PACKET:
return check_pkt_ptr_alignment(reg, off, size, strict);
case PTR_TO_MAP_VALUE_ADJ:
- return check_val_ptr_alignment(reg, size, strict);
+ return check_val_ptr_alignment(reg, off, size, strict);
default:
if (off % size != 0) {
verbose("misaligned access off %d size %d\n",
--
2.1.2.532.g19b5d50
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH v2 6/7] bpf: Make use of alignment information in check_val_ptr_alignment().
2017-05-11 16:06 [PATCH v2 6/7] bpf: Make use of alignment information in check_val_ptr_alignment() David Miller
@ 2017-05-11 16:49 ` Daniel Borkmann
2017-05-11 17:23 ` David Miller
0 siblings, 1 reply; 4+ messages in thread
From: Daniel Borkmann @ 2017-05-11 16:49 UTC (permalink / raw)
To: David Miller; +Cc: ast, alexei.starovoitov, netdev
On 05/11/2017 06:06 PM, David Miller wrote:
>
> We can validate PTR_TO_MAP_VALUE_ADJ accesses in the same way that we
> do for PTR_TO_PACKET. The only difference is that we don't plug
> NET_IP_ALIGN into the equation.
>
> Signed-off-by: David S. Miller <davem@davemloft.net>
> ---
> kernel/bpf/verifier.c | 25 +++++++++++++++++++++----
> 1 file changed, 21 insertions(+), 4 deletions(-)
>
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index e74fb1b..cdbf282 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -823,10 +823,27 @@ static int check_pkt_ptr_alignment(const struct bpf_reg_state *reg,
> }
>
> static int check_val_ptr_alignment(const struct bpf_reg_state *reg,
> - int size, bool strict)
> + int off, int size, bool strict)
> {
> - if (strict && size != 1) {
> - verbose("Unknown alignment. Only byte-sized access allowed in value access.\n");
> + int reg_off;
> +
> + /* Byte size accesses are always allowed. */
> + if (!strict || size == 1)
> + return 0;
> +
> + reg_off = reg->off;
> + if (reg->id) {
> + if (reg->aux_off_align % size) {
> + verbose("Value access is only %u byte aligned, %d byte access not allowed\n",
> + reg->aux_off_align, size);
> + return -EACCES;
> + }
> + reg_off += reg->aux_off;
> + }
This actually won't work, see also commit 79adffcd6489 ("bpf, verifier:
fix rejection of unaligned access checks for map_value_adj") with some
longer explanation. In case of map_value_adj, reg->id is always 0.
> + if ((reg_off + off) % size != 0) {
> + verbose("misaligned value access off %d+%d size %d\n",
> + reg_off, off, size);
> return -EACCES;
> }
>
> @@ -846,7 +863,7 @@ static int check_ptr_alignment(struct bpf_verifier_env *env,
> case PTR_TO_PACKET:
> return check_pkt_ptr_alignment(reg, off, size, strict);
> case PTR_TO_MAP_VALUE_ADJ:
> - return check_val_ptr_alignment(reg, size, strict);
> + return check_val_ptr_alignment(reg, off, size, strict);
> default:
> if (off % size != 0) {
> verbose("misaligned access off %d size %d\n",
>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH v2 6/7] bpf: Make use of alignment information in check_val_ptr_alignment().
2017-05-11 16:49 ` Daniel Borkmann
@ 2017-05-11 17:23 ` David Miller
2017-05-11 17:53 ` Daniel Borkmann
0 siblings, 1 reply; 4+ messages in thread
From: David Miller @ 2017-05-11 17:23 UTC (permalink / raw)
To: daniel; +Cc: ast, alexei.starovoitov, netdev
From: Daniel Borkmann <daniel@iogearbox.net>
Date: Thu, 11 May 2017 18:49:45 +0200
> This actually won't work, see also commit 79adffcd6489 ("bpf,
> verifier:
> fix rejection of unaligned access checks for map_value_adj") with some
> longer explanation. In case of map_value_adj, reg->id is always 0.
I see....
Ok if I merge in the first 5 patches then?
I'll look more deeply into the MAP value issues.
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH v2 6/7] bpf: Make use of alignment information in check_val_ptr_alignment().
2017-05-11 17:23 ` David Miller
@ 2017-05-11 17:53 ` Daniel Borkmann
0 siblings, 0 replies; 4+ messages in thread
From: Daniel Borkmann @ 2017-05-11 17:53 UTC (permalink / raw)
To: David Miller; +Cc: ast, alexei.starovoitov, netdev
On 05/11/2017 07:23 PM, David Miller wrote:
> From: Daniel Borkmann <daniel@iogearbox.net>
> Date: Thu, 11 May 2017 18:49:45 +0200
>
>> This actually won't work, see also commit 79adffcd6489 ("bpf,
>> verifier:
>> fix rejection of unaligned access checks for map_value_adj") with some
>> longer explanation. In case of map_value_adj, reg->id is always 0.
>
> I see....
>
> Ok if I merge in the first 5 patches then?
Yes, please. :)
> I'll look more deeply into the MAP value issues.
Ok, thanks for looking into it!
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2017-05-11 17:53 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-05-11 16:06 [PATCH v2 6/7] bpf: Make use of alignment information in check_val_ptr_alignment() David Miller
2017-05-11 16:49 ` Daniel Borkmann
2017-05-11 17:23 ` David Miller
2017-05-11 17:53 ` Daniel Borkmann
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.