All of lore.kernel.org
 help / color / mirror / Atom feed
From: Greg KH <greg@kroah.com>
To: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
Cc: stable@vger.kernel.org, bpf@vger.kernel.org,
	Daniel Borkmann <daniel@iogearbox.net>,
	Alexei Starovoitov <ast@kernel.org>,
	John Fastabend <john.fastabend@gmail.com>,
	Pavel Machek <pavel@denx.de>
Subject: Re: [PATCH 4.14 1/4] bpf: Do not use ax register in interpreter on div/mod
Date: Wed, 1 Sep 2021 13:30:37 +0200	[thread overview]
Message-ID: <YS9kXabJPWScxiHi@kroah.com> (raw)
In-Reply-To: <20210830183211.339054-2-cascardo@canonical.com>

On Mon, Aug 30, 2021 at 03:32:08PM -0300, Thadeu Lima de Souza Cascardo wrote:
> From: Daniel Borkmann <daniel@iogearbox.net>
> 
> Partially undo old commit 144cd91c4c2b ("bpf: move tmp variable into ax
> register in interpreter"). The reason we need this here is because ax
> register will be used for holding temporary state for div/mod instruction
> which otherwise interpreter would corrupt. This will cause a small +8 byte
> stack increase for interpreter, but with the gain that we can use it from
> verifier rewrites as scratch register.
> 
> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
> Reviewed-by: John Fastabend <john.fastabend@gmail.com>
> [cascardo: This partial revert is needed in order to support using AX for
> the following two commits, as there is no JMP32 on 4.19.y]
> Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
> ---
>  kernel/bpf/core.c | 32 +++++++++++++++-----------------
>  1 file changed, 15 insertions(+), 17 deletions(-)
> 
> diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
> index e7211b0fa27c..30d871be9974 100644
> --- a/kernel/bpf/core.c
> +++ b/kernel/bpf/core.c
> @@ -616,9 +616,6 @@ static int bpf_jit_blind_insn(const struct bpf_insn *from,
>  	 * below.
>  	 *
>  	 * Constant blinding is only used by JITs, not in the interpreter.
> -	 * The interpreter uses AX in some occasions as a local temporary
> -	 * register e.g. in DIV or MOD instructions.
> -	 *
>  	 * In restricted circumstances, the verifier can also use the AX
>  	 * register for rewrites as long as they do not interfere with
>  	 * the above cases!
> @@ -951,6 +948,7 @@ static unsigned int ___bpf_prog_run(u64 *regs, const struct bpf_insn *insn,
>  	u32 tail_call_cnt = 0;
>  	void *ptr;
>  	int off;
> +	u64 tmp;
>  
>  #define CONT	 ({ insn++; goto select_insn; })
>  #define CONT_JMP ({ insn++; goto select_insn; })
> @@ -1013,22 +1011,22 @@ static unsigned int ___bpf_prog_run(u64 *regs, const struct bpf_insn *insn,
>  	ALU64_MOD_X:
>  		if (unlikely(SRC == 0))
>  			return 0;
> -		div64_u64_rem(DST, SRC, &AX);
> -		DST = AX;
> +		div64_u64_rem(DST, SRC, &tmp);
> +		DST = tmp;
>  		CONT;
>  	ALU_MOD_X:
>  		if (unlikely((u32)SRC == 0))
>  			return 0;
> -		AX = (u32) DST;
> -		DST = do_div(AX, (u32) SRC);
> +		tmp = (u32) DST;
> +		DST = do_div(tmp, (u32) SRC);
>  		CONT;
>  	ALU64_MOD_K:
> -		div64_u64_rem(DST, IMM, &AX);
> -		DST = AX;
> +		div64_u64_rem(DST, IMM, &tmp);
> +		DST = tmp;
>  		CONT;
>  	ALU_MOD_K:
> -		AX = (u32) DST;
> -		DST = do_div(AX, (u32) IMM);
> +		tmp = (u32) DST;
> +		DST = do_div(tmp, (u32) IMM);
>  		CONT;
>  	ALU64_DIV_X:
>  		if (unlikely(SRC == 0))
> @@ -1038,17 +1036,17 @@ static unsigned int ___bpf_prog_run(u64 *regs, const struct bpf_insn *insn,
>  	ALU_DIV_X:
>  		if (unlikely((u32)SRC == 0))
>  			return 0;
> -		AX = (u32) DST;
> -		do_div(AX, (u32) SRC);
> -		DST = (u32) AX;
> +		tmp = (u32) DST;
> +		do_div(tmp, (u32) SRC);
> +		DST = (u32) tmp;
>  		CONT;
>  	ALU64_DIV_K:
>  		DST = div64_u64(DST, IMM);
>  		CONT;
>  	ALU_DIV_K:
> -		AX = (u32) DST;
> -		do_div(AX, (u32) IMM);
> -		DST = (u32) AX;
> +		tmp = (u32) DST;
> +		do_div(tmp, (u32) IMM);
> +		DST = (u32) tmp;
>  		CONT;
>  	ALU_END_TO_BE:
>  		switch (IMM) {
> -- 
> 2.30.2
> 

Oops, no, this patch causes build errors:

kernel/bpf/core.c: In function ‘___bpf_prog_run’:
kernel/bpf/core.c:951:13: error: redeclaration of ‘tmp’ with no linkage
  951 |         u64 tmp;
      |             ^~~
kernel/bpf/core.c:839:13: note: previous declaration of ‘tmp’ with type ‘u64’ {aka ‘long long unsigned int’}
  839 |         u64 tmp;
      |             ^~~
make[2]: *** [scripts/Makefile.build:329: kernel/bpf/core.o] Error 1


Please fix up and resend the whole series, as I will go drop these 3
patches from the 4.14.y queue now.

greg k-h

  reply	other threads:[~2021-09-01 11:30 UTC|newest]

Thread overview: 9+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-08-30 18:32 [PATCH 4.14 0/4] BPF fixes for CVE-2021-3444 and CVE-2021-3600 Thadeu Lima de Souza Cascardo
2021-08-30 18:32 ` [PATCH 4.14 1/4] bpf: Do not use ax register in interpreter on div/mod Thadeu Lima de Souza Cascardo
2021-09-01 11:30   ` Greg KH [this message]
2021-09-01 11:31     ` Greg KH
2021-09-01 12:09       ` Thadeu Lima de Souza Cascardo
2021-08-30 18:32 ` [PATCH 4.14 2/4] bpf: fix subprog verifier bypass by div/mod by 0 exception Thadeu Lima de Souza Cascardo
2021-08-30 18:32 ` [PATCH 4.14 3/4] bpf: Fix 32 bit src register truncation on div/mod Thadeu Lima de Souza Cascardo
2021-08-30 18:32 ` [PATCH 4.14 4/4] bpf: Fix truncation handling for mod32 dst reg wrt zero Thadeu Lima de Souza Cascardo
2021-09-01  9:43 ` [PATCH 4.14 0/4] BPF fixes for CVE-2021-3444 and CVE-2021-3600 Greg KH

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=YS9kXabJPWScxiHi@kroah.com \
    --to=greg@kroah.com \
    --cc=ast@kernel.org \
    --cc=bpf@vger.kernel.org \
    --cc=cascardo@canonical.com \
    --cc=daniel@iogearbox.net \
    --cc=john.fastabend@gmail.com \
    --cc=pavel@denx.de \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.