From: Edward Cree <ecree.xilinx@gmail.com>
To: Kurt Manucredo <fuzzybritches0@gmail.com>,
ebiggers@kernel.org,
syzbot+bed360704c521841c85d@syzkaller.appspotmail.com
Cc: keescook@chromium.org, yhs@fb.com, dvyukov@google.com,
andrii@kernel.org, ast@kernel.org, bpf@vger.kernel.org,
daniel@iogearbox.net, davem@davemloft.net, hawk@kernel.org,
john.fastabend@gmail.com, kafai@fb.com, kpsingh@kernel.org,
kuba@kernel.org, linux-kernel@vger.kernel.org,
netdev@vger.kernel.org, songliubraving@fb.com,
syzkaller-bugs@googlegroups.com, nathan@kernel.org,
ndesaulniers@google.com, clang-built-linux@googlegroups.com,
kernel-hardening@lists.openwall.com, kasan-dev@googlegroups.com
Subject: Re: [PATCH v5] bpf: core: fix shift-out-of-bounds in ___bpf_prog_run
Date: Tue, 15 Jun 2021 19:51:07 +0100 [thread overview]
Message-ID: <bac16d8d-c174-bdc4-91bd-bfa62b410190@gmail.com> (raw)
In-Reply-To: <85536-177443-curtm@phaethon>
On 15/06/2021 17:42, Kurt Manucredo wrote:
> Syzbot detects a shift-out-of-bounds in ___bpf_prog_run()
> kernel/bpf/core.c:1414:2.
>
> The shift-out-of-bounds happens when we have BPF_X. This means we have
> to go the same way we go when we want to avoid a divide-by-zero. We do
> it in do_misc_fixups().
Shifts by more than insn_bitness are legal in the eBPF ISA; they are
implementation-defined behaviour, rather than UB, and have been made
legal for performance reasons. Each of the JIT backends compiles the
eBPF shift operations to machine instructions which produce
implementation-defined results in such a case; the resulting contents
of the register may be arbitrary but program behaviour as a whole
remains defined.
Guard checks in the fast path (i.e. affecting JITted code) will thus
not be accepted.
The case of division by zero is not truly analogous, as division
instructions on many of the JIT-targeted architectures will raise a
machine exception / fault on division by zero, whereas (to the best of
my knowledge) none will do so on an out-of-bounds shift.
(That said, it would be possible to record from the verifier division
instructions in the program which are known never to be passed zero as
divisor, and eliding the fixup patch in those cases. However, the
extra complexity may not be worthwhile.)
As I understand it, the UBSAN report is coming from the eBPF interpreter,
which is the *slow path* and indeed on many production systems is
compiled out for hardening reasons (CONFIG_BPF_JIT_ALWAYS_ON).
Perhaps a better approach to the fix would be to change the interpreter
to compute "DST = DST << (SRC & 63);" (and similar for other shifts and
bitnesses), thus matching the behaviour of most chips' shift opcodes.
This would shut up UBSAN, without affecting JIT code generation.
-ed
next prev parent reply other threads:[~2021-06-15 18:51 UTC|newest]
Thread overview: 47+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-03-10 16:05 [syzbot] UBSAN: shift-out-of-bounds in ___bpf_prog_run syzbot
2021-03-28 3:38 ` syzbot
2021-06-02 21:27 ` [PATCH v3] bpf: core: fix " Kurt Manucredo
2021-06-02 21:27 ` Kurt Manucredo
2021-06-03 4:43 ` Greg KH
2021-06-03 4:43 ` Greg KH
2021-06-05 15:01 ` [PATCH v4] " Kurt Manucredo
2021-06-05 15:01 ` Kurt Manucredo
2021-06-05 17:55 ` Yonghong Song
2021-06-05 17:55 ` Yonghong Song via Linux-kernel-mentees
2021-06-05 19:10 ` Alexei Starovoitov
2021-06-05 19:10 ` Alexei Starovoitov
2021-06-05 21:39 ` Yonghong Song
2021-06-05 21:39 ` Yonghong Song via Linux-kernel-mentees
2021-06-06 19:44 ` Kurt Manucredo
2021-06-06 19:44 ` Kurt Manucredo
2021-06-07 7:38 ` Dmitry Vyukov
2021-06-07 7:38 ` Dmitry Vyukov
2021-06-07 7:38 ` Dmitry Vyukov via Linux-kernel-mentees
2021-06-09 18:20 ` Kees Cook
2021-06-09 18:20 ` Kees Cook
2021-06-09 23:40 ` Yonghong Song
2021-06-09 23:40 ` Yonghong Song via Linux-kernel-mentees
2021-06-10 5:32 ` Dmitry Vyukov
2021-06-10 5:32 ` Dmitry Vyukov
2021-06-10 5:32 ` Dmitry Vyukov via Linux-kernel-mentees
2021-06-10 6:06 ` Yonghong Song
2021-06-10 6:06 ` Yonghong Song via Linux-kernel-mentees
2021-06-10 17:06 ` Kees Cook
2021-06-10 17:06 ` Kees Cook
2021-06-10 17:52 ` Alexei Starovoitov
2021-06-10 17:52 ` Alexei Starovoitov
2021-06-10 17:52 ` Alexei Starovoitov
2021-06-10 20:00 ` Eric Biggers
2021-06-10 20:00 ` Eric Biggers
2021-06-15 16:42 ` [PATCH v5] " Kurt Manucredo
2021-06-15 18:51 ` Edward Cree [this message]
2021-06-15 19:33 ` Eric Biggers
2021-06-15 21:08 ` Daniel Borkmann
2021-06-15 21:32 ` Eric Biggers
2021-06-15 21:38 ` Eric Biggers
2021-06-15 21:54 ` Daniel Borkmann
2021-06-15 22:07 ` Eric Biggers
2021-06-15 22:31 ` Kurt Manucredo
2021-06-17 10:09 ` Daniel Borkmann
2021-06-06 19:15 ` [PATCH v4] " Kurt Manucredo
2021-06-06 19:15 ` Kurt Manucredo
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=bac16d8d-c174-bdc4-91bd-bfa62b410190@gmail.com \
--to=ecree.xilinx@gmail.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=clang-built-linux@googlegroups.com \
--cc=daniel@iogearbox.net \
--cc=davem@davemloft.net \
--cc=dvyukov@google.com \
--cc=ebiggers@kernel.org \
--cc=fuzzybritches0@gmail.com \
--cc=hawk@kernel.org \
--cc=john.fastabend@gmail.com \
--cc=kafai@fb.com \
--cc=kasan-dev@googlegroups.com \
--cc=keescook@chromium.org \
--cc=kernel-hardening@lists.openwall.com \
--cc=kpsingh@kernel.org \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=nathan@kernel.org \
--cc=ndesaulniers@google.com \
--cc=netdev@vger.kernel.org \
--cc=songliubraving@fb.com \
--cc=syzbot+bed360704c521841c85d@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
--cc=yhs@fb.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.