* [PATCH bpf-next] bpf: Emit explicit NULL pointer checks for PROBE_LDX instructions.
@ 2021-02-02 5:38 Alexei Starovoitov
2021-02-03 0:56 ` Song Liu
2021-02-04 16:10 ` patchwork-bot+netdevbpf
0 siblings, 2 replies; 5+ messages in thread
From: Alexei Starovoitov @ 2021-02-02 5:38 UTC (permalink / raw)
To: davem; +Cc: daniel, netdev, bpf, kernel-team
From: Alexei Starovoitov <ast@kernel.org>
PTR_TO_BTF_ID registers contain either kernel pointer or NULL.
Emit the NULL check explicitly by JIT instead of going into
do_user_addr_fault() on NULL deference.
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
---
arch/x86/net/bpf_jit_comp.c | 19 +++++++++++++++++++
1 file changed, 19 insertions(+)
diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
index b7a2911bda77..a3dc3bd154ac 100644
--- a/arch/x86/net/bpf_jit_comp.c
+++ b/arch/x86/net/bpf_jit_comp.c
@@ -930,6 +930,7 @@ static int do_jit(struct bpf_prog *bpf_prog, int *addrs, u8 *image,
u32 dst_reg = insn->dst_reg;
u32 src_reg = insn->src_reg;
u8 b2 = 0, b3 = 0;
+ u8 *start_of_ldx;
s64 jmp_offset;
u8 jmp_cond;
u8 *func;
@@ -1278,12 +1279,30 @@ st: if (is_imm8(insn->off))
case BPF_LDX | BPF_PROBE_MEM | BPF_W:
case BPF_LDX | BPF_MEM | BPF_DW:
case BPF_LDX | BPF_PROBE_MEM | BPF_DW:
+ if (BPF_MODE(insn->code) == BPF_PROBE_MEM) {
+ /* test src_reg, src_reg */
+ maybe_emit_mod(&prog, src_reg, src_reg, true); /* always 1 byte */
+ EMIT2(0x85, add_2reg(0xC0, src_reg, src_reg));
+ /* jne start_of_ldx */
+ EMIT2(X86_JNE, 0);
+ /* xor dst_reg, dst_reg */
+ emit_mov_imm32(&prog, false, dst_reg, 0);
+ /* jmp byte_after_ldx */
+ EMIT2(0xEB, 0);
+
+ /* populate jmp_offset for JNE above */
+ temp[4] = prog - temp - 5 /* sizeof(test + jne) */;
+ start_of_ldx = prog;
+ }
emit_ldx(&prog, BPF_SIZE(insn->code), dst_reg, src_reg, insn->off);
if (BPF_MODE(insn->code) == BPF_PROBE_MEM) {
struct exception_table_entry *ex;
u8 *_insn = image + proglen;
s64 delta;
+ /* populate jmp_offset for JMP above */
+ start_of_ldx[-1] = prog - start_of_ldx;
+
if (!bpf_prog->aux->extable)
break;
--
2.24.1
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [PATCH bpf-next] bpf: Emit explicit NULL pointer checks for PROBE_LDX instructions.
2021-02-02 5:38 [PATCH bpf-next] bpf: Emit explicit NULL pointer checks for PROBE_LDX instructions Alexei Starovoitov
@ 2021-02-03 0:56 ` Song Liu
2021-02-03 2:19 ` Alexei Starovoitov
2021-02-04 16:10 ` patchwork-bot+netdevbpf
1 sibling, 1 reply; 5+ messages in thread
From: Song Liu @ 2021-02-03 0:56 UTC (permalink / raw)
To: Alexei Starovoitov
Cc: David S . Miller, Daniel Borkmann, Networking, bpf, Kernel Team
> On Feb 1, 2021, at 9:38 PM, Alexei Starovoitov <alexei.starovoitov@gmail.com> wrote:
>
> From: Alexei Starovoitov <ast@kernel.org>
>
> PTR_TO_BTF_ID registers contain either kernel pointer or NULL.
> Emit the NULL check explicitly by JIT instead of going into
> do_user_addr_fault() on NULL deference.
>
> Signed-off-by: Alexei Starovoitov <ast@kernel.org>
> ---
> arch/x86/net/bpf_jit_comp.c | 19 +++++++++++++++++++
> 1 file changed, 19 insertions(+)
>
> diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
> index b7a2911bda77..a3dc3bd154ac 100644
> --- a/arch/x86/net/bpf_jit_comp.c
> +++ b/arch/x86/net/bpf_jit_comp.c
> @@ -930,6 +930,7 @@ static int do_jit(struct bpf_prog *bpf_prog, int *addrs, u8 *image,
> u32 dst_reg = insn->dst_reg;
> u32 src_reg = insn->src_reg;
> u8 b2 = 0, b3 = 0;
> + u8 *start_of_ldx;
> s64 jmp_offset;
> u8 jmp_cond;
> u8 *func;
> @@ -1278,12 +1279,30 @@ st: if (is_imm8(insn->off))
> case BPF_LDX | BPF_PROBE_MEM | BPF_W:
> case BPF_LDX | BPF_MEM | BPF_DW:
> case BPF_LDX | BPF_PROBE_MEM | BPF_DW:
> + if (BPF_MODE(insn->code) == BPF_PROBE_MEM) {
> + /* test src_reg, src_reg */
> + maybe_emit_mod(&prog, src_reg, src_reg, true); /* always 1 byte */
> + EMIT2(0x85, add_2reg(0xC0, src_reg, src_reg));
> + /* jne start_of_ldx */
> + EMIT2(X86_JNE, 0);
> + /* xor dst_reg, dst_reg */
> + emit_mov_imm32(&prog, false, dst_reg, 0);
> + /* jmp byte_after_ldx */
> + EMIT2(0xEB, 0);
> +
> + /* populate jmp_offset for JNE above */
> + temp[4] = prog - temp - 5 /* sizeof(test + jne) */;
IIUC, this case only happens for i == 1 in the loop? If so, can we use temp[5(?)]
instead of start_of_ldx?
Thanks,
Song
> + start_of_ldx = prog;
> + }
> emit_ldx(&prog, BPF_SIZE(insn->code), dst_reg, src_reg, insn->off);
> if (BPF_MODE(insn->code) == BPF_PROBE_MEM) {
> struct exception_table_entry *ex;
> u8 *_insn = image + proglen;
> s64 delta;
>
> + /* populate jmp_offset for JMP above */
> + start_of_ldx[-1] = prog - start_of_ldx;
> +
> if (!bpf_prog->aux->extable)
> break;
>
> --
> 2.24.1
>
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH bpf-next] bpf: Emit explicit NULL pointer checks for PROBE_LDX instructions.
2021-02-03 0:56 ` Song Liu
@ 2021-02-03 2:19 ` Alexei Starovoitov
2021-02-03 18:37 ` Song Liu
0 siblings, 1 reply; 5+ messages in thread
From: Alexei Starovoitov @ 2021-02-03 2:19 UTC (permalink / raw)
To: Song Liu; +Cc: David S . Miller, Daniel Borkmann, Networking, bpf, Kernel Team
On Wed, Feb 03, 2021 at 12:56:39AM +0000, Song Liu wrote:
>
>
> > On Feb 1, 2021, at 9:38 PM, Alexei Starovoitov <alexei.starovoitov@gmail.com> wrote:
> >
> > From: Alexei Starovoitov <ast@kernel.org>
> >
> > PTR_TO_BTF_ID registers contain either kernel pointer or NULL.
> > Emit the NULL check explicitly by JIT instead of going into
> > do_user_addr_fault() on NULL deference.
> >
> > Signed-off-by: Alexei Starovoitov <ast@kernel.org>
> > ---
> > arch/x86/net/bpf_jit_comp.c | 19 +++++++++++++++++++
> > 1 file changed, 19 insertions(+)
> >
> > diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
> > index b7a2911bda77..a3dc3bd154ac 100644
> > --- a/arch/x86/net/bpf_jit_comp.c
> > +++ b/arch/x86/net/bpf_jit_comp.c
> > @@ -930,6 +930,7 @@ static int do_jit(struct bpf_prog *bpf_prog, int *addrs, u8 *image,
> > u32 dst_reg = insn->dst_reg;
> > u32 src_reg = insn->src_reg;
> > u8 b2 = 0, b3 = 0;
> > + u8 *start_of_ldx;
> > s64 jmp_offset;
> > u8 jmp_cond;
> > u8 *func;
> > @@ -1278,12 +1279,30 @@ st: if (is_imm8(insn->off))
> > case BPF_LDX | BPF_PROBE_MEM | BPF_W:
> > case BPF_LDX | BPF_MEM | BPF_DW:
> > case BPF_LDX | BPF_PROBE_MEM | BPF_DW:
> > + if (BPF_MODE(insn->code) == BPF_PROBE_MEM) {
> > + /* test src_reg, src_reg */
> > + maybe_emit_mod(&prog, src_reg, src_reg, true); /* always 1 byte */
> > + EMIT2(0x85, add_2reg(0xC0, src_reg, src_reg));
> > + /* jne start_of_ldx */
> > + EMIT2(X86_JNE, 0);
> > + /* xor dst_reg, dst_reg */
> > + emit_mov_imm32(&prog, false, dst_reg, 0);
> > + /* jmp byte_after_ldx */
> > + EMIT2(0xEB, 0);
> > +
> > + /* populate jmp_offset for JNE above */
> > + temp[4] = prog - temp - 5 /* sizeof(test + jne) */;
>
> IIUC, this case only happens for i == 1 in the loop? If so, can we use temp[5(?)]
> instead of start_of_ldx?
I don't understand the question, but let me try anyway :)
temp is a buffer for single instruction.
prog=temp; for every loop iteration (not only i == 1)
temp[4] is second byte in JNE instruction as the comment says.
temp[5] is a byte after JNE. It's a first byte of XOR.
That XOR is variable length instruction.
Hence while emitting JNE we don't know the target offset in JNE and just use 0.
So temp[4] assignment populates with actual offset, since now we know the size
of XOR.
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH bpf-next] bpf: Emit explicit NULL pointer checks for PROBE_LDX instructions.
2021-02-03 2:19 ` Alexei Starovoitov
@ 2021-02-03 18:37 ` Song Liu
0 siblings, 0 replies; 5+ messages in thread
From: Song Liu @ 2021-02-03 18:37 UTC (permalink / raw)
To: Alexei Starovoitov
Cc: David S . Miller, Daniel Borkmann, Networking, bpf, Kernel Team
> On Feb 2, 2021, at 6:19 PM, Alexei Starovoitov <alexei.starovoitov@gmail.com> wrote:
>
> On Wed, Feb 03, 2021 at 12:56:39AM +0000, Song Liu wrote:
>>
>>
>>> On Feb 1, 2021, at 9:38 PM, Alexei Starovoitov <alexei.starovoitov@gmail.com> wrote:
>>>
>>> From: Alexei Starovoitov <ast@kernel.org>
>>>
>>> PTR_TO_BTF_ID registers contain either kernel pointer or NULL.
>>> Emit the NULL check explicitly by JIT instead of going into
>>> do_user_addr_fault() on NULL deference.
>>>
>>> Signed-off-by: Alexei Starovoitov <ast@kernel.org>
>>> ---
>>> arch/x86/net/bpf_jit_comp.c | 19 +++++++++++++++++++
>>> 1 file changed, 19 insertions(+)
>>>
>>> diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
>>> index b7a2911bda77..a3dc3bd154ac 100644
>>> --- a/arch/x86/net/bpf_jit_comp.c
>>> +++ b/arch/x86/net/bpf_jit_comp.c
>>> @@ -930,6 +930,7 @@ static int do_jit(struct bpf_prog *bpf_prog, int *addrs, u8 *image,
>>> u32 dst_reg = insn->dst_reg;
>>> u32 src_reg = insn->src_reg;
>>> u8 b2 = 0, b3 = 0;
>>> + u8 *start_of_ldx;
>>> s64 jmp_offset;
>>> u8 jmp_cond;
>>> u8 *func;
>>> @@ -1278,12 +1279,30 @@ st: if (is_imm8(insn->off))
>>> case BPF_LDX | BPF_PROBE_MEM | BPF_W:
>>> case BPF_LDX | BPF_MEM | BPF_DW:
>>> case BPF_LDX | BPF_PROBE_MEM | BPF_DW:
>>> + if (BPF_MODE(insn->code) == BPF_PROBE_MEM) {
>>> + /* test src_reg, src_reg */
>>> + maybe_emit_mod(&prog, src_reg, src_reg, true); /* always 1 byte */
>>> + EMIT2(0x85, add_2reg(0xC0, src_reg, src_reg));
>>> + /* jne start_of_ldx */
>>> + EMIT2(X86_JNE, 0);
>>> + /* xor dst_reg, dst_reg */
>>> + emit_mov_imm32(&prog, false, dst_reg, 0);
>>> + /* jmp byte_after_ldx */
>>> + EMIT2(0xEB, 0);
>>> +
>>> + /* populate jmp_offset for JNE above */
>>> + temp[4] = prog - temp - 5 /* sizeof(test + jne) */;
>>
>> IIUC, this case only happens for i == 1 in the loop? If so, can we use temp[5(?)]
>> instead of start_of_ldx?
>
> I don't understand the question, but let me try anyway :)
> temp is a buffer for single instruction.
> prog=temp; for every loop iteration (not only i == 1)
Thanks for the explanation. I misunderstood how we use prog in the loop.
> temp[4] is second byte in JNE instruction as the comment says.
> temp[5] is a byte after JNE. It's a first byte of XOR.
> That XOR is variable length instruction.
> Hence while emitting JNE we don't know the target offset in JNE and just use 0.
> So temp[4] assignment populates with actual offset, since now we know the size
> of XOR.
And after reading emit_ldx() more carefully, I agree that introducing
start_of_ldx would simplify the logic here.
Acked-by: Song Liu <songliubraving@fb.com>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH bpf-next] bpf: Emit explicit NULL pointer checks for PROBE_LDX instructions.
2021-02-02 5:38 [PATCH bpf-next] bpf: Emit explicit NULL pointer checks for PROBE_LDX instructions Alexei Starovoitov
2021-02-03 0:56 ` Song Liu
@ 2021-02-04 16:10 ` patchwork-bot+netdevbpf
1 sibling, 0 replies; 5+ messages in thread
From: patchwork-bot+netdevbpf @ 2021-02-04 16:10 UTC (permalink / raw)
To: Alexei Starovoitov; +Cc: davem, daniel, netdev, bpf, kernel-team
Hello:
This patch was applied to bpf/bpf-next.git (refs/heads/master):
On Mon, 1 Feb 2021 21:38:37 -0800 you wrote:
> From: Alexei Starovoitov <ast@kernel.org>
>
> PTR_TO_BTF_ID registers contain either kernel pointer or NULL.
> Emit the NULL check explicitly by JIT instead of going into
> do_user_addr_fault() on NULL deference.
>
> Signed-off-by: Alexei Starovoitov <ast@kernel.org>
>
> [...]
Here is the summary with links:
- [bpf-next] bpf: Emit explicit NULL pointer checks for PROBE_LDX instructions.
https://git.kernel.org/bpf/bpf-next/c/4c5de127598e
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2021-02-04 16:11 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-02-02 5:38 [PATCH bpf-next] bpf: Emit explicit NULL pointer checks for PROBE_LDX instructions Alexei Starovoitov
2021-02-03 0:56 ` Song Liu
2021-02-03 2:19 ` Alexei Starovoitov
2021-02-03 18:37 ` Song Liu
2021-02-04 16:10 ` patchwork-bot+netdevbpf
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).