From: Greg KH <greg@kroah.com>
To: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
Cc: stable@vger.kernel.org, bpf@vger.kernel.org,
Daniel Borkmann <daniel@iogearbox.net>,
Alexei Starovoitov <ast@kernel.org>,
John Fastabend <john.fastabend@gmail.com>,
Pavel Machek <pavel@denx.de>
Subject: Re: [PATCH 4.14 1/4] bpf: Do not use ax register in interpreter on div/mod
Date: Wed, 1 Sep 2021 13:31:18 +0200 [thread overview]
Message-ID: <YS9khsCFrPQ4PZDm@kroah.com> (raw)
In-Reply-To: <YS9kXabJPWScxiHi@kroah.com>
On Wed, Sep 01, 2021 at 01:30:37PM +0200, Greg KH wrote:
> On Mon, Aug 30, 2021 at 03:32:08PM -0300, Thadeu Lima de Souza Cascardo wrote:
> > From: Daniel Borkmann <daniel@iogearbox.net>
> >
> > Partially undo old commit 144cd91c4c2b ("bpf: move tmp variable into ax
> > register in interpreter"). The reason we need this here is because ax
> > register will be used for holding temporary state for div/mod instruction
> > which otherwise interpreter would corrupt. This will cause a small +8 byte
> > stack increase for interpreter, but with the gain that we can use it from
> > verifier rewrites as scratch register.
> >
> > Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
> > Reviewed-by: John Fastabend <john.fastabend@gmail.com>
> > [cascardo: This partial revert is needed in order to support using AX for
> > the following two commits, as there is no JMP32 on 4.19.y]
> > Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
> > ---
> > kernel/bpf/core.c | 32 +++++++++++++++-----------------
> > 1 file changed, 15 insertions(+), 17 deletions(-)
> >
> > diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
> > index e7211b0fa27c..30d871be9974 100644
> > --- a/kernel/bpf/core.c
> > +++ b/kernel/bpf/core.c
> > @@ -616,9 +616,6 @@ static int bpf_jit_blind_insn(const struct bpf_insn *from,
> > * below.
> > *
> > * Constant blinding is only used by JITs, not in the interpreter.
> > - * The interpreter uses AX in some occasions as a local temporary
> > - * register e.g. in DIV or MOD instructions.
> > - *
> > * In restricted circumstances, the verifier can also use the AX
> > * register for rewrites as long as they do not interfere with
> > * the above cases!
> > @@ -951,6 +948,7 @@ static unsigned int ___bpf_prog_run(u64 *regs, const struct bpf_insn *insn,
> > u32 tail_call_cnt = 0;
> > void *ptr;
> > int off;
> > + u64 tmp;
> >
> > #define CONT ({ insn++; goto select_insn; })
> > #define CONT_JMP ({ insn++; goto select_insn; })
> > @@ -1013,22 +1011,22 @@ static unsigned int ___bpf_prog_run(u64 *regs, const struct bpf_insn *insn,
> > ALU64_MOD_X:
> > if (unlikely(SRC == 0))
> > return 0;
> > - div64_u64_rem(DST, SRC, &AX);
> > - DST = AX;
> > + div64_u64_rem(DST, SRC, &tmp);
> > + DST = tmp;
> > CONT;
> > ALU_MOD_X:
> > if (unlikely((u32)SRC == 0))
> > return 0;
> > - AX = (u32) DST;
> > - DST = do_div(AX, (u32) SRC);
> > + tmp = (u32) DST;
> > + DST = do_div(tmp, (u32) SRC);
> > CONT;
> > ALU64_MOD_K:
> > - div64_u64_rem(DST, IMM, &AX);
> > - DST = AX;
> > + div64_u64_rem(DST, IMM, &tmp);
> > + DST = tmp;
> > CONT;
> > ALU_MOD_K:
> > - AX = (u32) DST;
> > - DST = do_div(AX, (u32) IMM);
> > + tmp = (u32) DST;
> > + DST = do_div(tmp, (u32) IMM);
> > CONT;
> > ALU64_DIV_X:
> > if (unlikely(SRC == 0))
> > @@ -1038,17 +1036,17 @@ static unsigned int ___bpf_prog_run(u64 *regs, const struct bpf_insn *insn,
> > ALU_DIV_X:
> > if (unlikely((u32)SRC == 0))
> > return 0;
> > - AX = (u32) DST;
> > - do_div(AX, (u32) SRC);
> > - DST = (u32) AX;
> > + tmp = (u32) DST;
> > + do_div(tmp, (u32) SRC);
> > + DST = (u32) tmp;
> > CONT;
> > ALU64_DIV_K:
> > DST = div64_u64(DST, IMM);
> > CONT;
> > ALU_DIV_K:
> > - AX = (u32) DST;
> > - do_div(AX, (u32) IMM);
> > - DST = (u32) AX;
> > + tmp = (u32) DST;
> > + do_div(tmp, (u32) IMM);
> > + DST = (u32) tmp;
> > CONT;
> > ALU_END_TO_BE:
> > switch (IMM) {
> > --
> > 2.30.2
> >
>
> Oops, no, this patch causes build errors:
>
> kernel/bpf/core.c: In function ‘___bpf_prog_run’:
> kernel/bpf/core.c:951:13: error: redeclaration of ‘tmp’ with no linkage
> 951 | u64 tmp;
> | ^~~
> kernel/bpf/core.c:839:13: note: previous declaration of ‘tmp’ with type ‘u64’ {aka ‘long long unsigned int’}
> 839 | u64 tmp;
> | ^~~
> make[2]: *** [scripts/Makefile.build:329: kernel/bpf/core.o] Error 1
>
>
> Please fix up and resend the whole series, as I will go drop these 3
> patches from the 4.14.y queue now.
All _4_ patches I mean. now dropped...
next prev parent reply other threads:[~2021-09-01 11:31 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-08-30 18:32 [PATCH 4.14 0/4] BPF fixes for CVE-2021-3444 and CVE-2021-3600 Thadeu Lima de Souza Cascardo
2021-08-30 18:32 ` [PATCH 4.14 1/4] bpf: Do not use ax register in interpreter on div/mod Thadeu Lima de Souza Cascardo
2021-09-01 11:30 ` Greg KH
2021-09-01 11:31 ` Greg KH [this message]
2021-09-01 12:09 ` Thadeu Lima de Souza Cascardo
2021-08-30 18:32 ` [PATCH 4.14 2/4] bpf: fix subprog verifier bypass by div/mod by 0 exception Thadeu Lima de Souza Cascardo
2021-08-30 18:32 ` [PATCH 4.14 3/4] bpf: Fix 32 bit src register truncation on div/mod Thadeu Lima de Souza Cascardo
2021-08-30 18:32 ` [PATCH 4.14 4/4] bpf: Fix truncation handling for mod32 dst reg wrt zero Thadeu Lima de Souza Cascardo
2021-09-01 9:43 ` [PATCH 4.14 0/4] BPF fixes for CVE-2021-3444 and CVE-2021-3600 Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=YS9khsCFrPQ4PZDm@kroah.com \
--to=greg@kroah.com \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=cascardo@canonical.com \
--cc=daniel@iogearbox.net \
--cc=john.fastabend@gmail.com \
--cc=pavel@denx.de \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).