* [PATCH bpf-next 0/2] bpf: remove incorrect 'verifier bug' warning
@ 2019-03-20 12:57 Paul Chaignon
2019-03-20 12:58 ` [PATCH bpf-next 1/2] " Paul Chaignon
` (2 more replies)
0 siblings, 3 replies; 6+ messages in thread
From: Paul Chaignon @ 2019-03-20 12:57 UTC (permalink / raw)
To: Alexei Starovoitov, Daniel Borkmann, netdev, bpf
Cc: xiao.han, paul.chaignon, Martin KaFai Lau, Song Liu, Yonghong Song
The BPF verifier checks the maximum number of call stack frames twice,
first in the main CFG traversal (do_check) and then in a subsequent
traversal (check_max_stack_depth). If the second check fails, it logs a
'verifier bug' warning and errors out, as the number of call stack frames
should have been verified already.
However, the second check may fail without indicating a verifier bug: if
the excessive function calls reside in dead code, the main CFG traversal
may not visit them; the subsequent traversal visits all instructions,
including dead code.
This case raises the question of how invalid dead code should be treated.
The first patch implements the conservative option and rejects such code;
the second adds a test case.
Paul Chaignon (2):
bpf: remove incorrect 'verifier bug' warning
selftests/bpf: test case for invalid call stack in dead code
kernel/bpf/verifier.c | 5 +--
tools/testing/selftests/bpf/verifier/calls.c | 38 ++++++++++++++++++++
2 files changed, 41 insertions(+), 2 deletions(-)
--
2.17.1
^ permalink raw reply [flat|nested] 6+ messages in thread* [PATCH bpf-next 1/2] bpf: remove incorrect 'verifier bug' warning 2019-03-20 12:57 [PATCH bpf-next 0/2] bpf: remove incorrect 'verifier bug' warning Paul Chaignon @ 2019-03-20 12:58 ` Paul Chaignon 2019-03-20 12:58 ` [PATCH bpf-next 2/2] selftests/bpf: test case for invalid call stack in dead code Paul Chaignon 2019-03-20 23:31 ` [PATCH bpf-next 0/2] bpf: remove incorrect 'verifier bug' warning Yonghong Song 2 siblings, 0 replies; 6+ messages in thread From: Paul Chaignon @ 2019-03-20 12:58 UTC (permalink / raw) To: Alexei Starovoitov, Daniel Borkmann, netdev, bpf Cc: xiao.han, paul.chaignon, Martin KaFai Lau, Song Liu, Yonghong Song The BPF verifier checks the maximum number of call stack frames twice, first in the main CFG traversal (do_check) and then in a subsequent traversal (check_max_stack_depth). If the second check fails, it logs a 'verifier bug' warning and errors out, as the number of call stack frames should have been verified already. However, the second check may fail without indicating a verifier bug: if the excessive function calls reside in dead code, the main CFG traversal may not visit them; the subsequent traversal visits all instructions, including dead code. This case raises the question of how invalid dead code should be treated. This patch implements the conservative option and rejects such code. Signed-off-by: Paul Chaignon <paul.chaignon@orange.com> Tested-by: Xiao Han <xiao.han@orange.com> --- kernel/bpf/verifier.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 86f9cd5d1c4e..6719bb9b332e 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -1888,8 +1888,9 @@ static int check_max_stack_depth(struct bpf_verifier_env *env) } frame++; if (frame >= MAX_CALL_FRAMES) { - WARN_ONCE(1, "verifier bug. Call stack is too deep\n"); - return -EFAULT; + verbose(env, "the call stack of %d frames is too deep !\n", + frame); + return -E2BIG; } goto process_func; } -- 2.17.1 ^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH bpf-next 2/2] selftests/bpf: test case for invalid call stack in dead code 2019-03-20 12:57 [PATCH bpf-next 0/2] bpf: remove incorrect 'verifier bug' warning Paul Chaignon 2019-03-20 12:58 ` [PATCH bpf-next 1/2] " Paul Chaignon @ 2019-03-20 12:58 ` Paul Chaignon 2019-03-20 23:31 ` [PATCH bpf-next 0/2] bpf: remove incorrect 'verifier bug' warning Yonghong Song 2 siblings, 0 replies; 6+ messages in thread From: Paul Chaignon @ 2019-03-20 12:58 UTC (permalink / raw) To: Alexei Starovoitov, Daniel Borkmann, netdev, bpf Cc: xiao.han, paul.chaignon, Martin KaFai Lau, Song Liu, Yonghong Song This patch adds a test case with an excessive number of call stack frames in dead code. Signed-off-by: Paul Chaignon <paul.chaignon@orange.com> Tested-by: Xiao Han <xiao.han@orange.com> --- tools/testing/selftests/bpf/verifier/calls.c | 38 ++++++++++++++++++++ 1 file changed, 38 insertions(+) diff --git a/tools/testing/selftests/bpf/verifier/calls.c b/tools/testing/selftests/bpf/verifier/calls.c index 4004891afa9c..ff147fcda82b 100644 --- a/tools/testing/selftests/bpf/verifier/calls.c +++ b/tools/testing/selftests/bpf/verifier/calls.c @@ -907,6 +907,44 @@ .errstr = "call stack", .result = REJECT, }, +{ + "calls: stack depth check in dead code", + .insns = { + /* main */ + BPF_MOV64_IMM(BPF_REG_1, 0), + BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call A */ + BPF_EXIT_INSN(), + /* A */ + BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1), + BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 2), /* call B */ + BPF_MOV64_IMM(BPF_REG_0, 0), + BPF_EXIT_INSN(), + /* B */ + BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call C */ + BPF_EXIT_INSN(), + /* C */ + BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call D */ + BPF_EXIT_INSN(), + /* D */ + BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call E */ + BPF_EXIT_INSN(), + /* E */ + BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call F */ + BPF_EXIT_INSN(), + /* F */ + BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call G */ + BPF_EXIT_INSN(), + /* G */ + BPF_RAW_INSN(BPF_JMP|BPF_CALL, 0, 1, 0, 1), /* call H */ + BPF_EXIT_INSN(), + /* H */ + BPF_MOV64_IMM(BPF_REG_0, 0), + BPF_EXIT_INSN(), + }, + .prog_type = BPF_PROG_TYPE_XDP, + .errstr = "call stack", + .result = REJECT, +}, { "calls: spill into caller stack frame", .insns = { -- 2.17.1 ^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH bpf-next 0/2] bpf: remove incorrect 'verifier bug' warning 2019-03-20 12:57 [PATCH bpf-next 0/2] bpf: remove incorrect 'verifier bug' warning Paul Chaignon 2019-03-20 12:58 ` [PATCH bpf-next 1/2] " Paul Chaignon 2019-03-20 12:58 ` [PATCH bpf-next 2/2] selftests/bpf: test case for invalid call stack in dead code Paul Chaignon @ 2019-03-20 23:31 ` Yonghong Song 2019-03-21 9:33 ` Paul Chaignon 2 siblings, 1 reply; 6+ messages in thread From: Yonghong Song @ 2019-03-20 23:31 UTC (permalink / raw) To: Paul Chaignon, Alexei Starovoitov, Daniel Borkmann, netdev, bpf Cc: xiao.han, paul.chaignon, Martin Lau, Song Liu On 3/20/19 5:57 AM, Paul Chaignon wrote: > The BPF verifier checks the maximum number of call stack frames twice, > first in the main CFG traversal (do_check) and then in a subsequent > traversal (check_max_stack_depth). If the second check fails, it logs a > 'verifier bug' warning and errors out, as the number of call stack frames > should have been verified already. > > However, the second check may fail without indicating a verifier bug: if > the excessive function calls reside in dead code, the main CFG traversal > may not visit them; the subsequent traversal visits all instructions, > including dead code. > > This case raises the question of how invalid dead code should be treated. Maybe we should do this check after dead code elimination to be consistent with do_check? There could some other kinds of illegal stuff in the dead code, e.g., illegal/unsupported helpers, etc. I suppose we did not warn or reject the program, right? > The first patch implements the conservative option and rejects such code; > the second adds a test case. > > Paul Chaignon (2): > bpf: remove incorrect 'verifier bug' warning > selftests/bpf: test case for invalid call stack in dead code > > kernel/bpf/verifier.c | 5 +-- > tools/testing/selftests/bpf/verifier/calls.c | 38 ++++++++++++++++++++ > 2 files changed, 41 insertions(+), 2 deletions(-) > ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH bpf-next 0/2] bpf: remove incorrect 'verifier bug' warning 2019-03-20 23:31 ` [PATCH bpf-next 0/2] bpf: remove incorrect 'verifier bug' warning Yonghong Song @ 2019-03-21 9:33 ` Paul Chaignon 2019-03-26 20:07 ` Alexei Starovoitov 0 siblings, 1 reply; 6+ messages in thread From: Paul Chaignon @ 2019-03-21 9:33 UTC (permalink / raw) To: Yonghong Song, Alexei Starovoitov, Daniel Borkmann, netdev, bpf Cc: Jakub Kicinski, xiao.han, paul.chaignon, Martin KaFai Lau, Song Liu On Wed, Mar 20, 2019 at 11:31PM, Yonghong Song wrote: > On 3/20/19 5:57 AM, Paul Chaignon wrote: > > The BPF verifier checks the maximum number of call stack frames twice, > > first in the main CFG traversal (do_check) and then in a subsequent > > traversal (check_max_stack_depth). If the second check fails, it logs a > > 'verifier bug' warning and errors out, as the number of call stack frames > > should have been verified already. > > > > However, the second check may fail without indicating a verifier bug: if > > the excessive function calls reside in dead code, the main CFG traversal > > may not visit them; the subsequent traversal visits all instructions, > > including dead code. > > > > This case raises the question of how invalid dead code should be treated. > > Maybe we should do this check after dead code elimination to be > consistent with do_check? There could some other kinds of illegal stuff To be clear, are you suggesting we run check_max_stack_depth after the dead code elimination? That would indeed solve this issue, but Jakub made the exact reverse change not so long ago, in 9b38c40 ("bpf: verifier: reorder stack size check with dead code sanitization"). I think the idea was to avoid having code modifications in between code checks. > in the dead code, e.g., illegal/unsupported helpers, etc. I suppose we > did not warn or reject the program, right? As far as I know, we do not warn or reject the programs for other illegal stuff found in dead code, no. > > > The first patch implements the conservative option and rejects such code; > > the second adds a test case. > > > > Paul Chaignon (2): > > bpf: remove incorrect 'verifier bug' warning > > selftests/bpf: test case for invalid call stack in dead code > > > > kernel/bpf/verifier.c | 5 +-- > > tools/testing/selftests/bpf/verifier/calls.c | 38 ++++++++++++++++++++ > > 2 files changed, 41 insertions(+), 2 deletions(-) > > ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH bpf-next 0/2] bpf: remove incorrect 'verifier bug' warning 2019-03-21 9:33 ` Paul Chaignon @ 2019-03-26 20:07 ` Alexei Starovoitov 0 siblings, 0 replies; 6+ messages in thread From: Alexei Starovoitov @ 2019-03-26 20:07 UTC (permalink / raw) To: Paul Chaignon Cc: Yonghong Song, Alexei Starovoitov, Daniel Borkmann, netdev, bpf, Jakub Kicinski, xiao.han, paul.chaignon, Martin KaFai Lau, Song Liu On Thu, Mar 21, 2019 at 10:33:06AM +0100, Paul Chaignon wrote: > On Wed, Mar 20, 2019 at 11:31PM, Yonghong Song wrote: > > On 3/20/19 5:57 AM, Paul Chaignon wrote: > > > The BPF verifier checks the maximum number of call stack frames twice, > > > first in the main CFG traversal (do_check) and then in a subsequent > > > traversal (check_max_stack_depth). If the second check fails, it logs a > > > 'verifier bug' warning and errors out, as the number of call stack frames > > > should have been verified already. > > > > > > However, the second check may fail without indicating a verifier bug: if > > > the excessive function calls reside in dead code, the main CFG traversal > > > may not visit them; the subsequent traversal visits all instructions, > > > including dead code. > > > > > > This case raises the question of how invalid dead code should be treated. > > > > Maybe we should do this check after dead code elimination to be > > consistent with do_check? There could some other kinds of illegal stuff > > To be clear, are you suggesting we run check_max_stack_depth after the > dead code elimination? That would indeed solve this issue, but Jakub made > the exact reverse change not so long ago, in 9b38c40 ("bpf: verifier: > reorder stack size check with dead code sanitization"). I think the idea > was to avoid having code modifications in between code checks. I think it's fine fix as it is. I've applied it to bpf tree, since the verifier shouldn't be warning like this. As far as changing the order back I think it's good to keep 'too many frames' check before dead code elimination. 'too many frames' is similar to 'too many instructions'. The verifier rejects large programs before removing dead code. So in that sense it's similar. ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2019-03-26 20:07 UTC | newest] Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2019-03-20 12:57 [PATCH bpf-next 0/2] bpf: remove incorrect 'verifier bug' warning Paul Chaignon 2019-03-20 12:58 ` [PATCH bpf-next 1/2] " Paul Chaignon 2019-03-20 12:58 ` [PATCH bpf-next 2/2] selftests/bpf: test case for invalid call stack in dead code Paul Chaignon 2019-03-20 23:31 ` [PATCH bpf-next 0/2] bpf: remove incorrect 'verifier bug' warning Yonghong Song 2019-03-21 9:33 ` Paul Chaignon 2019-03-26 20:07 ` Alexei Starovoitov
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).