* [PATCH] bpf: skip invalid kfunc call in backtrack_insn
@ 2023-01-04 1:47 Hao Sun
2023-01-04 16:55 ` Yonghong Song
2023-01-06 18:00 ` patchwork-bot+netdevbpf
0 siblings, 2 replies; 3+ messages in thread
From: Hao Sun @ 2023-01-04 1:47 UTC (permalink / raw)
To: bpf
Cc: ast, daniel, john.fastabend, andrii, martin.lau, song, yhs,
kpsingh, sdf, haoluo, jolsa, davem, linux-kernel, Hao Sun
The verifier skips invalid kfunc call in check_kfunc_call(), which
would be captured in fixup_kfunc_call() if such insn is not
eliminated by dead code elimination. However, this can lead to the
following warning in backtrack_insn(), alse see [1]:
------------[ cut here ]------------
verifier backtracking bug
WARNING: CPU: 6 PID: 8646 at kernel/bpf/verifier.c:2756 backtrack_insn
kernel/bpf/verifier.c:2756
__mark_chain_precision kernel/bpf/verifier.c:3065
mark_chain_precision kernel/bpf/verifier.c:3165
adjust_reg_min_max_vals kernel/bpf/verifier.c:10715
check_alu_op kernel/bpf/verifier.c:10928
do_check kernel/bpf/verifier.c:13821 [inline]
do_check_common kernel/bpf/verifier.c:16289
...
So make backtracking conservative with this by returning ENOTSUPP.
[1] https://lore.kernel.org/bpf/CACkBjsaXNceR8ZjkLG=dT3P=4A8SBsg0Z5h5PWLryF5=ghKq=g@mail.gmail.com/
Signed-off-by: Hao Sun <sunhao.th@gmail.com>
---
kernel/bpf/verifier.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 4a25375ebb0d..04887b1e4178 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -2750,6 +2750,12 @@ static int backtrack_insn(struct bpf_verifier_env *env, int idx,
*/
if (insn->src_reg == 0 && is_callback_calling_function(insn->imm))
return -ENOTSUPP;
+ /* kfunc with imm==0 is invalid and fixup_kfunc_call will
+ * catch this error later. Make backtracking conservative
+ * with ENOTSUPP.
+ */
+ if (insn->src_reg == BPF_PSEUDO_KFUNC_CALL && insn->imm == 0)
+ return -ENOTSUPP;
/* regular helper call sets R0 */
*reg_mask &= ~1;
if (*reg_mask & 0x3f) {
base-commit: acd3b7768048fe338248cdf43ccfbf8c084a6bc1
--
2.39.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] bpf: skip invalid kfunc call in backtrack_insn
2023-01-04 1:47 [PATCH] bpf: skip invalid kfunc call in backtrack_insn Hao Sun
@ 2023-01-04 16:55 ` Yonghong Song
2023-01-06 18:00 ` patchwork-bot+netdevbpf
1 sibling, 0 replies; 3+ messages in thread
From: Yonghong Song @ 2023-01-04 16:55 UTC (permalink / raw)
To: Hao Sun, bpf
Cc: ast, daniel, john.fastabend, andrii, martin.lau, song, yhs,
kpsingh, sdf, haoluo, jolsa, davem, linux-kernel
On 1/3/23 5:47 PM, Hao Sun wrote:
> The verifier skips invalid kfunc call in check_kfunc_call(), which
> would be captured in fixup_kfunc_call() if such insn is not
> eliminated by dead code elimination. However, this can lead to the
> following warning in backtrack_insn(), alse see [1]:
>
> ------------[ cut here ]------------
> verifier backtracking bug
> WARNING: CPU: 6 PID: 8646 at kernel/bpf/verifier.c:2756 backtrack_insn
> kernel/bpf/verifier.c:2756
> __mark_chain_precision kernel/bpf/verifier.c:3065
> mark_chain_precision kernel/bpf/verifier.c:3165
> adjust_reg_min_max_vals kernel/bpf/verifier.c:10715
> check_alu_op kernel/bpf/verifier.c:10928
> do_check kernel/bpf/verifier.c:13821 [inline]
> do_check_common kernel/bpf/verifier.c:16289
> ...
>
> So make backtracking conservative with this by returning ENOTSUPP.
>
> [1] https://lore.kernel.org/bpf/CACkBjsaXNceR8ZjkLG=dT3P=4A8SBsg0Z5h5PWLryF5=ghKq=g@mail.gmail.com/
>
> Signed-off-by: Hao Sun <sunhao.th@gmail.com>
Acked-by: Yonghong Song <yhs@fb.com>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] bpf: skip invalid kfunc call in backtrack_insn
2023-01-04 1:47 [PATCH] bpf: skip invalid kfunc call in backtrack_insn Hao Sun
2023-01-04 16:55 ` Yonghong Song
@ 2023-01-06 18:00 ` patchwork-bot+netdevbpf
1 sibling, 0 replies; 3+ messages in thread
From: patchwork-bot+netdevbpf @ 2023-01-06 18:00 UTC (permalink / raw)
To: Hao Sun
Cc: bpf, ast, daniel, john.fastabend, andrii, martin.lau, song, yhs,
kpsingh, sdf, haoluo, jolsa, davem, linux-kernel
Hello:
This patch was applied to bpf/bpf.git (master)
by Daniel Borkmann <daniel@iogearbox.net>:
On Wed, 4 Jan 2023 09:47:09 +0800 you wrote:
> The verifier skips invalid kfunc call in check_kfunc_call(), which
> would be captured in fixup_kfunc_call() if such insn is not
> eliminated by dead code elimination. However, this can lead to the
> following warning in backtrack_insn(), alse see [1]:
>
> ------------[ cut here ]------------
> verifier backtracking bug
> WARNING: CPU: 6 PID: 8646 at kernel/bpf/verifier.c:2756 backtrack_insn
> kernel/bpf/verifier.c:2756
> __mark_chain_precision kernel/bpf/verifier.c:3065
> mark_chain_precision kernel/bpf/verifier.c:3165
> adjust_reg_min_max_vals kernel/bpf/verifier.c:10715
> check_alu_op kernel/bpf/verifier.c:10928
> do_check kernel/bpf/verifier.c:13821 [inline]
> do_check_common kernel/bpf/verifier.c:16289
> ...
>
> [...]
Here is the summary with links:
- bpf: skip invalid kfunc call in backtrack_insn
https://git.kernel.org/bpf/bpf/c/d3178e8a434b
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2023-01-06 18:00 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-01-04 1:47 [PATCH] bpf: skip invalid kfunc call in backtrack_insn Hao Sun
2023-01-04 16:55 ` Yonghong Song
2023-01-06 18:00 ` patchwork-bot+netdevbpf
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).