From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Martin KaFai Lau <kafai@fb.com>, Joe Stringer <joe@wand.net.nz>,
Alexei Starovoitov <ast@kernel.org>,
Sasha Levin <sashal@kernel.org>
Subject: [PATCH AUTOSEL 4.20 06/60] bpf: Fix narrow load on a bpf_sock returned from sk_lookup()
Date: Wed, 13 Mar 2019 15:09:27 -0400 [thread overview]
Message-ID: <20190313191021.158171-6-sashal@kernel.org> (raw)
In-Reply-To: <20190313191021.158171-1-sashal@kernel.org>
From: Martin KaFai Lau <kafai@fb.com>
[ Upstream commit d623876646be119439999a229a2c3ce30fd197fb ]
By adding this test to test_verifier:
{
"reference tracking: access sk->src_ip4 (narrow load)",
.insns = {
BPF_SK_LOOKUP,
BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
BPF_LDX_MEM(BPF_H, BPF_REG_2, BPF_REG_0, offsetof(struct bpf_sock, src_ip4) + 2),
BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
BPF_EMIT_CALL(BPF_FUNC_sk_release),
BPF_EXIT_INSN(),
},
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
.result = ACCEPT,
},
The above test loads 2 bytes from sk->src_ip4 where
sk is obtained by bpf_sk_lookup_tcp().
It hits an internal verifier error from convert_ctx_accesses():
[root@arch-fb-vm1 bpf]# ./test_verifier 665 665
Failed to load prog 'Invalid argument'!
0: (b7) r2 = 0
1: (63) *(u32 *)(r10 -8) = r2
2: (7b) *(u64 *)(r10 -16) = r2
3: (7b) *(u64 *)(r10 -24) = r2
4: (7b) *(u64 *)(r10 -32) = r2
5: (7b) *(u64 *)(r10 -40) = r2
6: (7b) *(u64 *)(r10 -48) = r2
7: (bf) r2 = r10
8: (07) r2 += -48
9: (b7) r3 = 36
10: (b7) r4 = 0
11: (b7) r5 = 0
12: (85) call bpf_sk_lookup_tcp#84
13: (bf) r6 = r0
14: (15) if r0 == 0x0 goto pc+3
R0=sock(id=1,off=0,imm=0) R6=sock(id=1,off=0,imm=0) R10=fp0,call_-1 fp-8=????0000 fp-16=0000mmmm fp-24=mmmmmmmm fp-32=mmmmmmmm fp-40=mmmmmmmm fp-48=mmmmmmmm refs=1
15: (69) r2 = *(u16 *)(r0 +26)
16: (bf) r1 = r6
17: (85) call bpf_sk_release#86
18: (95) exit
from 14 to 18: safe
processed 20 insns (limit 131072), stack depth 48
bpf verifier is misconfigured
Summary: 0 PASSED, 0 SKIPPED, 1 FAILED
The bpf_sock_is_valid_access() is expecting src_ip4 can be narrowly
loaded (meaning load any 1 or 2 bytes of the src_ip4) by
marking info->ctx_field_size. However, this marked
ctx_field_size is not used. This patch fixes it.
Due to the recent refactoring in test_verifier,
this new test will be added to the bpf-next branch
(together with the bpf_tcp_sock patchset)
to avoid merge conflict.
Fixes: c64b7983288e ("bpf: Add PTR_TO_SOCKET verifier type")
Cc: Joe Stringer <joe@wand.net.nz>
Signed-off-by: Martin KaFai Lau <kafai@fb.com>
Acked-by: Joe Stringer <joe@wand.net.nz>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/verifier.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 63a9253679f2..c0fb76d1e771 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -1533,12 +1533,13 @@ static int check_flow_keys_access(struct bpf_verifier_env *env, int off,
return 0;
}
-static int check_sock_access(struct bpf_verifier_env *env, u32 regno, int off,
- int size, enum bpf_access_type t)
+static int check_sock_access(struct bpf_verifier_env *env, int insn_idx,
+ u32 regno, int off, int size,
+ enum bpf_access_type t)
{
struct bpf_reg_state *regs = cur_regs(env);
struct bpf_reg_state *reg = ®s[regno];
- struct bpf_insn_access_aux info;
+ struct bpf_insn_access_aux info = {};
if (reg->smin_value < 0) {
verbose(env, "R%d min value is negative, either use unsigned index or do a if (index >=0) check.\n",
@@ -1552,6 +1553,8 @@ static int check_sock_access(struct bpf_verifier_env *env, u32 regno, int off,
return -EACCES;
}
+ env->insn_aux_data[insn_idx].ctx_field_size = info.ctx_field_size;
+
return 0;
}
@@ -1948,7 +1951,7 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
verbose(env, "cannot write into socket\n");
return -EACCES;
}
- err = check_sock_access(env, regno, off, size, t);
+ err = check_sock_access(env, insn_idx, regno, off, size, t);
if (!err && value_regno >= 0)
mark_reg_unknown(env, regs, value_regno);
} else {
--
2.19.1
next prev parent reply other threads:[~2019-03-13 19:10 UTC|newest]
Thread overview: 62+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-03-13 19:09 [PATCH AUTOSEL 4.20 01/60] clk: sunxi-ng: v3s: Fix TCON reset de-assert bit Sasha Levin
2019-03-13 19:09 ` [PATCH AUTOSEL 4.20 02/60] kallsyms: Handle too long symbols in kallsyms.c Sasha Levin
2019-03-13 19:09 ` [PATCH AUTOSEL 4.20 03/60] clk: sunxi: A31: Fix wrong AHB gate number Sasha Levin
2019-03-13 19:09 ` [PATCH AUTOSEL 4.20 04/60] esp: Skip TX bytes accounting when sending from a request socket Sasha Levin
2019-03-13 19:09 ` [PATCH AUTOSEL 4.20 05/60] ARM: 8824/1: fix a migrating irq bug when hotplug cpu Sasha Levin
2019-03-13 19:09 ` Sasha Levin [this message]
2019-03-13 19:09 ` [PATCH AUTOSEL 4.20 07/60] bpf: only adjust gso_size on bytestream protocols Sasha Levin
2019-03-13 19:09 ` [PATCH AUTOSEL 4.20 08/60] bpf: fix lockdep false positive in stackmap Sasha Levin
2019-03-13 19:09 ` [PATCH AUTOSEL 4.20 09/60] af_key: unconditionally clone on broadcast Sasha Levin
2019-03-13 19:09 ` [PATCH AUTOSEL 4.20 10/60] ARM: 8835/1: dma-mapping: Clear DMA ops on teardown Sasha Levin
2019-03-13 19:09 ` [PATCH AUTOSEL 4.20 11/60] sh: fix build error for invisible CONFIG_BUILTIN_DTB_SOURCE Sasha Levin
2019-03-13 19:09 ` [PATCH AUTOSEL 4.20 12/60] assoc_array: Fix shortcut creation Sasha Levin
2019-03-13 19:09 ` [PATCH AUTOSEL 4.20 13/60] keys: Fix dependency loop between construction record and auth key Sasha Levin
2019-03-13 19:09 ` [PATCH AUTOSEL 4.20 14/60] scsi: libiscsi: Fix race between iscsi_xmit_task and iscsi_complete_task Sasha Levin
2019-03-13 19:09 ` [PATCH AUTOSEL 4.20 15/60] net: systemport: Fix reception of BPDUs Sasha Levin
2019-03-13 19:09 ` [PATCH AUTOSEL 4.20 16/60] net: dsa: bcm_sf2: Do not assume DSA master supports WoL Sasha Levin
2019-03-13 19:09 ` [PATCH AUTOSEL 4.20 17/60] pinctrl: meson: meson8b: fix the sdxc_a data 1..3 pins Sasha Levin
2019-03-13 19:09 ` [PATCH AUTOSEL 4.20 18/60] qmi_wwan: apply SET_DTR quirk to Sierra WP7607 Sasha Levin
2019-03-13 19:09 ` [PATCH AUTOSEL 4.20 19/60] net: mv643xx_eth: disable clk on error path in mv643xx_eth_shared_probe() Sasha Levin
2019-03-13 19:09 ` [PATCH AUTOSEL 4.20 20/60] xfrm: Fix inbound traffic via XFRM interfaces across network namespaces Sasha Levin
2019-03-13 19:09 ` [PATCH AUTOSEL 4.20 21/60] arm64: fix SSBS sanitization Sasha Levin
2019-03-13 19:09 ` [PATCH AUTOSEL 4.20 22/60] mailbox: bcm-flexrm-mailbox: Fix FlexRM ring flush timeout issue Sasha Levin
2019-03-13 19:09 ` [PATCH AUTOSEL 4.20 23/60] ASoC: topology: free created components in tplg load error Sasha Levin
2019-03-13 19:09 ` [PATCH AUTOSEL 4.20 24/60] bpf/test_run: fix unkillable BPF_PROG_TEST_RUN Sasha Levin
2019-03-13 19:09 ` [PATCH AUTOSEL 4.20 25/60] qed: Fix iWARP buffer size provided for syn packet processing Sasha Levin
2019-03-13 19:09 ` [PATCH AUTOSEL 4.20 26/60] qed: Fix iWARP syn packet mac address validation Sasha Levin
2019-03-13 19:09 ` [PATCH AUTOSEL 4.20 27/60] ARM: dts: armada-xp: fix Armada XP boards NAND description Sasha Levin
2019-03-13 19:09 ` [PATCH AUTOSEL 4.20 28/60] ARM: dts: am335x-evmsk: Fix PHY mode for ethernet Sasha Levin
2019-03-13 19:09 ` [PATCH AUTOSEL 4.20 29/60] ARM: dts: am335x-evm: " Sasha Levin
2019-03-13 19:09 ` [PATCH AUTOSEL 4.20 30/60] arm64: Relax GIC version check during early boot Sasha Levin
2019-03-13 19:09 ` [PATCH AUTOSEL 4.20 31/60] ARM: tegra: Restore DT ABI on Tegra124 Chromebooks Sasha Levin
2019-03-13 19:09 ` [PATCH AUTOSEL 4.20 32/60] drm/amd/display: Fix negative cursor pos programming Sasha Levin
2019-03-13 19:09 ` [PATCH AUTOSEL 4.20 33/60] net: marvell: mvneta: fix DMA debug warning Sasha Levin
2019-03-13 19:09 ` [PATCH AUTOSEL 4.20 34/60] kasan, slub: move kasan_poison_slab hook before page_address Sasha Levin
2019-03-13 19:09 ` [PATCH AUTOSEL 4.20 35/60] mm: handle lru_add_drain_all for UP properly Sasha Levin
2019-03-13 19:09 ` [PATCH AUTOSEL 4.20 36/60] psi: avoid divide-by-zero crash inside virtual machines Sasha Levin
2019-03-13 19:09 ` [PATCH AUTOSEL 4.20 37/60] tmpfs: fix link accounting when a tmpfile is linked in Sasha Levin
2019-03-13 19:58 ` Hugh Dickins
2019-03-19 20:07 ` Sasha Levin
2019-03-13 19:09 ` [PATCH AUTOSEL 4.20 38/60] kasan, slab: fix conflicts with CONFIG_HARDENED_USERCOPY Sasha Levin
2019-03-13 19:10 ` [PATCH AUTOSEL 4.20 39/60] kasan, slab: make freelist stored without tags Sasha Levin
2019-03-13 19:10 ` [PATCH AUTOSEL 4.20 40/60] ixgbe: fix older devices that do not support IXGBE_MRQC_L3L4TXSWEN Sasha Levin
2019-03-13 19:10 ` [PATCH AUTOSEL 4.20 41/60] i40e: fix potential RX buffer starvation for AF_XDP Sasha Levin
2019-03-13 19:10 ` [PATCH AUTOSEL 4.20 42/60] ixgbe: " Sasha Levin
2019-03-13 19:10 ` [PATCH AUTOSEL 4.20 43/60] ARCv2: lib: memcpy: fix doing prefetchw outside of buffer Sasha Levin
2019-03-13 19:10 ` [PATCH AUTOSEL 4.20 44/60] ARC: uacces: remove lp_start, lp_end from clobber list Sasha Levin
2019-03-13 19:10 ` [PATCH AUTOSEL 4.20 45/60] ARCv2: support manual regfile save on interrupts Sasha Levin
2019-03-13 19:10 ` [PATCH AUTOSEL 4.20 46/60] i40e: fix XDP_REDIRECT/XDP xmit ring cleanup race Sasha Levin
2019-03-13 19:10 ` [PATCH AUTOSEL 4.20 47/60] ixgbe: don't do any AF_XDP zero-copy transmit if netif is not OK Sasha Levin
2019-03-13 19:10 ` [PATCH AUTOSEL 4.20 48/60] ARCv2: don't assume core 0x54 has dual issue Sasha Levin
2019-03-13 19:10 ` [PATCH AUTOSEL 4.20 49/60] phonet: fix building with clang Sasha Levin
2019-03-13 19:10 ` [PATCH AUTOSEL 4.20 50/60] mac80211_hwsim: propagate genlmsg_reply return code Sasha Levin
2019-03-13 19:10 ` [PATCH AUTOSEL 4.20 51/60] bpf, lpm: fix lookup bug in map_delete_elem Sasha Levin
2019-03-13 19:10 ` [PATCH AUTOSEL 4.20 52/60] net: thunderx: make CFG_DONE message to run through generic send-ack sequence Sasha Levin
2019-03-13 19:10 ` [PATCH AUTOSEL 4.20 53/60] net: thunderx: add nicvf_send_msg_to_pf result check for set_rx_mode_task Sasha Levin
2019-03-13 19:10 ` [PATCH AUTOSEL 4.20 54/60] nfp: bpf: fix code-gen bug on BPF_ALU | BPF_XOR | BPF_K Sasha Levin
2019-03-13 19:10 ` [PATCH AUTOSEL 4.20 55/60] nfp: bpf: fix ALU32 high bits clearance bug Sasha Levin
2019-03-13 19:10 ` [PATCH AUTOSEL 4.20 56/60] bnxt_en: Fix typo in firmware message timeout logic Sasha Levin
2019-03-13 19:10 ` [PATCH AUTOSEL 4.20 57/60] bnxt_en: Wait longer for the firmware message response to complete Sasha Levin
2019-03-13 19:10 ` [PATCH AUTOSEL 4.20 58/60] mdio_bus: Fix use-after-free on device_register fails Sasha Levin
2019-03-13 19:10 ` [PATCH AUTOSEL 4.20 59/60] net: set static variable an initial value in atl2_probe() Sasha Levin
2019-03-13 19:10 ` [PATCH AUTOSEL 4.20 60/60] selftests: fib_tests: sleep after changing carrier. again Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190313191021.158171-6-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=ast@kernel.org \
--cc=joe@wand.net.nz \
--cc=kafai@fb.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).