From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: Po-Hsu Lin <po-hsu.lin@canonical.com>
Cc: linux-kernel@vger.kernel.org, stable@vger.kernel.org,
Kumar Kartikeya Dwivedi <memxor@gmail.com>,
Alexei Starovoitov <ast@kernel.org>
Subject: Re: [PATCH 5.15 33/33] selftests/bpf: Add test for reg2btf_ids out of bounds access
Date: Fri, 24 Jun 2022 13:09:26 +0200 [thread overview]
Message-ID: <YrWbZi7jt1x83tRC@kroah.com> (raw)
In-Reply-To: <CAMy_GT9YbgqsoLbCDqhHpXNW6EejgK+YaE4YPxpxcmer+qn-1g@mail.gmail.com>
On Fri, Jun 24, 2022 at 06:33:57PM +0800, Po-Hsu Lin wrote:
> On Fri, Apr 29, 2022 at 6:47 PM Greg Kroah-Hartman
> <gregkh@linuxfoundation.org> wrote:
> >
> > From: Kumar Kartikeya Dwivedi <memxor@gmail.com>
> >
> > commit 13c6a37d409db9abc9c0bfc6d0a2f07bf0fff60e upstream.
> >
> > This test tries to pass a PTR_TO_BTF_ID_OR_NULL to the release function,
> > which would trigger a out of bounds access without the fix in commit
> > 45ce4b4f9009 ("bpf: Fix crash due to out of bounds access into reg2btf_ids.")
> > but after the fix, it should only index using base_type(reg->type),
> > which should be less than __BPF_REG_TYPE_MAX, and also not permit any
> > type flags to be set for the reg->type.
> >
> > Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
> > Signed-off-by: Alexei Starovoitov <ast@kernel.org>
> > Link: https://lore.kernel.org/bpf/20220220023138.2224652-1-memxor@gmail.com
> > Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> > ---
> > tools/testing/selftests/bpf/verifier/calls.c | 19 +++++++++++++++++++
> > 1 file changed, 19 insertions(+)
> >
> > --- a/tools/testing/selftests/bpf/verifier/calls.c
> > +++ b/tools/testing/selftests/bpf/verifier/calls.c
> > @@ -108,6 +108,25 @@
> > .errstr = "R0 min value is outside of the allowed memory range",
> > },
> > {
> > + "calls: trigger reg2btf_ids[reg->type] for reg->type > __BPF_REG_TYPE_MAX",
> > + .insns = {
> > + BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
> > + BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
> > + BPF_ST_MEM(BPF_DW, BPF_REG_1, 0, 0),
> > + BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, BPF_PSEUDO_KFUNC_CALL, 0, 0),
> > + BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
> > + BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, BPF_PSEUDO_KFUNC_CALL, 0, 0),
> > + BPF_EXIT_INSN(),
> > + },
> > + .prog_type = BPF_PROG_TYPE_SCHED_CLS,
> > + .result = REJECT,
> > + .errstr = "arg#0 pointer type STRUCT prog_test_ref_kfunc must point",
> > + .fixup_kfunc_btf_id = {
> > + { "bpf_kfunc_call_test_acquire", 3 },
> > + { "bpf_kfunc_call_test_release", 5 },
> > + },
> > +},
> > +{
> > "calls: overlapping caller/callee",
> > .insns = {
> > BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 1, 0, 0),
> >
> >
>
> Hello Greg,
>
> When I tried to build the bpf selftest from 5.15.49 source tree on a
> Ubuntu Jammy instance running with 5.15.49-051549-generic, I got the
> following error message:
>
> In file included from
> /home/ubuntu/linux/tools/testing/selftests/bpf/verifier/tests.h:21,
> from test_verifier.c:432:
> /home/ubuntu/linux/tools/testing/selftests/bpf/verifier/calls.c:124:10:
> error: ‘struct bpf_test’ has no member named ‘fixup_kfunc_btf_id’
> 124 | .fixup_kfunc_btf_id = {
> | ^~~~~~~~~~~~~~~~~~
> /home/ubuntu/linux/tools/testing/selftests/bpf/verifier/calls.c:124:9:
> warning: braces around scalar initializer
> 124 | .fixup_kfunc_btf_id = {
> | ^
> /home/ubuntu/linux/tools/testing/selftests/bpf/verifier/calls.c:124:9:
> note: (near initialization for ‘tests[150].errstr_unpriv’)
> /home/ubuntu/linux/tools/testing/selftests/bpf/verifier/calls.c:125:17:
> warning: braces around scalar initializer
> 125 | { "bpf_kfunc_call_test_acquire", 3 },
> | ^
> /home/ubuntu/linux/tools/testing/selftests/bpf/verifier/calls.c:125:17:
> note: (near initialization for ‘tests[150].errstr_unpriv’)
> /home/ubuntu/linux/tools/testing/selftests/bpf/verifier/calls.c:125:50:
> warning: excess elements in scalar initializer
> 125 | { "bpf_kfunc_call_test_acquire", 3 },
> | ^
> /home/ubuntu/linux/tools/testing/selftests/bpf/verifier/calls.c:125:50:
> note: (near initialization for ‘tests[150].errstr_unpriv’)
> /home/ubuntu/linux/tools/testing/selftests/bpf/verifier/calls.c:126:17:
> warning: braces around scalar initializer
> 126 | { "bpf_kfunc_call_test_release", 5 },
> | ^
> /home/ubuntu/linux/tools/testing/selftests/bpf/verifier/calls.c:126:17:
> note: (near initialization for ‘tests[150].errstr_unpriv’)
> /home/ubuntu/linux/tools/testing/selftests/bpf/verifier/calls.c:126:50:
> warning: excess elements in scalar initializer
> 126 | { "bpf_kfunc_call_test_release", 5 },
> | ^
> /home/ubuntu/linux/tools/testing/selftests/bpf/verifier/calls.c:126:50:
> note: (near initialization for ‘tests[150].errstr_unpriv’)
> /home/ubuntu/linux/tools/testing/selftests/bpf/verifier/calls.c:126:17:
> warning: excess elements in scalar initializer
> 126 | { "bpf_kfunc_call_test_release", 5 },
> | ^
> /home/ubuntu/linux/tools/testing/selftests/bpf/verifier/calls.c:126:17:
> note: (near initialization for ‘tests[150].errstr_unpriv’)
> make: *** [Makefile:508:
> /home/ubuntu/linux/tools/testing/selftests/bpf/test_verifier] Error 1
>
> Which is introduced by this commit f59e6886c "selftests/bpf: Add test
> for reg2btf_ids out of bounds access" on 5.15. With this commit
> reverted, there will be another error in progs/timer_crash.c like in
> 5.10 [1]:
>
> progs/timer_crash.c:8:19: error: field has incomplete type 'struct bpf_timer'
> struct bpf_timer timer;
> ^
> /home/ubuntu/linux/tools/testing/selftests/bpf/tools/include/bpf/bpf_helper_defs.h:39:8:
> note: forward declaration of 'struct bpf_timer'
> struct bpf_timer;
> ^
> 1 error generated.
>
> Maybe commit "selftests/bpf: Add test for bpf_timer overwriting crash"
> should be reverted on 5.15 as well.
Should the test be fixed instead?
I'll take patches for either, thanks.
greg k-h
next prev parent reply other threads:[~2022-06-24 11:44 UTC|newest]
Thread overview: 43+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-04-29 10:41 [PATCH 5.15 00/33] 5.15.37-rc1 review Greg Kroah-Hartman
2022-04-29 10:41 ` [PATCH 5.15 01/33] floppy: disable FDRAWCMD by default Greg Kroah-Hartman
2022-04-29 10:41 ` [PATCH 5.15 02/33] bpf: Introduce composable reg, ret and arg types Greg Kroah-Hartman
2022-04-29 10:41 ` [PATCH 5.15 03/33] bpf: Replace ARG_XXX_OR_NULL with ARG_XXX | PTR_MAYBE_NULL Greg Kroah-Hartman
2022-04-29 10:41 ` [PATCH 5.15 04/33] bpf: Replace RET_XXX_OR_NULL with RET_XXX " Greg Kroah-Hartman
2022-04-29 10:41 ` [PATCH 5.15 05/33] bpf: Replace PTR_TO_XXX_OR_NULL with PTR_TO_XXX " Greg Kroah-Hartman
2022-04-29 10:41 ` [PATCH 5.15 06/33] bpf: Introduce MEM_RDONLY flag Greg Kroah-Hartman
2022-04-29 10:41 ` [PATCH 5.15 07/33] bpf: Convert PTR_TO_MEM_OR_NULL to composable types Greg Kroah-Hartman
2022-04-29 10:41 ` [PATCH 5.15 08/33] bpf: Make per_cpu_ptr return rdonly PTR_TO_MEM Greg Kroah-Hartman
2022-04-29 10:41 ` [PATCH 5.15 09/33] bpf: Add MEM_RDONLY for helper args that are pointers to rdonly mem Greg Kroah-Hartman
2022-04-29 10:41 ` [PATCH 5.15 10/33] bpf/selftests: Test PTR_TO_RDONLY_MEM Greg Kroah-Hartman
2022-04-29 10:41 ` [PATCH 5.15 11/33] bpf: Fix crash due to out of bounds access into reg2btf_ids Greg Kroah-Hartman
2022-04-29 10:41 ` [PATCH 5.15 12/33] spi: cadence-quadspi: fix write completion support Greg Kroah-Hartman
2022-04-29 10:42 ` [PATCH 5.15 13/33] ARM: dts: socfpga: change qspi to "intel,socfpga-qspi" Greg Kroah-Hartman
2022-04-29 10:42 ` [PATCH 5.15 14/33] mm: kfence: fix objcgs vector allocation Greg Kroah-Hartman
2022-04-29 10:42 ` [PATCH 5.15 15/33] gup: Turn fault_in_pages_{readable,writeable} into fault_in_{readable,writeable} Greg Kroah-Hartman
2022-04-29 10:42 ` [PATCH 5.15 16/33] iov_iter: Turn iov_iter_fault_in_readable into fault_in_iov_iter_readable Greg Kroah-Hartman
2022-04-29 10:42 ` [PATCH 5.15 17/33] iov_iter: Introduce fault_in_iov_iter_writeable Greg Kroah-Hartman
2022-04-29 10:42 ` [PATCH 5.15 18/33] gfs2: Add wrapper for iomap_file_buffered_write Greg Kroah-Hartman
2022-04-29 10:42 ` [PATCH 5.15 19/33] gfs2: Clean up function may_grant Greg Kroah-Hartman
2022-04-29 10:42 ` [PATCH 5.15 20/33] gfs2: Introduce flag for glock holder auto-demotion Greg Kroah-Hartman
2022-04-29 10:42 ` [PATCH 5.15 21/33] gfs2: Move the inode glock locking to gfs2_file_buffered_write Greg Kroah-Hartman
2022-04-29 10:42 ` [PATCH 5.15 22/33] gfs2: Eliminate ip->i_gh Greg Kroah-Hartman
2022-04-29 10:42 ` [PATCH 5.15 23/33] gfs2: Fix mmap + page fault deadlocks for buffered I/O Greg Kroah-Hartman
2022-04-29 10:42 ` [PATCH 5.15 24/33] iomap: Fix iomap_dio_rw return value for user copies Greg Kroah-Hartman
2022-04-29 10:42 ` [PATCH 5.15 25/33] iomap: Support partial direct I/O on user copy failures Greg Kroah-Hartman
2022-04-29 10:42 ` [PATCH 5.15 26/33] iomap: Add done_before argument to iomap_dio_rw Greg Kroah-Hartman
2022-04-29 10:42 ` [PATCH 5.15 27/33] gup: Introduce FOLL_NOFAULT flag to disable page faults Greg Kroah-Hartman
2022-04-29 10:42 ` [PATCH 5.15 28/33] iov_iter: Introduce nofault " Greg Kroah-Hartman
2022-04-29 10:42 ` [PATCH 5.15 29/33] gfs2: Fix mmap + page fault deadlocks for direct I/O Greg Kroah-Hartman
2022-04-29 10:42 ` [PATCH 5.15 30/33] btrfs: fix deadlock due to page faults during direct IO reads and writes Greg Kroah-Hartman
2022-04-29 10:42 ` [PATCH 5.15 31/33] btrfs: fallback to blocking mode when doing async dio over multiple extents Greg Kroah-Hartman
2022-04-29 10:42 ` [PATCH 5.15 32/33] mm: gup: make fault_in_safe_writeable() use fixup_user_fault() Greg Kroah-Hartman
2022-04-29 10:42 ` [PATCH 5.15 33/33] selftests/bpf: Add test for reg2btf_ids out of bounds access Greg Kroah-Hartman
2022-06-24 10:33 ` Po-Hsu Lin
2022-06-24 11:09 ` Greg Kroah-Hartman [this message]
2022-07-01 12:51 ` Po-Hsu Lin
2022-04-29 16:39 ` [PATCH 5.15 00/33] 5.15.37-rc1 review Florian Fainelli
2022-04-29 18:36 ` Shuah Khan
2022-04-29 21:14 ` Naresh Kamboju
2022-04-29 23:47 ` Guenter Roeck
2022-04-29 23:54 ` Ron Economos
2022-04-30 10:17 ` Sudip Mukherjee
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=YrWbZi7jt1x83tRC@kroah.com \
--to=gregkh@linuxfoundation.org \
--cc=ast@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=memxor@gmail.com \
--cc=po-hsu.lin@canonical.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).