* [PATCH net-next] ebpf: Allow dereferences of PTR_TO_STACK registers
@ 2015-07-23 21:24 Alex Gartrell
2015-07-23 21:47 ` Alexei Starovoitov
2015-07-27 7:54 ` David Miller
0 siblings, 2 replies; 3+ messages in thread
From: Alex Gartrell @ 2015-07-23 21:24 UTC (permalink / raw)
To: davem, ast; +Cc: daniel, netdev, kernel-team, Alex Gartrell
mov %rsp, %r1 ; r1 = rsp
add $-8, %r1 ; r1 = rsp - 8
store_q $123, -8(%rsp) ; *(u64*)r1 = 123 <- valid
store_q $123, (%r1) ; *(u64*)r1 = 123 <- previously invalid
mov $0, %r0
exit ; Always need to exit
And we'd get the following error:
0: (bf) r1 = r10
1: (07) r1 += -8
2: (7a) *(u64 *)(r10 -8) = 999
3: (7a) *(u64 *)(r1 +0) = 999
R1 invalid mem access 'fp'
Unable to load program
We already know that a register is a stack address and the appropriate
offset, so we should be able to validate those references as well.
Signed-off-by: Alex Gartrell <agartrell@fb.com>
---
kernel/bpf/verifier.c | 6 ++++-
samples/bpf/test_verifier.c | 59 +++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 64 insertions(+), 1 deletion(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 039d866..cd307df 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -648,6 +648,9 @@ static int check_mem_access(struct verifier_env *env, u32 regno, int off,
struct verifier_state *state = &env->cur_state;
int size, err = 0;
+ if (state->regs[regno].type == PTR_TO_STACK)
+ off += state->regs[regno].imm;
+
size = bpf_size_to_bytes(bpf_size);
if (size < 0)
return size;
@@ -667,7 +670,8 @@ static int check_mem_access(struct verifier_env *env, u32 regno, int off,
if (!err && t == BPF_READ && value_regno >= 0)
mark_reg_unknown_value(state->regs, value_regno);
- } else if (state->regs[regno].type == FRAME_PTR) {
+ } else if (state->regs[regno].type == FRAME_PTR ||
+ state->regs[regno].type == PTR_TO_STACK) {
if (off >= 0 || off < -MAX_BPF_STACK) {
verbose("invalid stack off=%d size=%d\n", off, size);
return -EACCES;
diff --git a/samples/bpf/test_verifier.c b/samples/bpf/test_verifier.c
index 6936059..ee0f110 100644
--- a/samples/bpf/test_verifier.c
+++ b/samples/bpf/test_verifier.c
@@ -822,6 +822,65 @@ static struct bpf_test tests[] = {
.result = ACCEPT,
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
},
+ {
+ "PTR_TO_STACK store/load",
+ .insns = {
+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -10),
+ BPF_ST_MEM(BPF_DW, BPF_REG_1, 2, 0xfaceb00c),
+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 2),
+ BPF_EXIT_INSN(),
+ },
+ .result = ACCEPT,
+ },
+ {
+ "PTR_TO_STACK store/load - bad alignment on off",
+ .insns = {
+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
+ BPF_ST_MEM(BPF_DW, BPF_REG_1, 2, 0xfaceb00c),
+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 2),
+ BPF_EXIT_INSN(),
+ },
+ .result = REJECT,
+ .errstr = "misaligned access off -6 size 8",
+ },
+ {
+ "PTR_TO_STACK store/load - bad alignment on reg",
+ .insns = {
+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -10),
+ BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),
+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),
+ BPF_EXIT_INSN(),
+ },
+ .result = REJECT,
+ .errstr = "misaligned access off -2 size 8",
+ },
+ {
+ "PTR_TO_STACK store/load - out of bounds low",
+ .insns = {
+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -80000),
+ BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),
+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),
+ BPF_EXIT_INSN(),
+ },
+ .result = REJECT,
+ .errstr = "invalid stack off=-79992 size=8",
+ },
+ {
+ "PTR_TO_STACK store/load - out of bounds high",
+ .insns = {
+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
+ BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),
+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),
+ BPF_EXIT_INSN(),
+ },
+ .result = REJECT,
+ .errstr = "invalid stack off=0 size=8",
+ },
};
static int probe_filter_length(struct bpf_insn *fp)
--
Alex Gartrell <agartrell@fb.com>
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH net-next] ebpf: Allow dereferences of PTR_TO_STACK registers
2015-07-23 21:24 [PATCH net-next] ebpf: Allow dereferences of PTR_TO_STACK registers Alex Gartrell
@ 2015-07-23 21:47 ` Alexei Starovoitov
2015-07-27 7:54 ` David Miller
1 sibling, 0 replies; 3+ messages in thread
From: Alexei Starovoitov @ 2015-07-23 21:47 UTC (permalink / raw)
To: Alex Gartrell; +Cc: davem, ast, daniel, netdev, kernel-team
On Thu, Jul 23, 2015 at 02:24:40PM -0700, Alex Gartrell wrote:
> mov %rsp, %r1 ; r1 = rsp
> add $-8, %r1 ; r1 = rsp - 8
> store_q $123, -8(%rsp) ; *(u64*)r1 = 123 <- valid
> store_q $123, (%r1) ; *(u64*)r1 = 123 <- previously invalid
> mov $0, %r0
> exit ; Always need to exit
>
> And we'd get the following error:
>
> 0: (bf) r1 = r10
> 1: (07) r1 += -8
> 2: (7a) *(u64 *)(r10 -8) = 999
> 3: (7a) *(u64 *)(r1 +0) = 999
> R1 invalid mem access 'fp'
>
> Unable to load program
>
> We already know that a register is a stack address and the appropriate
> offset, so we should be able to validate those references as well.
>
> Signed-off-by: Alex Gartrell <agartrell@fb.com>
> ---
> kernel/bpf/verifier.c | 6 ++++-
> samples/bpf/test_verifier.c | 59 +++++++++++++++++++++++++++++++++++++++++++++
> 2 files changed, 64 insertions(+), 1 deletion(-)
Looks good.
Acked-by: Alexei Starovoitov <ast@plumgrid.com>
> + BPF_ST_MEM(BPF_DW, BPF_REG_1, 2, 0xfaceb00c),
nice constants :)
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH net-next] ebpf: Allow dereferences of PTR_TO_STACK registers
2015-07-23 21:24 [PATCH net-next] ebpf: Allow dereferences of PTR_TO_STACK registers Alex Gartrell
2015-07-23 21:47 ` Alexei Starovoitov
@ 2015-07-27 7:54 ` David Miller
1 sibling, 0 replies; 3+ messages in thread
From: David Miller @ 2015-07-27 7:54 UTC (permalink / raw)
To: agartrell; +Cc: ast, daniel, netdev, kernel-team
From: Alex Gartrell <agartrell@fb.com>
Date: Thu, 23 Jul 2015 14:24:40 -0700
> mov %rsp, %r1 ; r1 = rsp
> add $-8, %r1 ; r1 = rsp - 8
> store_q $123, -8(%rsp) ; *(u64*)r1 = 123 <- valid
> store_q $123, (%r1) ; *(u64*)r1 = 123 <- previously invalid
> mov $0, %r0
> exit ; Always need to exit
>
> And we'd get the following error:
>
> 0: (bf) r1 = r10
> 1: (07) r1 += -8
> 2: (7a) *(u64 *)(r10 -8) = 999
> 3: (7a) *(u64 *)(r1 +0) = 999
> R1 invalid mem access 'fp'
>
> Unable to load program
>
> We already know that a register is a stack address and the appropriate
> offset, so we should be able to validate those references as well.
>
> Signed-off-by: Alex Gartrell <agartrell@fb.com>
Applied, thanks.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2015-07-27 7:54 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-07-23 21:24 [PATCH net-next] ebpf: Allow dereferences of PTR_TO_STACK registers Alex Gartrell
2015-07-23 21:47 ` Alexei Starovoitov
2015-07-27 7:54 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).