[PATCH] bpf: fix verifier support for validation of async callbacks

[PATCH] bpf: fix verifier support for validation of async callbacks

[Kris Van Hees]

Commit bfc6bb74e4 ("bpf: Implement verifier support for validation of
async callbacks.") added support for BPF_FUNC_timer_set_callback to
the __check_func_call() function.  The test in __check_func_call() is
flaweed because it can mis-interpret a regular BPF-to-BPF pseudo-call
as a BPF_FUNC_timer_set_callback callback call.

Consider the conditional in the code:

	if (insn->code == (BPF_JMP | BPF_CALL) &&
	    insn->imm == BPF_FUNC_timer_set_callback) {

The BPF_FUNC_timer_set_callback has value 170.  This means that if you
have a BPF program that contains a pseudo-call with an instruction delta
of 170, this conditional will be found to be true by the verifier, and
it will interpret the pseudo-call as a callback.  This leads to a mess
with the verification of the program because it makes the wrong
assumptions about the nature of this call.

Solution: include an explicit check to ensure that insn->src_reg == 0.
This ensures that calls cannot be mis-interpreted as an async callback
call.

Signed-off-by: Kris Van Hees <kris.van.hees@oracle.com>
---
 kernel/bpf/verifier.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index b70c66c6db3b..a40ff2efe6be 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -6031,6 +6031,7 @@ static int __check_func_call(struct bpf_verifier_env *env, struct bpf_insn *insn
 	}
 
 	if (insn->code == (BPF_JMP | BPF_CALL) &&
+	    insn->src_reg == 0 &&
 	    insn->imm == BPF_FUNC_timer_set_callback) {
 		struct bpf_verifier_state *async_cb;
 
-- 
2.34.1

Re: [PATCH] bpf: fix verifier support for validation of async callbacks

[Alexei Starovoitov]

On Wed, Jan 5, 2022 at 1:01 PM Kris Van Hees <kris.van.hees@oracle.com> wrote:
>
> Commit bfc6bb74e4 ("bpf: Implement verifier support for validation of
> async callbacks.") added support for BPF_FUNC_timer_set_callback to

abbrev=12 is the standard nowadays.
Also don't break the commit subj into multiple lines.
I've added
Fixes: bfc6bb74e4f1 ("bpf: Implement verifier support for validation
of async callbacks.")
and pushed to bpf-next.
Thanks a lot!