From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.0 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 308EBC43381 for ; Fri, 1 Mar 2019 14:05:40 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 0861F20850 for ; Fri, 1 Mar 2019 14:05:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388063AbfCAOFj (ORCPT ); Fri, 1 Mar 2019 09:05:39 -0500 Received: from www62.your-server.de ([213.133.104.62]:34258 "EHLO www62.your-server.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2387990AbfCAOEp (ORCPT ); Fri, 1 Mar 2019 09:04:45 -0500 Received: from [78.46.172.2] (helo=sslproxy05.your-server.de) by www62.your-server.de with esmtpsa (TLSv1.2:DHE-RSA-AES256-GCM-SHA384:256) (Exim 4.89_1) (envelope-from ) id 1gzimI-0000qi-Tt; Fri, 01 Mar 2019 15:04:42 +0100 Received: from [2a02:1205:34ea:9e0:5681:e3d2:fbd:7e53] (helo=linux.home) by sslproxy05.your-server.de with esmtpsa (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.89) (envelope-from ) id 1gzimI-00062e-OC; Fri, 01 Mar 2019 15:04:42 +0100 Subject: Re: SOCKET_FILTER regression - eBPF can't subtract when attached from unprivileged user To: Arthur Fabre , marek@cloudflare.com Cc: ast@kernel.org, netdev@vger.kernel.org References: <20190301113901.29448-1-afabre@cloudflare.com> From: Daniel Borkmann Message-ID: Date: Fri, 1 Mar 2019 15:04:42 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.3.0 MIME-Version: 1.0 In-Reply-To: <20190301113901.29448-1-afabre@cloudflare.com> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit X-Authenticated-Sender: daniel@iogearbox.net X-Virus-Scanned: Clear (ClamAV 0.100.2/25374/Thu Feb 28 11:38:05 2019) Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org On 03/01/2019 12:39 PM, Arthur Fabre wrote: > I can reproduce this on 4.19.0-3-amd64 both with, and without the JIT enabled. > > Dumping the "root" and "non-root" programs with bpftool, > the subtraction instructions differ: > > "non-root": > 0: (85) call bpf_ktime_get_ns#74944 > 1: (bf) r7 = r0 > 2: (85) call bpf_ktime_get_ns#74944 > 3: (bf) r6 = r0 > 4: (bf) r8 = r6 > 5: (b4) w11 = -1 > 6: (1f) r11 -= r8 > 7: (4f) r11 |= r8 > 8: (87) r11 = -r11 > 9: (c7) r11 s>>= 63 > 10: (5f) r8 &= r11 > > "root": > 0: (85) call bpf_ktime_get_ns#74944 > 1: (bf) r7 = r0 > 2: (85) call bpf_ktime_get_ns#74944 > 3: (bf) r6 = r0 > 4: (bf) r8 = r6 > > The remainder of the instructions are for writing the results in the map, > and the instructions are identical. > > I believe the extra instructions come from "fixup_bpf_calls" in the verifier: > > if (isneg) > *patch++ = BPF_ALU64_IMM(BPF_MUL, off_reg, -1); > *patch++ = BPF_MOV32_IMM(BPF_REG_AX, aux->alu_limit - 1); > *patch++ = BPF_ALU64_REG(BPF_SUB, BPF_REG_AX, off_reg); > *patch++ = BPF_ALU64_REG(BPF_OR, BPF_REG_AX, off_reg); > *patch++ = BPF_ALU64_IMM(BPF_NEG, BPF_REG_AX, 0); > *patch++ = BPF_ALU64_IMM(BPF_ARSH, BPF_REG_AX, 63); > if (issrc) { > *patch++ = BPF_ALU64_REG(BPF_AND, BPF_REG_AX, > off_reg); > insn->src_reg = BPF_REG_AX; > } else { > *patch++ = BPF_ALU64_REG(BPF_AND, off_reg, > BPF_REG_AX); > } > > This was introduced by "bpf: prevent out of bounds speculation on pointer arithmetic" > (https://patchwork.ozlabs.org/patch/1039606/). > I don't yet understand what's going on. Ok, sigh, fix is this, sorry about the braino: diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index cdd2cb01f789..5b3cd384df1d 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -7629,7 +7629,8 @@ static int fixup_bpf_calls(struct bpf_verifier_env *env) u32 off_reg; aux = &env->insn_aux_data[i + delta]; - if (!aux->alu_state) + if (!aux->alu_state || + aux->alu_state == BPF_ALU_NON_POINTER) continue; isneg = aux->alu_state & BPF_ALU_NEG_VALUE; And this also makes the test work again: foo@test:/root/d0bb75a8c62cc35bec2b342054084aab-7cc37a3a93c8b4028e977f3131feaf7f8705e6a7$ ./ebpf-bug 0 -> 0 0x0000000000000000 1 -> 54645145816 0x0000000cb91ac0d8 2 -> 54645145860 0x0000000cb91ac104 3 -> 44 0x000000000000002c foo@test:/root/d0bb75a8c62cc35bec2b342054084aab-7cc37a3a93c8b4028e977f3131feaf7f8705e6a7$ exit root@test:~/d0bb75a8c62cc35bec2b342054084aab-7cc37a3a93c8b4028e977f3131feaf7f8705e6a7# ./ebpf-bug 0 -> 0 0x0000000000000000 1 -> 57984017624 0x0000000d801de4d8 2 -> 57984017673 0x0000000d801de509 3 -> 49 0x0000000000000031 I'll cook it as proper patch in a bit along with a test case. Thanks for reporting! Daniel