From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-1.0 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B974CC10F03 for ; Fri, 1 Mar 2019 12:51:13 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 912072084D for ; Fri, 1 Mar 2019 12:51:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2387803AbfCAMvJ (ORCPT ); Fri, 1 Mar 2019 07:51:09 -0500 Received: from www62.your-server.de ([213.133.104.62]:50970 "EHLO www62.your-server.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726001AbfCAMvC (ORCPT ); Fri, 1 Mar 2019 07:51:02 -0500 Received: from [78.46.172.3] (helo=sslproxy06.your-server.de) by www62.your-server.de with esmtpsa (TLSv1.2:DHE-RSA-AES256-GCM-SHA384:256) (Exim 4.89_1) (envelope-from ) id 1gzhcy-0002oG-Uc; Fri, 01 Mar 2019 13:51:01 +0100 Received: from [2a02:1205:34ea:9e0:5681:e3d2:fbd:7e53] (helo=linux.home) by sslproxy06.your-server.de with esmtpsa (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.89) (envelope-from ) id 1gzhcy-00089N-Oy; Fri, 01 Mar 2019 13:51:00 +0100 Subject: Re: SOCKET_FILTER regression - eBPF can't subtract when attached from unprivileged user To: Arthur Fabre , marek@cloudflare.com Cc: ast@kernel.org, netdev@vger.kernel.org References: <20190301113901.29448-1-afabre@cloudflare.com> From: Daniel Borkmann Message-ID: Date: Fri, 1 Mar 2019 13:51:00 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.3.0 MIME-Version: 1.0 In-Reply-To: <20190301113901.29448-1-afabre@cloudflare.com> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit X-Authenticated-Sender: daniel@iogearbox.net X-Virus-Scanned: Clear (ClamAV 0.100.2/25374/Thu Feb 28 11:38:05 2019) Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org On 03/01/2019 12:39 PM, Arthur Fabre wrote: > I can reproduce this on 4.19.0-3-amd64 both with, and without the JIT enabled. > > Dumping the "root" and "non-root" programs with bpftool, > the subtraction instructions differ: > > "non-root": > 0: (85) call bpf_ktime_get_ns#74944 > 1: (bf) r7 = r0 > 2: (85) call bpf_ktime_get_ns#74944 > 3: (bf) r6 = r0 > 4: (bf) r8 = r6 > 5: (b4) w11 = -1 > 6: (1f) r11 -= r8 > 7: (4f) r11 |= r8 > 8: (87) r11 = -r11 > 9: (c7) r11 s>>= 63 > 10: (5f) r8 &= r11 > > "root": > 0: (85) call bpf_ktime_get_ns#74944 > 1: (bf) r7 = r0 > 2: (85) call bpf_ktime_get_ns#74944 > 3: (bf) r6 = r0 > 4: (bf) r8 = r6 > > The remainder of the instructions are for writing the results in the map, > and the instructions are identical. > > I believe the extra instructions come from "fixup_bpf_calls" in the verifier: > > if (isneg) > *patch++ = BPF_ALU64_IMM(BPF_MUL, off_reg, -1); > *patch++ = BPF_MOV32_IMM(BPF_REG_AX, aux->alu_limit - 1); > *patch++ = BPF_ALU64_REG(BPF_SUB, BPF_REG_AX, off_reg); > *patch++ = BPF_ALU64_REG(BPF_OR, BPF_REG_AX, off_reg); > *patch++ = BPF_ALU64_IMM(BPF_NEG, BPF_REG_AX, 0); > *patch++ = BPF_ALU64_IMM(BPF_ARSH, BPF_REG_AX, 63); > if (issrc) { > *patch++ = BPF_ALU64_REG(BPF_AND, BPF_REG_AX, > off_reg); > insn->src_reg = BPF_REG_AX; > } else { > *patch++ = BPF_ALU64_REG(BPF_AND, off_reg, > BPF_REG_AX); > } > > This was introduced by "bpf: prevent out of bounds speculation on pointer arithmetic" > (https://patchwork.ozlabs.org/patch/1039606/). > I don't yet understand what's going on. Hmm, thanks for the report, I'll take a look right away! There's no map involved here it seems, so there shouldn't be such fixup. Cheers, Daniel