netdev - [RFC][PATCH bpf 1/2] bpf: allow 64-bit offsets for bpf function calls

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Thu,  8 Feb 2018 17:33:05 +0530
From:   Sandipan Das <sandipan@...ux.vnet.ibm.com>
To:     ast@...com, daniel@...earbox.net
Cc:     netdev@...r.kernel.org, linuxppc-dev@...ts.ozlabs.org,
        mpe@...erman.id.au, naveen.n.rao@...ux.vnet.ibm.com
Subject: [RFC][PATCH bpf 1/2] bpf: allow 64-bit offsets for bpf function calls

The imm field of a bpf_insn is a signed 32-bit integer. For
JIT-ed bpf-to-bpf function calls, it stores the offset from
__bpf_call_base to the start of the callee function.

For some architectures, such as powerpc64, it was found that
this offset may be as large as 64 bits because of which this
cannot be accomodated in the imm field without truncation.

To resolve this, we additionally use the aux data within each
bpf_prog associated with the caller functions to store the
addresses of their respective callees.

Signed-off-by: Sandipan Das <sandipan@...ux.vnet.ibm.com>
---
 kernel/bpf/verifier.c | 39 ++++++++++++++++++++++++++++++++++++++-
 1 file changed, 38 insertions(+), 1 deletion(-)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 5fb69a85d967..52088b4ca02f 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -5282,6 +5282,19 @@ static int jit_subprogs(struct bpf_verifier_env *env)
 	 * run last pass of JIT
 	 */
 	for (i = 0; i <= env->subprog_cnt; i++) {
+		u32 flen = func[i]->len, callee_cnt = 0;
+		struct bpf_prog **callee;
+
+		/* for now assume that the maximum number of bpf function
+		 * calls that can be made by a caller must be at most the
+		 * number of bpf instructions in that function
+		 */
+		callee = kzalloc(sizeof(func[i]) * flen, GFP_KERNEL);
+		if (!callee) {
+			err = -ENOMEM;
+			goto out_free;
+		}
+
 		insn = func[i]->insnsi;
 		for (j = 0; j < func[i]->len; j++, insn++) {
 			if (insn->code != (BPF_JMP | BPF_CALL) ||
@@ -5292,6 +5305,26 @@ static int jit_subprogs(struct bpf_verifier_env *env)
 			insn->imm = (u64 (*)(u64, u64, u64, u64, u64))
 				func[subprog]->bpf_func -
 				__bpf_call_base;
+
+			/* the offset to the callee from __bpf_call_base
+			 * may be larger than what the 32 bit integer imm
+			 * can accomodate which will truncate the higher
+			 * order bits
+			 *
+			 * to avoid this, we additionally utilize the aux
+			 * data of each caller function for storing the
+			 * addresses of every callee associated with it
+			 */
+			callee[callee_cnt++] = func[subprog];
+		}
+
+		/* free up callee list if no function calls were made */
+		if (!callee_cnt) {
+			kfree(callee);
+			callee = NULL;
+		} else {
+			func[i]->aux->func = callee;
+			func[i]->aux->func_cnt = callee_cnt;
 		}
 	}
 	for (i = 0; i <= env->subprog_cnt; i++) {
@@ -5338,8 +5371,12 @@ static int jit_subprogs(struct bpf_verifier_env *env)
 	return 0;
 out_free:
 	for (i = 0; i <= env->subprog_cnt; i++)
-		if (func[i])
+		if (func[i]) {
+			/* cleanup callee list */
+			if (func[i]->aux->func)
+				kfree(func[i]->aux->func);
 			bpf_jit_free(func[i]);
+		}
 	kfree(func);
 	/* cleanup main prog to be interpreted */
 	prog->jit_requested = 0;
-- 
2.14.3