netdev - Re: [PATCH bpf-next v2 13/13] bpf/tests: Add tail call limit test with external function call

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 08 Sep 2021 12:10:01 +0200
From:   Ilya Leoshkevich <iii@...ux.ibm.com>
To:     Johan Almbladh <johan.almbladh@...finetworks.com>, ast@...nel.org,
        daniel@...earbox.net, andrii@...nel.org
Cc:     kafai@...com, songliubraving@...com, yhs@...com,
        john.fastabend@...il.com, kpsingh@...nel.org,
        netdev@...r.kernel.org, bpf@...r.kernel.org
Subject: Re: [PATCH bpf-next v2 13/13] bpf/tests: Add tail call limit test
 with external function call

On Wed, 2021-09-08 at 00:23 +0200, Johan Almbladh wrote:
> This patch adds a tail call limit test where the program also emits
> a BPF_CALL to an external function prior to the tail call. Mainly
> testing that JITed programs preserve its internal register state, for
> example tail call count, across such external calls.
> 
> Signed-off-by: Johan Almbladh <johan.almbladh@...finetworks.com>
> ---
>  lib/test_bpf.c | 51 +++++++++++++++++++++++++++++++++++++++++++++++---
>  1 file changed, 48 insertions(+), 3 deletions(-)
> 
> diff --git a/lib/test_bpf.c b/lib/test_bpf.c
> index 7475abfd2186..6e45b4da9841 100644
> --- a/lib/test_bpf.c
> +++ b/lib/test_bpf.c
> @@ -12259,6 +12259,20 @@ static struct tail_call_test tail_call_tests[]
> = {
>                 },
>                 .result = MAX_TAIL_CALL_CNT + 1,
>         },
> +       {
> +               "Tail call count preserved across function calls",
> +               .insns = {
> +                       BPF_ALU64_IMM(BPF_ADD, R1, 1),
> +                       BPF_STX_MEM(BPF_DW, R10, R1, -8),
> +                       BPF_CALL_REL(0),
> +                       BPF_LDX_MEM(BPF_DW, R1, R10, -8),
> +                       BPF_ALU32_REG(BPF_MOV, R0, R1),
> +                       TAIL_CALL(0),
> +                       BPF_EXIT_INSN(),
> +               },
> +               .stack_depth = 8,
> +               .result = MAX_TAIL_CALL_CNT + 1,
> +       },
>         {
>                 "Tail call error path, NULL target",
>                 .insns = {

There seems to be a problem with BPF_CALL_REL(0) on s390, since it
assumes that test_bpf_func and __bpf_call_base are within +-2G of
each other, which is not (yet) the case.

I can't think of a good fix, so how about something like this?

--- a/lib/test_bpf.c
+++ b/lib/test_bpf.c
@@ -12257,6 +12257,7 @@ static struct tail_call_test tail_call_tests[]
= {
                },
                .result = MAX_TAIL_CALL_CNT + 1,
        },
+#ifndef __s390__
        {
                "Tail call count preserved across function calls",
                .insns = {
@@ -12271,6 +12272,7 @@ static struct tail_call_test tail_call_tests[]
= {
                .stack_depth = 8,
                .result = MAX_TAIL_CALL_CNT + 1,
        },
+#endif
        {
                "Tail call error path, NULL target",
                .insns = {

[...]