lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite for Android: free password hash cracker in your pocket
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20181123183455.qjokyt6zpa2yck6s@xylophone.i.decadent.org.uk>
Date:   Fri, 23 Nov 2018 18:34:55 +0000
From:   Ben Hutchings <ben.hutchings@...ethink.co.uk>
To:     Alexei Starovoitov <ast@...nel.org>,
        Daniel Borkmann <daniel@...earbox.net>
Cc:     netdev@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: [PATCH 1/3] bpf/verifier: Log instruction patching when verbose
 logging is enabled

User-space does not have access to the patched eBPF code, but we
need to be able to test that patches are being applied.  Therefore
log distinct messages for each case that requires patching.

Signed-off-by: Ben Hutchings <ben.hutchings@...ethink.co.uk>
---
 kernel/bpf/verifier.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 4ce049cd30a3..ea4bc796e545 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -5844,6 +5844,7 @@ static int convert_ctx_accesses(struct bpf_verifier_env *env)
 			verbose(env, "bpf verifier is misconfigured\n");
 			return -EINVAL;
 		} else if (cnt) {
+			verbose(env, "patching in prologue\n");
 			new_prog = bpf_patch_insn_data(env, 0, insn_buf, cnt);
 			if (!new_prog)
 				return -ENOMEM;
@@ -5892,6 +5893,9 @@ static int convert_ctx_accesses(struct bpf_verifier_env *env)
 			};
 
 			cnt = ARRAY_SIZE(patch);
+			verbose(env,
+				"patching in sanitization against SSB at %d\n",
+				i + delta);
 			new_prog = bpf_patch_insn_data(env, i + delta, patch, cnt);
 			if (!new_prog)
 				return -ENOMEM;
@@ -5973,6 +5977,7 @@ static int convert_ctx_accesses(struct bpf_verifier_env *env)
 			}
 		}
 
+		verbose(env, "patching explicit ctx access at %d\n", i + delta);
 		new_prog = bpf_patch_insn_data(env, i + delta, insn_buf, cnt);
 		if (!new_prog)
 			return -ENOMEM;
@@ -6225,6 +6230,8 @@ static int fixup_bpf_calls(struct bpf_verifier_env *env)
 				cnt = ARRAY_SIZE(mask_and_mod) - (is64 ? 1 : 0);
 			}
 
+			verbose(env, "patching in divide-by-zero check at %d\n",
+				i + delta);
 			new_prog = bpf_patch_insn_data(env, i + delta, patchlet, cnt);
 			if (!new_prog)
 				return -ENOMEM;
@@ -6244,6 +6251,8 @@ static int fixup_bpf_calls(struct bpf_verifier_env *env)
 				return -EINVAL;
 			}
 
+			verbose(env, "patching implicit ctx access at %d\n",
+				i + delta);
 			new_prog = bpf_patch_insn_data(env, i + delta, insn_buf, cnt);
 			if (!new_prog)
 				return -ENOMEM;
@@ -6307,6 +6316,8 @@ static int fixup_bpf_calls(struct bpf_verifier_env *env)
 								 map)->index_mask);
 			insn_buf[2] = *insn;
 			cnt = 3;
+			verbose(env, "patching in tail-call bounds check at %d",
+				i + delta);
 			new_prog = bpf_patch_insn_data(env, i + delta, insn_buf, cnt);
 			if (!new_prog)
 				return -ENOMEM;
@@ -6342,6 +6353,8 @@ static int fixup_bpf_calls(struct bpf_verifier_env *env)
 					return -EINVAL;
 				}
 
+				verbose(env, "patching in map lookup at %d",
+					i + delta);
 				new_prog = bpf_patch_insn_data(env, i + delta,
 							       insn_buf, cnt);
 				if (!new_prog)
-- 
Ben Hutchings, Software Developer                         Codethink Ltd
https://www.codethink.co.uk/                 Dale House, 35 Dale Street
                                     Manchester, M1 2HF, United Kingdom


Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ