linux-kernel - Re: [PATCH v2 bpf-next 07/13] bpf: Add BPF_FETCH field / create atomic_fetch

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20201201122232.GD2114905@google.com>
Date:   Tue, 1 Dec 2020 12:22:32 +0000
From:   Brendan Jackman <jackmanb@...gle.com>
To:     Yonghong Song <yhs@...com>
Cc:     bpf@...r.kernel.org, Alexei Starovoitov <ast@...nel.org>,
        Daniel Borkmann <daniel@...earbox.net>,
        KP Singh <kpsingh@...omium.org>,
        Florent Revest <revest@...omium.org>,
        linux-kernel@...r.kernel.org, Jann Horn <jannh@...gle.com>
Subject: Re: [PATCH v2 bpf-next 07/13] bpf: Add BPF_FETCH field / create
 atomic_fetch_add instruction

On Fri, Nov 27, 2020 at 08:15:49PM -0800, Yonghong Song wrote:
> 
> 
> On 11/27/20 9:57 AM, Brendan Jackman wrote:
[...]
> > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> > index e8b41ccdfb90..cd4c03b25573 100644
> > --- a/kernel/bpf/verifier.c
> > +++ b/kernel/bpf/verifier.c
> > @@ -3602,7 +3602,11 @@ static int check_atomic(struct bpf_verifier_env *env, int insn_idx, struct bpf_i
> >   {
> >   	int err;
> > -	if (insn->imm != BPF_ADD) {
> > +	switch (insn->imm) {
> > +	case BPF_ADD:
> > +	case BPF_ADD | BPF_FETCH:
> > +		break;
> > +	default:
> >   		verbose(env, "BPF_ATOMIC uses invalid atomic opcode %02x\n", insn->imm);
> >   		return -EINVAL;
> >   	}
> > @@ -3631,7 +3635,7 @@ static int check_atomic(struct bpf_verifier_env *env, int insn_idx, struct bpf_i
> >   	    is_pkt_reg(env, insn->dst_reg) ||
> >   	    is_flow_key_reg(env, insn->dst_reg) ||
> >   	    is_sk_reg(env, insn->dst_reg)) {
> > -		verbose(env, "atomic stores into R%d %s is not allowed\n",
> > +		verbose(env, "BPF_ATOMIC stores into R%d %s is not allowed\n",
> >   			insn->dst_reg,
> >   			reg_type_str[reg_state(env, insn->dst_reg)->type]);
> >   		return -EACCES;
> > @@ -3644,8 +3648,20 @@ static int check_atomic(struct bpf_verifier_env *env, int insn_idx, struct bpf_i
> >   		return err;
> >   	/* check whether we can write into the same memory */
> > -	return check_mem_access(env, insn_idx, insn->dst_reg, insn->off,
> > -				BPF_SIZE(insn->code), BPF_WRITE, -1, true);
> > +	err = check_mem_access(env, insn_idx, insn->dst_reg, insn->off,
> > +			       BPF_SIZE(insn->code), BPF_WRITE, -1, true);
> > +	if (err)
> > +		return err;
> > +
> > +	if (!(insn->imm & BPF_FETCH))
> > +		return 0;
> > +
> > +	/* check and record load of old value into src reg  */
> > +	err = check_reg_arg(env, insn->src_reg, DST_OP);
> > +	if (err)
> > +		return err;
> > +
> > +	return 0;
> >   }
> >   static int __check_stack_boundary(struct bpf_verifier_env *env, u32 regno,
> > @@ -9501,12 +9517,6 @@ static int do_check(struct bpf_verifier_env *env)
> >   		} else if (class == BPF_STX) {
> >   			enum bpf_reg_type *prev_dst_type, dst_reg_type;
> > -			if (((BPF_MODE(insn->code) != BPF_MEM &&
> > -			      BPF_MODE(insn->code) != BPF_ATOMIC) || insn->imm != 0)) {
> > -				verbose(env, "BPF_STX uses reserved fields\n");
> > -				return -EINVAL;
> > -			}
> > -
> >   			if (BPF_MODE(insn->code) == BPF_ATOMIC) {
> >   				err = check_atomic(env, env->insn_idx, insn);
> >   				if (err)
> > @@ -9515,6 +9525,11 @@ static int do_check(struct bpf_verifier_env *env)
> >   				continue;
> >   			}
> > +			if (BPF_MODE(insn->code) != BPF_MEM && insn->imm != 0) {
> 
> "||" here instead of "&&"?

Right - thanks again!