linux-kernel - Re: [PATCH bpf-next] bpf: limit bpf_core_types_are

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 29 Jan 2022 01:35:59 +0100
From:   Matteo Croce <mcroce@...ux.microsoft.com>
To:     Alexei Starovoitov <alexei.starovoitov@...il.com>
Cc:     Yonghong Song <yhs@...com>, bpf <bpf@...r.kernel.org>,
        Alexei Starovoitov <ast@...nel.org>,
        Daniel Borkmann <daniel@...earbox.net>,
        Andrii Nakryiko <andrii@...nel.org>,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH bpf-next] bpf: limit bpf_core_types_are_compat() recursion

On Fri, Jan 28, 2022 at 9:09 PM Alexei Starovoitov
<alexei.starovoitov@...il.com> wrote:
>
> On Fri, Jan 28, 2022 at 10:51 AM Matteo Croce
> <mcroce@...ux.microsoft.com> wrote:
> >
> > On Fri, Jan 28, 2022 at 6:31 AM Alexei Starovoitov
> > <alexei.starovoitov@...il.com> wrote:
> > >
> > > On Mon, Dec 20, 2021 at 10:34 PM Yonghong Song <yhs@...com> wrote:
> > > >
> > > >
> > > > https://reviews.llvm.org/D116063 improved the error message as below
> > > > to make it a little bit more evident what is the problem:
> > > >
> > > > $ clang -target bpf -O2 -g -c bug.c
> > > >
> > > > fatal error: error in backend: SubroutineType not supported for
> > > > BTF_TYPE_ID_REMOTE reloc
> > >
> > > Hi Matteo,
> > >
> > > Are you still working on a test?
> > > What's a timeline to repost the patch set?
> > >
> > > Thanks!
> >
> > Hi Alexei,
> >
> > The change itself is ready, I'm just stuck at writing a test which
> > will effectively calls __bpf_core_types_are_compat() with some
> > recursion.
> > I guess that I have to generate a BTF_KIND_FUNC_PROTO type somehow, so
> > __bpf_core_types_are_compat() is called again to check the prototipe
> > arguments type.
> > I tried with these two, with no luck:
> >
> > // 1
> > typedef int (*func_proto_typedef)(struct sk_buff *);
> > bpf_core_type_exists(func_proto_typedef);
> >
> > // 2
> > void func_proto(int, unsigned int);
> > bpf_core_type_id_kernel(func_proto);
> >
> > Which is a simple way to generate a BTF_KIND_FUNC_PROTO BTF field?
>
> What do you mean 'no luck'?
> Have you tried what progs/test_core_reloc_type_id.c is doing?
> typedef int (*func_proto_typedef)(long);
> bpf_core_type_id_kernel(func_proto_typedef);
>
> Without macros:
> typedef int (*func_proto_typedef)(long);
>
> int test() {
>    return __builtin_btf_type_id(*(typeof(func_proto_typedef) *)0, 1);
> }
> int test2() {
>    return __builtin_preserve_type_info(*(typeof(func_proto_typedef) *)0, 0);
> }
>
>
> compiles fine and generates relos.

Yes, I tried that one.
We reach bpf_core_apply_relo_insn() but not bpf_core_spec_match(),
since cands->len is 0.

[   16.424821] bpf_core_apply_relo_insn:1202 cands->len: 0

That's a very simple raw_tracepoint/sys_enter program:

-- 
per aspera ad upstream