linux-kernel - Re: [PATCH bpf-next] bpf: limit bpf_core_types_are

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAADnVQL8D0cBixtqnOok621gfXnBs4sZSTSTKBodrtRzwBFsHQ@mail.gmail.com>
Date:   Fri, 28 Jan 2022 17:11:34 -0800
From:   Alexei Starovoitov <alexei.starovoitov@...il.com>
To:     Matteo Croce <mcroce@...ux.microsoft.com>
Cc:     Yonghong Song <yhs@...com>, bpf <bpf@...r.kernel.org>,
        Alexei Starovoitov <ast@...nel.org>,
        Daniel Borkmann <daniel@...earbox.net>,
        Andrii Nakryiko <andrii@...nel.org>,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH bpf-next] bpf: limit bpf_core_types_are_compat() recursion

On Fri, Jan 28, 2022 at 4:36 PM Matteo Croce <mcroce@...ux.microsoft.com> wrote:
>
> On Fri, Jan 28, 2022 at 9:09 PM Alexei Starovoitov
> <alexei.starovoitov@...il.com> wrote:
> >
> > On Fri, Jan 28, 2022 at 10:51 AM Matteo Croce
> > <mcroce@...ux.microsoft.com> wrote:
> > >
> > > On Fri, Jan 28, 2022 at 6:31 AM Alexei Starovoitov
> > > <alexei.starovoitov@...il.com> wrote:
> > > >
> > > > On Mon, Dec 20, 2021 at 10:34 PM Yonghong Song <yhs@...com> wrote:
> > > > >
> > > > >
> > > > > https://reviews.llvm.org/D116063 improved the error message as below
> > > > > to make it a little bit more evident what is the problem:
> > > > >
> > > > > $ clang -target bpf -O2 -g -c bug.c
> > > > >
> > > > > fatal error: error in backend: SubroutineType not supported for
> > > > > BTF_TYPE_ID_REMOTE reloc
> > > >
> > > > Hi Matteo,
> > > >
> > > > Are you still working on a test?
> > > > What's a timeline to repost the patch set?
> > > >
> > > > Thanks!
> > >
> > > Hi Alexei,
> > >
> > > The change itself is ready, I'm just stuck at writing a test which
> > > will effectively calls __bpf_core_types_are_compat() with some
> > > recursion.
> > > I guess that I have to generate a BTF_KIND_FUNC_PROTO type somehow, so
> > > __bpf_core_types_are_compat() is called again to check the prototipe
> > > arguments type.
> > > I tried with these two, with no luck:
> > >
> > > // 1
> > > typedef int (*func_proto_typedef)(struct sk_buff *);
> > > bpf_core_type_exists(func_proto_typedef);
> > >
> > > // 2
> > > void func_proto(int, unsigned int);
> > > bpf_core_type_id_kernel(func_proto);
> > >
> > > Which is a simple way to generate a BTF_KIND_FUNC_PROTO BTF field?
> >
> > What do you mean 'no luck'?
> > Have you tried what progs/test_core_reloc_type_id.c is doing?
> > typedef int (*func_proto_typedef)(long);
> > bpf_core_type_id_kernel(func_proto_typedef);
> >
> > Without macros:
> > typedef int (*func_proto_typedef)(long);
> >
> > int test() {
> >    return __builtin_btf_type_id(*(typeof(func_proto_typedef) *)0, 1);
> > }
> > int test2() {
> >    return __builtin_preserve_type_info(*(typeof(func_proto_typedef) *)0, 0);
> > }
> >
> >
> > compiles fine and generates relos.
>
> Yes, I tried that one.
> We reach bpf_core_apply_relo_insn() but not bpf_core_spec_match(),
> since cands->len is 0.
>
> [   16.424821] bpf_core_apply_relo_insn:1202 cands->len: 0
>
> That's a very simple raw_tracepoint/sys_enter program:

Did you forget to attach it ?

If it's doing bpf_core_type_id_kernel(func_proto_typedef)
then, of course, cands->len will be zero.
You need to add this typedef to bpf_testmod first.
Then use two typedef flavors: func_proto_typedef___match
and func_proto_typedef___doesnt_match
with matching and mismatching prototypes, so
both can call into bpf_core_types_are_compat() and
return different results.
Then build on top to test recursion.