linux-kernel - Re: [PATCH bpf-next] bpf: limit bpf_core_types_are

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 2 Feb 2022 19:30:05 +0100
From:   Matteo Croce <mcroce@...ux.microsoft.com>
To:     Alexei Starovoitov <alexei.starovoitov@...il.com>
Cc:     Yonghong Song <yhs@...com>, bpf <bpf@...r.kernel.org>,
        Alexei Starovoitov <ast@...nel.org>,
        Daniel Borkmann <daniel@...earbox.net>,
        Andrii Nakryiko <andrii@...nel.org>,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH bpf-next] bpf: limit bpf_core_types_are_compat() recursion

On Sat, Jan 29, 2022 at 2:11 AM Alexei Starovoitov
<alexei.starovoitov@...il.com> wrote:
>
> On Fri, Jan 28, 2022 at 4:36 PM Matteo Croce <mcroce@...ux.microsoft.com> wrote:
> >
> > On Fri, Jan 28, 2022 at 9:09 PM Alexei Starovoitov
> > <alexei.starovoitov@...il.com> wrote:
> > >
> > > On Fri, Jan 28, 2022 at 10:51 AM Matteo Croce
> > > <mcroce@...ux.microsoft.com> wrote:
> > > >
> > > > On Fri, Jan 28, 2022 at 6:31 AM Alexei Starovoitov
> > > > <alexei.starovoitov@...il.com> wrote:
> > > > >
> > > > > On Mon, Dec 20, 2021 at 10:34 PM Yonghong Song <yhs@...com> wrote:
> > > > > >
> > > > > >
> > > > > > https://reviews.llvm.org/D116063 improved the error message as below
> > > > > > to make it a little bit more evident what is the problem:
> > > > > >
> > > > > > $ clang -target bpf -O2 -g -c bug.c
> > > > > >
> > > > > > fatal error: error in backend: SubroutineType not supported for
> > > > > > BTF_TYPE_ID_REMOTE reloc
> > > > >
> > > > > Hi Matteo,
> > > > >
> > > > > Are you still working on a test?
> > > > > What's a timeline to repost the patch set?
> > > > >
> > > > > Thanks!
> > > >
> > > > Hi Alexei,
> > > >
> > > > The change itself is ready, I'm just stuck at writing a test which
> > > > will effectively calls __bpf_core_types_are_compat() with some
> > > > recursion.
> > > > I guess that I have to generate a BTF_KIND_FUNC_PROTO type somehow, so
> > > > __bpf_core_types_are_compat() is called again to check the prototipe
> > > > arguments type.
> > > > I tried with these two, with no luck:
> > > >
> > > > // 1
> > > > typedef int (*func_proto_typedef)(struct sk_buff *);
> > > > bpf_core_type_exists(func_proto_typedef);
> > > >
> > > > // 2
> > > > void func_proto(int, unsigned int);
> > > > bpf_core_type_id_kernel(func_proto);
> > > >
> > > > Which is a simple way to generate a BTF_KIND_FUNC_PROTO BTF field?
> > >
> > > What do you mean 'no luck'?
> > > Have you tried what progs/test_core_reloc_type_id.c is doing?
> > > typedef int (*func_proto_typedef)(long);
> > > bpf_core_type_id_kernel(func_proto_typedef);
> > >
> > > Without macros:
> > > typedef int (*func_proto_typedef)(long);
> > >
> > > int test() {
> > >    return __builtin_btf_type_id(*(typeof(func_proto_typedef) *)0, 1);
> > > }
> > > int test2() {
> > >    return __builtin_preserve_type_info(*(typeof(func_proto_typedef) *)0, 0);
> > > }
> > >
> > >
> > > compiles fine and generates relos.
> >
> > Yes, I tried that one.
> > We reach bpf_core_apply_relo_insn() but not bpf_core_spec_match(),
> > since cands->len is 0.
> >
> > [   16.424821] bpf_core_apply_relo_insn:1202 cands->len: 0
> >
> > That's a very simple raw_tracepoint/sys_enter program:
>
> Did you forget to attach it ?
>
> If it's doing bpf_core_type_id_kernel(func_proto_typedef)
> then, of course, cands->len will be zero.
> You need to add this typedef to bpf_testmod first.
> Then use two typedef flavors: func_proto_typedef___match
> and func_proto_typedef___doesnt_match
> with matching and mismatching prototypes, so
> both can call into bpf_core_types_are_compat() and
> return different results.
> Then build on top to test recursion.

Hi,

I'm able to trigger __bpf_core_types_are_compat() recursion now.
What do you think to generate also a prototype which needs 3 recursion
calls, thus invalid, and check that it returns error?
e.g.

typedef int (*func_proto_typedef)(long);
typedef int (*func_proto_typedef___of)(func_proto_typedef);

func_proto_typedef funcp = NULL;
func_proto_typedef___of funcp_of = NULL;

this gives:

[  190.875387] bpf_core_apply_relo_insn:1200 cands->len: 3
[  190.875435] __bpf_core_types_are_compat:6798 level: 2
[  190.875479] __bpf_core_types_are_compat:6798 level: 1
[  190.875506] bpf_core_types_are_compat:6896: ret: 0
[  190.875541] __bpf_core_types_are_compat:6798 level: 2
[  190.875570] __bpf_core_types_are_compat:6798 level: 1
[  190.875599] bpf_core_types_are_compat:6896: ret: 0
[  190.875629] __bpf_core_types_are_compat:6798 level: 2
[  190.875659] __bpf_core_types_are_compat:6798 level: 1
[  190.875686] bpf_core_types_are_compat:6896: ret: -22
failed to open and/or load BPF object

-- 
per aspera ad upstream