linux-kernel - Re: [RFC PATCH bpf-next 1/2] bpf, x64: Fix tailcall infinite loop bug

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <fea59b79-3f28-c580-185b-8c64dc21a399@gmail.com>
Date:   Fri, 18 Aug 2023 10:10:33 +0800
From:   Leon Hwang <hffilwlqm@...il.com>
To:     Alexei Starovoitov <alexei.starovoitov@...il.com>
Cc:     bpf@...r.kernel.org, ast@...nel.org, daniel@...earbox.net,
        andrii@...nel.org, martin.lau@...ux.dev, song@...nel.org,
        yonghong.song@...ux.dev, john.fastabend@...il.com,
        kpsingh@...nel.org, sdf@...gle.com, haoluo@...gle.com,
        jolsa@...nel.org, x86@...nel.org, tglx@...utronix.de,
        mingo@...hat.com, bp@...en8.de, dave.hansen@...ux.intel.com,
        hpa@...or.com, mykolal@...com, shuah@...nel.org,
        davem@...emloft.net, dsahern@...nel.org, tangyeechou@...il.com,
        kernel-patches-bot@...com, maciej.fijalkowski@...el.com,
        netdev@...r.kernel.org, linux-kernel@...r.kernel.org,
        linux-kselftest@...r.kernel.org
Subject: Re: [RFC PATCH bpf-next 1/2] bpf, x64: Fix tailcall infinite loop bug



On 18/8/23 06:31, Alexei Starovoitov wrote:
> On Mon, Aug 14, 2023 at 09:41:46PM +0800, Leon Hwang wrote:
>> @@ -1147,6 +1152,7 @@ struct bpf_attach_target_info {
>>  	struct module *tgt_mod;
>>  	const char *tgt_name;
>>  	const struct btf_type *tgt_type;
>> +	bool tail_call_ctx;
> 
> Instead of extra flag here can you check tgt_prog->aux->tail_call_reachable in check_attach_btf_id()
> and set tr->flags there?

Should we check tgt_prog->aux->func[subprog]->is_func? Or, tgt_prog->aux->tail_call_reachable
is enough?

I think tgt_prog->aux->func[subprog]->is_func is required to check. It's because it's a bug
about subprog instead of tgt_prog.

In check_attach_btf_id():

bool tail_call_ctx;
// ...
ret = bpf_check_attach_target(&env->log, prog, tgt_prog, btf_id, &tgt_info, &tail_call_ctx);
// ...
tr->flags = (tail_call_ctx ? BPF_TRAMP_F_TAIL_CALL_CTX : 0);

How about changing like this? However, it's bad to change bpf_check_attach_target() declaration.

> Other than this the fix makes sense.
> Please trim your cc list when you respin.> Just maintainers, Maciej (author of fixes tag) and bpf@...r is enough.

I'll trim it.

Thanks,
Leon