linux-kernel - Re: [Bug Report] bpf: incorrectly pruning runtime execution path

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <3ba67d3e220c19c4a921e20f06e26bfe70ae8c80.camel@gmail.com>
Date:   Thu, 14 Dec 2023 01:47:35 +0200
From:   Eduard Zingerman <eddyz87@...il.com>
To:     Andrii Nakryiko <andrii.nakryiko@...il.com>
Cc:     Hao Sun <sunhao.th@...il.com>, Alexei Starovoitov <ast@...nel.org>,
        Andrii Nakryiko <andrii@...nel.org>,
        Daniel Borkmann <daniel@...earbox.net>,
        bpf <bpf@...r.kernel.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [Bug Report] bpf: incorrectly pruning runtime execution path

On Wed, 2023-12-13 at 15:40 -0800, Andrii Nakryiko wrote:
[...]
> >     24: (18) r2 = 0x4                     ; R2_w=4
> >     26: (7e) if w8 s>= w0 goto pc+5
> >     mark_precise: frame0: last_idx 26 first_idx 22 subseq_idx -1
> >     mark_precise: frame0: regs=r5,r8 stack= before 24: (18) r2 = 0x4
> >     ...                   ^^^^^^^^^^
> >                           ^^^^^^^^^^
> > Here w8 == 15, w0 in range [0, 2], so the jump is being predicted,
> > but for some reason R0 is not among the registers that would be marked precise.
> 
> It is, as a second step. There are two concatenated precision logs:
> 
> mark_precise: frame0: last_idx 26 first_idx 22 subseq_idx -1
> mark_precise: frame0: regs=r0 stack= before 24: (18) r2 = 0x4
> mark_precise: frame0: regs=r0 stack= before 23: (bf) r5 = r8
> mark_precise: frame0: regs=r0 stack= before 22: (67) r4 <<= 2
> 
> 
> The issue is elsewhere, see my last email.

Oh, right, there are two calls to mark_chain_precision in a row, thanks