linux-kernel - Re: [Bug Report] bpf: incorrectly pruning runtime execution path

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAEf4BzbTCsP6ybmpWZ7mmb3CPGHB9WAD3xmd77YauMPuR1pSdA@mail.gmail.com>
Date:   Wed, 13 Dec 2023 15:50:39 -0800
From:   Andrii Nakryiko <andrii.nakryiko@...il.com>
To:     Eduard Zingerman <eddyz87@...il.com>
Cc:     Hao Sun <sunhao.th@...il.com>, Alexei Starovoitov <ast@...nel.org>,
        Andrii Nakryiko <andrii@...nel.org>,
        Daniel Borkmann <daniel@...earbox.net>,
        bpf <bpf@...r.kernel.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [Bug Report] bpf: incorrectly pruning runtime execution path

On Wed, Dec 13, 2023 at 3:47 PM Eduard Zingerman <eddyz87@...il.com> wrote:
>
> On Wed, 2023-12-13 at 15:40 -0800, Andrii Nakryiko wrote:
> [...]
> > >     24: (18) r2 = 0x4                     ; R2_w=4
> > >     26: (7e) if w8 s>= w0 goto pc+5
> > >     mark_precise: frame0: last_idx 26 first_idx 22 subseq_idx -1
> > >     mark_precise: frame0: regs=r5,r8 stack= before 24: (18) r2 = 0x4
> > >     ...                   ^^^^^^^^^^
> > >                           ^^^^^^^^^^
> > > Here w8 == 15, w0 in range [0, 2], so the jump is being predicted,
> > > but for some reason R0 is not among the registers that would be marked precise.
> >
> > It is, as a second step. There are two concatenated precision logs:
> >
> > mark_precise: frame0: last_idx 26 first_idx 22 subseq_idx -1
> > mark_precise: frame0: regs=r0 stack= before 24: (18) r2 = 0x4
> > mark_precise: frame0: regs=r0 stack= before 23: (bf) r5 = r8
> > mark_precise: frame0: regs=r0 stack= before 22: (67) r4 <<= 2
> >
> >
> > The issue is elsewhere, see my last email.
>
> Oh, right, there are two calls to mark_chain_precision in a row, thanks

We should probably combine those two steps, though, backtrack_state
allows us that now (see how propagate_precision() is doing that in one
go). It used to be very hard to mark two registers at the same time,
but now it's trivial. So not a bad idea to improve this and remove
confusion, especially in big real-world programs.