linux-kernel - Re: [PATCH] bpftool: un-const bpf_func_info to fix it for llvm 17 and newer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 20 May 2024 16:02:43 -0700
From: Nick Desaulniers <ndesaulniers@...gle.com>
To: Ivan Babrou <ivan@...udflare.com>
Cc: bpf@...r.kernel.org, linux-kernel@...r.kernel.org, 
	kernel-team@...udflare.com, Quentin Monnet <quentin@...valent.com>, 
	Alexei Starovoitov <ast@...nel.org>, Daniel Borkmann <daniel@...earbox.net>, 
	Andrii Nakryiko <andrii@...nel.org>, Martin KaFai Lau <martin.lau@...ux.dev>, Song Liu <song@...nel.org>, 
	Yonghong Song <yonghong.song@...ux.dev>, John Fastabend <john.fastabend@...il.com>, 
	KP Singh <kpsingh@...nel.org>, Stanislav Fomichev <sdf@...gle.com>, Hao Luo <haoluo@...gle.com>, 
	Jiri Olsa <jolsa@...nel.org>, Nathan Chancellor <nathan@...nel.org>, Tom Rix <trix@...hat.com>, 
	Raman Shukhau <ramasha@...com>
Subject: Re: [PATCH] bpftool: un-const bpf_func_info to fix it for llvm 17 and newer

On Mon, May 20, 2024 at 3:52 PM Ivan Babrou <ivan@...udflare.com> wrote:
>
> LLVM 17 started treating const structs as constants:
>
> * https://github.com/llvm/llvm-project/commit/0b2d5b967d98
>
> Combined with pointer laundering via ptr_to_u64, which takes a const ptr,
> but in reality treats the underlying memory as mutable, this makes clang
> always pass zero to btf__type_by_id, which breaks full name resolution.
>
> Disassembly before (LLVM 16) and after (LLVM 17):
>
>     -    8b 75 cc                 mov    -0x34(%rbp),%esi
>     -    e8 47 8d 02 00           call   3f5b0 <btf__type_by_id>
>     +    31 f6                    xor    %esi,%esi
>     +    e8 a9 8c 02 00           call   3f510 <btf__type_by_id>
>
> It's a bigger project to fix this properly (and a question whether LLVM
> itself should detect this), but for right now let's just fix bpftool.

Right, looks like we don't currently have UBSan instrumentation for "I
modified an object declared const."  Instead, it just leads to fun
bugs like "why was my write elided" or in this case "why did my
constant folding change between compiler versions?"  Such are the joys
of UB.

Acked-by: Nick Desaulniers <ndesaulniers@...gle.com>

>
> For more information, see this thread in bpf mailing list:
>
> * https://lore.kernel.org/bpf/CABWYdi0ymezpYsQsPv7qzpx2fWuTkoD1-wG1eT-9x-TSREFrQg@mail.gmail.com/T/
>
> Fixes: b662000aff84 ("bpftool: Adding support for BTF program names")
> Signed-off-by: Ivan Babrou <ivan@...udflare.com>
> ---
>  tools/bpf/bpftool/common.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/tools/bpf/bpftool/common.c b/tools/bpf/bpftool/common.c
> index cc6e6aae2447..6d8bbc3ec603 100644
> --- a/tools/bpf/bpftool/common.c
> +++ b/tools/bpf/bpftool/common.c
> @@ -338,7 +338,7 @@ void get_prog_full_name(const struct bpf_prog_info *prog_info, int prog_fd,
>  {
>         const char *prog_name = prog_info->name;
>         const struct btf_type *func_type;
> -       const struct bpf_func_info finfo = {};
> +       struct bpf_func_info finfo = {};
>         struct bpf_prog_info info = {};
>         __u32 info_len = sizeof(info);
>         struct btf *prog_btf = NULL;
> --
> 2.44.0
>


-- 
Thanks,
~Nick Desaulniers