linux-kernel - Re: [PATCH bpf] bpf: fix argument type in bpf

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAADnVQJGQ8b+E5m09Gd=bZAqQ2bLpHk+1r9vhB0As_PcmCzWpA@mail.gmail.com>
Date: Wed, 9 Oct 2024 11:27:15 -0700
From: Alexei Starovoitov <alexei.starovoitov@...il.com>
To: Matteo Croce <technoboy85@...il.com>
Cc: Andrii Nakryiko <andrii@...nel.org>, bpf <bpf@...r.kernel.org>, 
	Alexei Starovoitov <ast@...nel.org>, Daniel Borkmann <daniel@...earbox.net>, 
	LKML <linux-kernel@...r.kernel.org>, clang-built-linux <llvm@...ts.linux.dev>, 
	Matteo Croce <teknoraver@...a.com>
Subject: Re: [PATCH bpf] bpf: fix argument type in bpf_loop documentation

On Wed, Oct 9, 2024 at 11:05 AM Matteo Croce <technoboy85@...il.com> wrote:
>
> From: Matteo Croce <teknoraver@...a.com>
>
> The `index` argument to bpf_loop() is threaded as an u64.
> This lead in a subtle verifier denial where clang cloned the argument
> in another register[1].
>
> [1] https://github.com/systemd/systemd/pull/34650#issuecomment-2401092895
>
> Signed-off-by: Matteo Croce <teknoraver@...a.com>
> ---
>  include/uapi/linux/bpf.h | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
> index 8ab4d8184b9d..874af0186fe8 100644
> --- a/include/uapi/linux/bpf.h
> +++ b/include/uapi/linux/bpf.h
> @@ -5371,7 +5371,7 @@ union bpf_attr {
>   *             Currently, the **flags** must be 0. Currently, nr_loops is
>   *             limited to 1 << 23 (~8 million) loops.
>   *
> - *             long (\*callback_fn)(u32 index, void \*ctx);
> + *             long (\*callback_fn)(u64 index, void \*ctx);

Good catch.
Please update other places too:
static int set_loop_callback_state(struct bpf_verifier_env *env,
                                   struct bpf_func_state *caller,
                                   struct bpf_func_state *callee,
                                   int insn_idx)
{
        /* bpf_loop(u32 nr_loops, void *callback_fn, void *callback_ctx,
         *          u64 flags);
         * callback_fn(u32 index, void *callback_ctx);
         */
        callee->regs[BPF_REG_1].type = SCALAR_VALUE;
..

tools/include/uapi/linux/bpf.h

pw-bot: cr