linux-kernel - Re: [PATCH bpf-next v5 4/5] bpf: verifier: Support eliding map lookup nullness

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <kghvgxu5wdkupssnq7dy5upuf2wscsxgsnwl2yoam4mwk3h5pn@wjjsliwg6fzl>
Date: Thu, 19 Dec 2024 14:41:28 -0700
From: Daniel Xu <dxu@...uu.xyz>
To: Andrii Nakryiko <andrii.nakryiko@...il.com>
Cc: Eduard Zingerman <eddyz87@...il.com>, andrii@...nel.org, 
	ast@...nel.org, shuah@...nel.org, daniel@...earbox.net, john.fastabend@...il.com, 
	martin.lau@...ux.dev, song@...nel.org, yonghong.song@...ux.dev, kpsingh@...nel.org, 
	sdf@...ichev.me, haoluo@...gle.com, jolsa@...nel.org, mykolal@...com, 
	bpf@...r.kernel.org, linux-kernel@...r.kernel.org, linux-kselftest@...r.kernel.org, 
	netdev@...r.kernel.org
Subject: Re: [PATCH bpf-next v5 4/5] bpf: verifier: Support eliding map
 lookup nullness

On Mon, Dec 16, 2024 at 03:24:01PM -0800, Andrii Nakryiko wrote:
> On Fri, Dec 13, 2024 at 7:13 PM Eduard Zingerman <eddyz87@...il.com> wrote:
> >
> > On Fri, 2024-12-13 at 19:44 -0700, Daniel Xu wrote:
> >
> > [...]
> >
> > > > > +       /* First handle precisely tracked STACK_ZERO, up to BPF_REG_SIZE */
> > > > > +       stype = state->stack[spi].slot_type;
> > > > > +       for (i = 0; i < BPF_REG_SIZE && stype[i] == STACK_ZERO; i++)
> > > >
> > > > it's Friday and I'm lazy, but please double-check that this works for
> > > > both big-endian and little-endian :)
> > >
> > > Any tips? Are the existing tests running thru s390x hosts in CI
> > > sufficient or should I add some tests writen in C (and not BPF
> > > assembler)? I can never think about endianness correctly...
> >
> > I think that if test operates on a key like:
> >
> >       valid key 15
> >              v
> >       0000000f   <-- written to stack as a single u64 value
> >       ^^^^^^^
> >     stack zero marks
> >
> > and is executed (e.g. using __retval annotation),
> > then CI passing for s390 should be enough.
> 
> +1, something like that where for big-endian it will be all zero while
> for little endian it would be 0xf (and then make sure that the test
> should *fail* by making sure that 0xf is not a valid index, so NULL
> check is necessary)

How would it work for LE to be 0xF but BE to be 0x0?

The prog passes a pointer to the beginning of the u32 to
bpf_map_lookup_elem(). The kernel does a 4 byte read starting from that
address. On both BE and LE all 4 bytes will be interpreted. So set bits
cannot just go away.

Am I missing something?

Thanks,
Daniel