linux-kernel - Re: [PATCH bpf-next v1 3/8] bpf: Introduce load-acquire and store-release instructions

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <f5b72fa9460e4eda6e6b36756db855bfec67744a.camel@gmail.com>
Date: Tue, 28 Jan 2025 17:30:19 -0800
From: Eduard Zingerman <eddyz87@...il.com>
To: Peilin Ye <yepeilin@...gle.com>, bpf@...r.kernel.org, 
	linux-arm-kernel@...ts.infradead.org
Cc: bpf@...f.org, Xu Kuohai <xukuohai@...weicloud.com>, David Vernet	
 <void@...ifault.com>, Alexei Starovoitov <ast@...nel.org>, Daniel Borkmann	
 <daniel@...earbox.net>, Andrii Nakryiko <andrii@...nel.org>, Martin KaFai
 Lau	 <martin.lau@...ux.dev>, Song Liu <song@...nel.org>, Yonghong Song	
 <yonghong.song@...ux.dev>, John Fastabend <john.fastabend@...il.com>, KP
 Singh	 <kpsingh@...nel.org>, Stanislav Fomichev <sdf@...ichev.me>, Hao Luo	
 <haoluo@...gle.com>, Jiri Olsa <jolsa@...nel.org>, Jonathan Corbet	
 <corbet@....net>, "Paul E. McKenney" <paulmck@...nel.org>, Puranjay Mohan	
 <puranjay@...nel.org>, Catalin Marinas <catalin.marinas@....com>, Will
 Deacon	 <will@...nel.org>, Quentin Monnet <qmo@...nel.org>, Mykola Lysenko	
 <mykolal@...com>, Shuah Khan <shuah@...nel.org>, Josh Don
 <joshdon@...gle.com>,  Barret Rhoden <brho@...gle.com>, Neel Natu
 <neelnatu@...gle.com>, Benjamin Segall <bsegall@...gle.com>, 
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH bpf-next v1 3/8] bpf: Introduce load-acquire and
 store-release instructions

On Sat, 2025-01-25 at 02:18 +0000, Peilin Ye wrote:

[...]

> +static int check_atomic_store(struct bpf_verifier_env *env, int insn_idx,
> +			      struct bpf_insn *insn)
> +{
> +	int err;
> +
> +	err = check_reg_arg(env, insn->src_reg, SRC_OP);
> +	if (err)
> +		return err;
> +
> +	err = check_reg_arg(env, insn->dst_reg, SRC_OP);
> +	if (err)
> +		return err;
> +
> +	if (is_pointer_value(env, insn->src_reg)) {
> +		verbose(env, "R%d leaks addr into mem\n", insn->src_reg);
> +		return -EACCES;
> +	}

Nit: this check is done by check_mem_access(), albeit only for
     PTR_TO_MEM, I think it's better to be consistent with
     what happens for regular stores and avoid this check here.

> +
> +	if (!atomic_ptr_type_ok(env, insn->dst_reg, insn)) {
> +		verbose(env, "BPF_ATOMIC stores into R%d %s is not allowed\n",
> +			insn->dst_reg,
> +			reg_type_str(env, reg_state(env, insn->dst_reg)->type));
> +		return -EACCES;
> +	}
> +
> +	if (is_arena_reg(env, insn->dst_reg)) {
> +		err = save_aux_ptr_type(env, PTR_TO_ARENA, false);
> +		if (err)
> +			return err;
> +	}
> +
> +	/* Check whether we can write into the memory. */
> +	err = check_mem_access(env, insn_idx, insn->dst_reg, insn->off,
> +			       BPF_SIZE(insn->code), BPF_WRITE, insn->src_reg,
> +			       true, false);
> +	if (err)
> +		return err;
> +	return 0;
> +}

[...]