linux-kernel - Re: [PATCH bpf-next 1/3] bpf: verifier: Do not extract constant map keys for irrelevant maps

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <3kzwzsfyghdogwv2jghmkamzierq64l6zgozo3urja5fenzcqg@7yplvj3x3oqp>
Date: Tue, 4 Feb 2025 02:09:43 -0700
From: Daniel Xu <dxu@...uu.xyz>
To: Eduard Zingerman <eddyz87@...il.com>
Cc: daniel@...earbox.net, andrii@...nel.org, ast@...nel.org, 
	john.fastabend@...il.com, martin.lau@...ux.dev, song@...nel.org, yonghong.song@...ux.dev, 
	kpsingh@...nel.org, sdf@...ichev.me, haoluo@...gle.com, jolsa@...nel.org, 
	bpf@...r.kernel.org, linux-kernel@...r.kernel.org, mhartmay@...ux.ibm.com, 
	iii@...ux.ibm.com
Subject: Re: [PATCH bpf-next 1/3] bpf: verifier: Do not extract constant map
 keys for irrelevant maps

On Mon, Feb 03, 2025 at 10:45:35AM -0800, Eduard Zingerman wrote:
> On Sat, 2025-02-01 at 12:58 -0700, Daniel Xu wrote:
> > Previously, we were trying to extract constant map keys for all
> > bpf_map_lookup_elem(), regardless of map type. This is an issue if the
> > map has a u64 key and the value is very high, as it can be interpreted
> > as a negative signed value. This in turn is treated as an error value by
> > check_func_arg() which causes a valid program to be incorrectly
> > rejected.
> > 
> > Fix by only extracting constant map keys for relevant maps. See next
> > commit for an example via selftest.
> > 
> > Reported-by: Marc Hartmayer <mhartmay@...ux.ibm.com>
> > Reported-by: Ilya Leoshkevich <iii@...ux.ibm.com>
> > Tested-by: Marc Hartmayer <mhartmay@...ux.ibm.com>
> > Signed-off-by: Daniel Xu <dxu@...uu.xyz>
> 
> Acked-by: Eduard Zingerman <eddyz87@...il.com>
> 
> Nit:
>   would be good if commit message said something along the lines:
>   ... the fix works because nullness elision is only allowed for
>       {PERCPU_}ARRAY maps, and keys for these are within u32 range ...

Ack. I can respin if necessary. Otherwise, here's the edited commit msg:

    bpf: verifier: Do not extract constant map keys for irrelevant maps

    Previously, we were trying to extract constant map keys for all
    bpf_map_lookup_elem(), regardless of map type. This is an issue if the
    map has a u64 key and the value is very high, as it can be interpreted
    as a negative signed value. This in turn is treated as an error value by
    check_func_arg() which causes a valid program to be incorrectly
    rejected.

    Fix by only extracting constant map keys for relevant maps. This fix
    works because nullness elision is only allowed for {PERCPU_}ARRAY maps,
    and keys for these are within u32 range. See next commit for an example
    via selftest.

    Acked-by: Eduard Zingerman <eddyz87@...il.com>
    Reported-by: Marc Hartmayer <mhartmay@...ux.ibm.com>
    Reported-by: Ilya Leoshkevich <iii@...ux.ibm.com>
    Tested-by: Marc Hartmayer <mhartmay@...ux.ibm.com>