linux-kernel - Re: [PATCH bpf-next 09/11] bpf: Return PTR_ERR from push

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <87r02uu5ur.fsf@fau.de>
Date: Tue, 18 Mar 2025 08:59:24 +0100
From: Luis Gerhorst <luis.gerhorst@....de>
To: Eduard Zingerman <eddyz87@...il.com>
Cc: Alexei Starovoitov <ast@...nel.org>,  Daniel Borkmann
 <daniel@...earbox.net>,  Andrii Nakryiko <andrii@...nel.org>,  Martin
 KaFai Lau <martin.lau@...ux.dev>,  Song Liu <song@...nel.org>,  Yonghong
 Song <yonghong.song@...ux.dev>,  John Fastabend
 <john.fastabend@...il.com>,  KP Singh <kpsingh@...nel.org>,  Stanislav
 Fomichev <sdf@...ichev.me>,  Hao Luo <haoluo@...gle.com>,  Jiri Olsa
 <jolsa@...nel.org>,  Puranjay Mohan <puranjay@...nel.org>,  Xu Kuohai
 <xukuohai@...weicloud.com>,  Catalin Marinas <catalin.marinas@....com>,
  Will Deacon <will@...nel.org>,  Hari Bathini <hbathini@...ux.ibm.com>,
  Christophe Leroy <christophe.leroy@...roup.eu>,  Naveen N Rao
 <naveen@...nel.org>,  Madhavan Srinivasan <maddy@...ux.ibm.com>,  Michael
 Ellerman <mpe@...erman.id.au>,  Nicholas Piggin <npiggin@...il.com>,
  Mykola Lysenko <mykolal@...com>,  Shuah Khan <shuah@...nel.org>,
  Henriette Herzog <henriette.herzog@....de>,  Cupertino Miranda
 <cupertino.miranda@...cle.com>,  Matan Shachnai <m.shachnai@...il.com>,
  Dimitar Kanaliev <dimitar.kanaliev@...eground.com>,  Shung-Hsi Yu
 <shung-hsi.yu@...e.com>,  Daniel Xu <dxu@...uu.xyz>,  bpf@...r.kernel.org,
  linux-arm-kernel@...ts.infradead.org,  linux-kernel@...r.kernel.org,
  linuxppc-dev@...ts.ozlabs.org,  linux-kselftest@...r.kernel.org,  George
 Guo <guodongtai@...inos.cn>,  WANG Xuerui <git@...0n.name>,  Tiezhu Yang
 <yangtiezhu@...ngson.cn>,  Maximilian Ott <ott@...fau.de>,  Milan Stephan
 <milan.stephan@....de>
Subject: Re: [PATCH bpf-next 09/11] bpf: Return PTR_ERR from push_stack()

Eduard Zingerman <eddyz87@...il.com> writes:

> Could you please point me to a location, where exact error code
> returned by updated push_stack() matters?
> I checked push_stack() callgraph (in the attachment), but can't find
> anything.

Only with the final patch 11 ("bpf: Fall back to nospec for spec path
verification") applied, the error code should matter. Then, the error
code either matches `state->speculative &&
error_recoverable_with_nospec(err)` in do_check() if it was EINVAL (in
this case we heuristically avoided nested speculative path verification
but have to add a nospec), or we continue to raise the error (e.g.,
ENOMEM) from do_check().

Or is your question on this part from the commit message of patch 9?

  This changes the sanitization-case to returning -ENOMEM. However, this
  is more fitting as -EFAULT would indicate a verifier-internal bug.

This was referring to the sanitize_speculative_path() calls in
check_cond_jmp_op(). For that case, the error should also only be used
in do_check() with patch 11 applied. However, regarding this, EFAULT and
ENOMEM are treated the same (they both don't satisfy
error_recoverable_with_nospec()), therefore this change is primarily
made to not complicate the code.

I just became aware that there is some special handling of EFAULT as
discussed in c7a897843224 ("bpf: don't leave partial mangled prog in
jit_subprogs error path"). I will have look into this in detail to make
sure changing push_stack() from EFAULT to ENOMEM is OK.

Hope this answers your question.

Adding some of these details to v2 won't hurt I guess.