netdev - Re: [PATCHv4 net-next 07/15] bpf: recognize 64bit immediate loads as consts

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 15 Sep 2016 13:12:15 -0700
From:   Alexei Starovoitov <alexei.starovoitov@...il.com>
To:     Jakub Kicinski <jakub.kicinski@...ronome.com>
Cc:     netdev@...r.kernel.org, ast@...nel.org, daniel@...earbox.net,
        jiri@...nulli.us, john.fastabend@...il.com, kubakici@...pl
Subject: Re: [PATCHv4 net-next 07/15] bpf: recognize 64bit immediate loads as
 consts

On Thu, Sep 15, 2016 at 08:12:27PM +0100, Jakub Kicinski wrote:
> When running as parser interpret BPF_LD | BPF_IMM | BPF_DW
> instructions as loading CONST_IMM with the value stored
> in imm.  The verifier will continue not recognizing those
> due to concerns about search space/program complexity
> increase.
> 
> Signed-off-by: Jakub Kicinski <jakub.kicinski@...ronome.com>
> ---
> v3:
>  - limit to parsers.
> ---
>  kernel/bpf/verifier.c | 14 ++++++++++++--
>  1 file changed, 12 insertions(+), 2 deletions(-)
> 
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index d93e78331b90..f5bed7cce08d 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -1766,9 +1766,19 @@ static int check_ld_imm(struct bpf_verifier_env *env, struct bpf_insn *insn)
>  	if (err)
>  		return err;
>  
> -	if (insn->src_reg == 0)
> -		/* generic move 64-bit immediate into a register */
> +	if (insn->src_reg == 0) {
> +		/* generic move 64-bit immediate into a register,
> +		 * only analyzer needs to collect the ld_imm value.
> +		 */
> +		u64 imm = ((u64)(insn + 1)->imm << 32) | (u32)insn->imm;
> +
> +		if (!env->analyzer_ops)
> +			return 0;

the check makes sense. thanks.
Acked-by: Alexei Starovoitov <ast@...nel.org>