netdev - Re: [PATCH v2 net-next] bpf: enable verifier to add 0 to packet ptr

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 3 Feb 2017 13:10:46 -0800
From:   William Tu <u9012063@...il.com>
To:     Alexei Starovoitov <alexei.starovoitov@...il.com>
Cc:     Linux Kernel Network Developers <netdev@...r.kernel.org>,
        Mihai Budiu <mbudiu@...are.com>
Subject: Re: [PATCH v2 net-next] bpf: enable verifier to add 0 to packet ptr

Hi Alexei,

why it is bogus? on my system, it fails without the patch applied.

--William

On Fri, Feb 3, 2017 at 12:55 PM, Alexei Starovoitov
<alexei.starovoitov@...il.com> wrote:
> On Fri, Feb 03, 2017 at 09:22:45AM -0800, William Tu wrote:
>> The patch fixes the case when adding a zero value to the packet
>> pointer.  The verifer reports the following error:
>>   [...]
>>     R0=imm0,min_value=0,max_value=0
>>     R1=pkt(id=0,off=0,r=4)
>>     R2=pkt_end R3=fp-12
>>     R4=imm4,min_value=4,max_value=4
>>     R5=pkt(id=0,off=4,r=4)
>>   269: (bf) r2 = r0   // r2 becomes imm0
>>   270: (77) r2 >>= 3
>>   271: (bf) r4 = r1   // r4 becomes pkt ptr
>>   272: (0f) r4 += r2  // r4 += 0
>>   addition of negative constant to packet pointer is not allowed
>>
>> Signed-off-by: William Tu <u9012063@...il.com>
>> Signed-off-by: Mihai Budiu <mbudiu@...are.com>
>> ---
>>  kernel/bpf/verifier.c                       |  2 +-
>>  tools/testing/selftests/bpf/test_verifier.c | 15 +++++++++++++++
>>  2 files changed, 16 insertions(+), 1 deletion(-)
>>
>> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
>> index fb3513b..1a754e5 100644
>> --- a/kernel/bpf/verifier.c
>> +++ b/kernel/bpf/verifier.c
>> @@ -1397,7 +1397,7 @@ static int check_packet_ptr_add(struct bpf_verifier_env *env,
>>               imm = insn->imm;
>>
>>  add_imm:
>> -             if (imm <= 0) {
>> +             if (imm < 0) {
>>                       verbose("addition of negative constant to packet pointer is not allowed\n");
>>                       return -EACCES;
>>               }
>> diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c
>> index 0d0912c..a2b5c7e 100644
>> --- a/tools/testing/selftests/bpf/test_verifier.c
>> +++ b/tools/testing/selftests/bpf/test_verifier.c
>> @@ -2404,6 +2404,21 @@ static struct bpf_test tests[] = {
>>               .prog_type = BPF_PROG_TYPE_SCHED_CLS,
>>       },
>>       {
>> +             "direct packet access: test14 (pkt_ptr += 0, good access)",
>> +             .insns = {
>> +                     BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
>> +                                 offsetof(struct __sk_buff, data)),
>> +                     BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
>> +                                 offsetof(struct __sk_buff, data_end)),
>> +                     BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
>> +                     BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0),
>
> wait. the test is bogus.
> please write the proper test for the feature
> and check that it fails before the patch and passes afterwards.
>
>> +                     BPF_MOV64_IMM(BPF_REG_0, 1),
>> +                     BPF_EXIT_INSN(),
>> +             },
>> +             .result = ACCEPT,
>> +             .prog_type = BPF_PROG_TYPE_SCHED_CLS,
>> +     },
>> +     {
>>               "helper access to packet: test1, valid packet_ptr range",
>>               .insns = {
>>                       BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
>> --
>> 2.7.4
>>