netdev - Re: [PATCH net-next] bpf: enhance verifier to understand stack pointer arithmetic

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20170430.225732.1066032501940701451.davem@davemloft.net>
Date:   Sun, 30 Apr 2017 22:57:32 -0400 (EDT)
From:   David Miller <davem@...emloft.net>
To:     ast@...com
Cc:     daniel@...earbox.net, netdev@...r.kernel.org, kernel-team@...com
Subject: Re: [PATCH net-next] bpf: enhance verifier to understand stack
 pointer arithmetic

From: Alexei Starovoitov <ast@...com>
Date: Sat, 29 Apr 2017 22:52:42 -0700

> From: Yonghong Song <yhs@...com>
> 
> llvm 4.0 and above generates the code like below:
> ....
> 440: (b7) r1 = 15
> 441: (05) goto pc+73
> 515: (79) r6 = *(u64 *)(r10 -152)
> 516: (bf) r7 = r10
> 517: (07) r7 += -112
> 518: (bf) r2 = r7
> 519: (0f) r2 += r1
> 520: (71) r1 = *(u8 *)(r8 +0)
> 521: (73) *(u8 *)(r2 +45) = r1
> ....
> and the verifier complains "R2 invalid mem access 'inv'" for insn #521.
> This is because verifier marks register r2 as unknown value after #519
> where r2 is a stack pointer and r1 holds a constant value.
> 
> Teach verifier to recognize "stack_ptr + imm" and
> "stack_ptr + reg with const val" as valid stack_ptr with new offset.
> 
> Signed-off-by: Yonghong Song <yhs@...com>
> Acked-by: Martin KaFai Lau <kafai@...com>
> Acked-by: Daniel Borkmann <daniel@...earbox.net>
> Signed-off-by: Alexei Starovoitov <ast@...nel.org>
> ---
> technically it's 'net' material, but it's too late for 'net',
> hence 'net-next' tag.
> No 'Fixes' tag, since it's only seen with newer llvm.

Applied to net-next, but I'll queue this up to -stable.