netdev - Re: [PATCH net-next 5/5] bpf: write back the verifier log buffer as it gets filled

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <59D6A80F.8030208@iogearbox.net>
Date:   Thu, 05 Oct 2017 23:45:51 +0200
From:   Daniel Borkmann <daniel@...earbox.net>
To:     Jakub Kicinski <kubakici@...pl>
CC:     netdev@...r.kernel.org, alexei.starovoitov@...il.com,
        oss-drivers@...ronome.com
Subject: Re: [PATCH net-next 5/5] bpf: write back the verifier log buffer
 as it gets filled

On 10/05/2017 11:26 PM, Jakub Kicinski wrote:
> On Thu, 05 Oct 2017 23:10:03 +0200, Daniel Borkmann wrote:
>>>    include/linux/bpf_verifier.h |  7 +++--
>>>    kernel/bpf/verifier.c        | 64 +++++++++++++++++++++++++++++++-------------
>>>    2 files changed, 50 insertions(+), 21 deletions(-)
>>>
>>> diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h
>>> index 598802dd1897..c0f0e210c3f8 100644
>>> --- a/include/linux/bpf_verifier.h
>>> +++ b/include/linux/bpf_verifier.h
>>> @@ -140,10 +140,13 @@ struct bpf_verifier_env {
>>>    	bool seen_direct_write;
>>>    	struct bpf_insn_aux_data *insn_aux_data; /* array of per-insn state */
>>>
>>> -	u32 log_level;
>>> +	char __user *log_ubuf;
>>> +	u32 log_usize;
>>> +	u32 log_ulen;
>>> +	char *log_buf;
>>>    	u32 log_size;
>>>    	u32 log_len;
>>> -	char *log_buf;
>>> +	u32 log_level;
>>
>> Small request: given we'd now have log_{level,ubuf,usize,ulen,buf,size,len}
>> in struct bpf_verifier_env, could we abstract that a bit e.g. into something
>> like struct bpf_verifier_log, which has level and kbuf and ubuf as members
>> of which {k,u}buf would be something like struct bpf_verifier_buf with three
>> members (mem or buf, len_total, len_used) or such. I think most of patch 1
>> is on passing env into verbose, so likely wouldn't be too much change required
>> for this, but would be nice to make that a bit more structured if we need to
>> touch it anyway.
>
> I thought about it but got put off by the fact that on of the bufs has
> a special __user marking..  So I don't think we can really have a common
> struct bpf_verifier_buf for the two :S  Any suggestions on how to work
> around that?

Little bit annoying, I know. We have same 'issue' with struct sock_fprog_kern
and struct sock_fprog, probably something similar would be needed here for
the bpf_verifier_buf thing as well to make it two structs.

>>>    		ret = -ENOMEM;
>>> -		env->log_buf = vmalloc(env->log_size);
>>> +		env->log_buf = page_address(alloc_page(GFP_USER));
>>
>> alloc_page() can return NULL, if I spot this correctly, then page_address()
>> cannot handle NULL and would try to deref it, no? Am I missing something?
>
> Oh, I need to fix the nfp driver too, then!