netdev - sparc64 verifier failures..

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-Id: <20171219.153636.783486472609136549.davem@davemloft.net>
Date:   Tue, 19 Dec 2017 15:36:36 -0500 (EST)
From:   David Miller <davem@...emloft.net>
To:     daniel@...earbox.net
CC:     netdev@...r.kernel.org
Subject: sparc64 verifier failures..


I'm getting about 100 verifier failures on sparc64.

The vast majority of them seem to be due to misaligned packet
accesses.  Here is a sample of some of the failures.

#32/p invalid fp arithmetic FAIL
Unexpected error message!
0: (b7) r0 = 0
1: (bf) r1 = r10
2: (17) r1 -= 8
3: (7b) *(u64 *)(r1 +0) = r0
misaligned access off (0x0; 0xffffffffffffffff)+0+0 size 8
 ...
#160/p raw_stack: skb_load_bytes, spilled regs corruption FAIL
Unexpected error message!
0: (b7) r2 = 4
1: (bf) r6 = r10
2: (07) r6 += -8
3: (7b) *(u64 *)(r6 +0) = r1
4: (bf) r3 = r6
5: (b7) r4 = 8
6: (85) call bpf_skb_load_bytes#26
7: (79) r0 = *(u64 *)(r6 +0)
8: (61) r0 = *(u32 *)(r0 +8)
misaligned access off (0x0; 0xffffffffffffffff)+0+8 size 4
#161/p raw_stack: skb_load_bytes, spilled regs corruption 2 FAIL
Unexpected error message!
0: (b7) r2 = 4
1: (bf) r6 = r10
2: (07) r6 += -16
3: (7b) *(u64 *)(r6 -8) = r1
4: (7b) *(u64 *)(r6 +0) = r1
5: (7b) *(u64 *)(r6 +8) = r1
6: (bf) r3 = r6
7: (b7) r4 = 8
8: (85) call bpf_skb_load_bytes#26
9: (79) r0 = *(u64 *)(r6 -8)
10: (79) r2 = *(u64 *)(r6 +8)
11: (79) r3 = *(u64 *)(r6 +0)
12: (61) r0 = *(u32 *)(r0 +8)
13: (61) r2 = *(u32 *)(r2 +32)
14: (0f) r0 += r2
15: (61) r3 = *(u32 *)(r3 +4)
misaligned access off (0x0; 0xffffffffffffffff)+0+4 size 4
 ...
#184/p direct packet access: test15 (spill with xadd) FAIL
Unexpected error message!
0: (61) r2 = *(u32 *)(r1 +76)
1: (61) r3 = *(u32 *)(r1 +80)
2: (bf) r0 = r2
3: (07) r0 += 8
4: (2d) if r0 > r3 goto pc+8
 R0=pkt(id=0,off=8,r=8,imm=0) R1=ctx(id=0,off=0,imm=0) R2=pkt(id=0,off=0,r=8,imm=0) R3=pkt_end(id=0,off=0,imm=0) R10=fp0,call_-1
5: (b7) r5 = 4096
6: (bf) r4 = r10
7: (07) r4 += -8
8: (7b) *(u64 *)(r4 +0) = r2
9: (db) lock *(u64 *)(r4 +0) += r5
10: (79) r2 = *(u64 *)(r4 +0)
11: (63) *(u32 *)(r2 +0) = r5
misaligned access off (0x0; 0xffffffffffffffff)+0+0 size 4
 ...
#189/p direct packet access: test20 (x += pkt_ptr, 1) FAIL
Failed to load prog 'Permission denied'!
0: (61) r2 = *(u32 *)(r1 +76)
1: (61) r3 = *(u32 *)(r1 +80)
2: (b7) r0 = -1
3: (7b) *(u64 *)(r10 -8) = r0
4: (79) r0 = *(u64 *)(r10 -8)
5: (57) r0 &= 32767
6: (bf) r4 = r0
7: (0f) r4 += r2
8: (bf) r5 = r4
9: (07) r4 += 32766
10: (2d) if r4 > r3 goto pc+1
 R0=inv(id=0,umax_value=32767,var_off=(0x0; 0x7fff)) R1=ctx(id=0,off=0,imm=0) R2=pkt(id=0,off=0,r=0,imm=0) R3=pkt_end(id=0,off=0,imm=0) R4=pkt(id=1,off=32766,r=32766,umax_value=32767,var_off=(0x0; 0x7fff)) R5=pkt(id=1,off=0,r=32766,umax_value=32767,var_off=(0x0; 0x7fff)) R10=fp0,call_-1
11: (7b) *(u64 *)(r5 +0) = r4
misaligned packet access off 2+(0x0; 0x7fff)+0+0 size 8
#190/p direct packet access: test21 (x += pkt_ptr, 2) FAIL
Failed to load prog 'Permission denied'!
0: (61) r2 = *(u32 *)(r1 +76)
1: (61) r3 = *(u32 *)(r1 +80)
2: (bf) r0 = r2
3: (07) r0 += 8
4: (2d) if r0 > r3 goto pc+9
 R0=pkt(id=0,off=8,r=8,imm=0) R1=ctx(id=0,off=0,imm=0) R2=pkt(id=0,off=0,r=8,imm=0) R3=pkt_end(id=0,off=0,imm=0) R10=fp0,call_-1
5: (b7) r4 = -1
6: (7b) *(u64 *)(r10 -8) = r4
7: (79) r4 = *(u64 *)(r10 -8)
8: (57) r4 &= 32767
9: (0f) r4 += r2
10: (bf) r5 = r4
11: (07) r4 += 32766
12: (2d) if r4 > r3 goto pc+1
 R0=pkt(id=0,off=8,r=8,imm=0) R1=ctx(id=0,off=0,imm=0) R2=pkt(id=0,off=0,r=8,imm=0) R3=pkt_end(id=0,off=0,imm=0) R4=pkt(id=1,off=32766,r=32766,umax_value=32767,var_off=(0x0; 0x7fff)) R5=pkt(id=1,off=0,r=32766,umax_value=32767,var_off=(0x0; 0x7fff)) R10=fp0,call_-1
13: (7b) *(u64 *)(r5 +0) = r4
misaligned packet access off 2+(0x0; 0x7fff)+0+0 size 8
#191/p direct packet access: test22 (x += pkt_ptr, 3) FAIL
Failed to load prog 'Permission denied'!
0: (61) r2 = *(u32 *)(r1 +76)
1: (61) r3 = *(u32 *)(r1 +80)
2: (bf) r0 = r2
3: (07) r0 += 8
4: (7b) *(u64 *)(r10 -8) = r2
5: (7b) *(u64 *)(r10 -16) = r3
6: (79) r3 = *(u64 *)(r10 -16)
7: (2d) if r0 > r3 goto pc+11
 R0=pkt(id=0,off=8,r=8,imm=0) R1=ctx(id=0,off=0,imm=0) R2=pkt(id=0,off=0,r=8,imm=0) R3=pkt_end(id=0,off=0,imm=0) R10=fp0,call_-1 fp-8=pkt fp-16=pkt_end
8: (79) r2 = *(u64 *)(r10 -8)
9: (b7) r4 = -1
10: (db) lock *(u64 *)(r10 -8) += r4
11: (79) r4 = *(u64 *)(r10 -8)
12: (77) r4 >>= 49
13: (0f) r4 += r2
14: (bf) r0 = r4
15: (07) r0 += 2
16: (2d) if r0 > r3 goto pc+2
 R0=pkt(id=1,off=2,r=2,umax_value=32767,var_off=(0x0; 0x7fff)) R1=ctx(id=0,off=0,imm=0) R2=pkt(id=0,off=0,r=8,imm=0) R3=pkt_end(id=0,off=0,imm=0) R4=pkt(id=1,off=0,r=2,umax_value=32767,var_off=(0x0; 0x7fff)) R10=fp0,call_-1 fp-16=pkt_end
17: (b7) r2 = 1
18: (6b) *(u16 *)(r4 +0) = r2
misaligned packet access off 2+(0x0; 0x7fff)+0+0 size 2
#192/p direct packet access: test23 (x += pkt_ptr, 4) FAIL
Unexpected error message!
0: (61) r2 = *(u32 *)(r1 +76)
1: (61) r3 = *(u32 *)(r1 +80)
2: (b7) r0 = -1
3: (7b) *(u64 *)(r10 -8) = r0
4: (79) r0 = *(u64 *)(r10 -8)
5: (57) r0 &= 65535
6: (bf) r4 = r0
7: (b7) r0 = 31
8: (0f) r0 += r4
9: (0f) r0 += r2
10: (bf) r5 = r0
11: (07) r0 += 65534
12: (2d) if r0 > r3 goto pc+1
 R0=pkt(id=1,off=65534,r=0,umin_value=31,umax_value=65566,var_off=(0x0; 0x1ffff)) R1=ctx(id=0,off=0,imm=0) R2=pkt(id=0,off=0,r=0,imm=0) R3=pkt_end(id=0,off=0,imm=0) R4=inv(id=0,umax_value=65535,var_off=(0x0; 0xffff)) R5=pkt(id=1,off=0,r=0,umin_value=31,umax_value=65566,var_off=(0x0; 0x1ffff)) R10=fp0,call_-1
13: (7b) *(u64 *)(r5 +0) = r0
misaligned packet access off 2+(0x0; 0x1ffff)+0+0 size 8
#193/p direct packet access: test24 (x += pkt_ptr, 5) FAIL
Failed to load prog 'Permission denied'!
0: (61) r2 = *(u32 *)(r1 +76)
1: (61) r3 = *(u32 *)(r1 +80)
2: (b7) r0 = -1
3: (7b) *(u64 *)(r10 -8) = r0
4: (79) r0 = *(u64 *)(r10 -8)
5: (57) r0 &= 255
6: (bf) r4 = r0
7: (b7) r0 = 64
8: (0f) r0 += r4
9: (0f) r0 += r2
10: (bf) r5 = r0
11: (07) r0 += 32766
12: (2d) if r0 > r3 goto pc+1
 R0=pkt(id=1,off=32766,r=32766,umin_value=64,umax_value=319,var_off=(0x0; 0x1ff)) R1=ctx(id=0,off=0,imm=0) R2=pkt(id=0,off=0,r=0,imm=0) R3=pkt_end(id=0,off=0,imm=0) R4=inv(id=0,umax_value=255,var_off=(0x0; 0xff)) R5=pkt(id=1,off=0,r=32766,umin_value=64,umax_value=319,var_off=(0x0; 0x1ff)) R10=fp0,call_-1
13: (7b) *(u64 *)(r5 +0) = r0
misaligned packet access off 2+(0x0; 0x1ff)+0+0 size 8
 ...
#221/u valid map access into an array with a variable FAIL
Unexpected error message!
0: (7a) *(u64 *)(r10 -8) = 0
1: (bf) r2 = r10
2: (07) r2 += -8
3: (18) r1 = 0x0
5: (85) call bpf_map_lookup_elem#1
6: (15) if r0 == 0x0 goto pc+5
 R0=map_value(id=0,off=0,ks=8,vs=48,imm=0) R10=fp0,call_-1
7: (61) r1 = *(u32 *)(r0 +0)
 R0=map_value(id=0,off=0,ks=8,vs=48,imm=0) R10=fp0,call_-1
8: (35) if r1 >= 0xb goto pc+3
 R0=map_value(id=0,off=0,ks=8,vs=48,imm=0) R1=inv(id=0,umax_value=10,var_off=(0x0; 0xf)) R10=fp0,call_-1
9: (67) r1 <<= 2
10: (0f) r0 += r1
11: (7a) *(u64 *)(r0 +0) = 4
misaligned value access off (0x0; 0x3c)+0+0 size 8
#221/p valid map access into an array with a variable FAIL
Failed to load prog 'Permission denied'!
0: (7a) *(u64 *)(r10 -8) = 0
1: (bf) r2 = r10
2: (07) r2 += -8
3: (18) r1 = 0xfff8003fb5788e00
5: (85) call bpf_map_lookup_elem#1
6: (15) if r0 == 0x0 goto pc+5
 R0=map_value(id=0,off=0,ks=8,vs=48,imm=0) R10=fp0,call_-1
7: (61) r1 = *(u32 *)(r0 +0)
 R0=map_value(id=0,off=0,ks=8,vs=48,imm=0) R10=fp0,call_-1
8: (35) if r1 >= 0xb goto pc+3
 R0=map_value(id=0,off=0,ks=8,vs=48,imm=0) R1=inv(id=0,umax_value=10,var_off=(0x0; 0xf)) R10=fp0,call_-1
9: (67) r1 <<= 2
10: (0f) r0 += r1
11: (7a) *(u64 *)(r0 +0) = 4
misaligned value access off (0x0; 0x3c)+0+0 size 8
 ...
#222/p valid map access into an array with a signed variable FAIL
Failed to load prog 'Permission denied'!
0: (7a) *(u64 *)(r10 -8) = 0
1: (bf) r2 = r10
2: (07) r2 += -8
3: (18) r1 = 0xfff8003fb5789200
5: (85) call bpf_map_lookup_elem#1
6: (15) if r0 == 0x0 goto pc+9
 R0=map_value(id=0,off=0,ks=8,vs=48,imm=0) R10=fp0,call_-1
7: (61) r1 = *(u32 *)(r0 +0)
 R0=map_value(id=0,off=0,ks=8,vs=48,imm=0) R10=fp0,call_-1
8: (65) if r1 s> 0xffffffff goto pc+1
 R0=map_value(id=0,off=0,ks=8,vs=48,imm=0) R1=inv(id=0,umax_value=4294967295,var_off=(0x0; 0xffffffff)) R10=fp0,call_-1
9: (b4) (u32) r1 = (u32) 0
10: (b4) (u32) r2 = (u32) 11
11: (6d) if r2 s> r1 goto pc+1
 R0=map_value(id=0,off=0,ks=8,vs=48,imm=0) R1=inv0 R2=inv11 R10=fp0,call_-1
12: (b4) (u32) r1 = (u32) 0
13: (64) (u32) r1 <<= (u32) 2
14: (0f) r0 += r1
15: (7a) *(u64 *)(r0 +0) = 4
 R0_w=map_value(id=0,off=0,ks=8,vs=48,imm=0) R1_w=inv0 R2=inv11 R10=fp0,call_-1
16: (95) exit

from 11 to 13: safe

from 8 to 10: R0=map_value(id=0,off=0,ks=8,vs=48,imm=0) R1=inv(id=0,umax_value=4294967295,var_off=(0x0; 0xffffffff)) R10=fp0,call_-1
10: (b4) (u32) r2 = (u32) 11
11: (6d) if r2 s> r1 goto pc+1
 R0=map_value(id=0,off=0,ks=8,vs=48,imm=0) R1=inv(id=0,umin_value=11,umax_value=4294967295,var_off=(0x0; 0xffffffff)) R2=inv11 R10=fp0,call_-1
12: (b4) (u32) r1 = (u32) 0
13: safe

from 11 to 13: R0=map_value(id=0,off=0,ks=8,vs=48,imm=0) R1=inv(id=0,umax_value=10,var_off=(0x0; 0xf)) R2=inv11 R10=fp0,call_-1
13: (64) (u32) r1 <<= (u32) 2
14: (0f) r0 += r1
15: (7a) *(u64 *)(r0 +0) = 4
misaligned value access off (0x0; 0x3c)+0+0 size 8
 ...
Summary: 603 PASSED, 100 FAILED