netdev - Re: [PATCH] bpf: verifier: BPF_MOV don't mark dst reg if src == dst

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAOn4ftt2MmhNEJKTtBHN2RqCKAWaN1LQmkN0n4Qa0M_jJtFUzA@mail.gmail.com>
Date:   Mon, 30 Jul 2018 08:40:54 +0100
From:   Arthur Fabre <afabre@...udflare.com>
To:     Y Song <ys114321@...il.com>
Cc:     Daniel Borkmann <daniel@...earbox.net>,
        Alexei Starovoitov <ast@...nel.org>,
        netdev <netdev@...r.kernel.org>
Subject: Re: [PATCH] bpf: verifier: BPF_MOV don't mark dst reg if src == dst

On Fri, Jul 27, 2018 at 12:21 AM, Y Song <ys114321@...il.com> wrote:
> The SMIN/UMIN still should be 0 since there is no negative here due to
> smaller width?

Yes that makes sense.

> We can do better than unbounded for dst register of mov32, which is
> the code already
> doing?

coerce_reg_to_size() will preserve the bounds if they fit in a u32,
which is better than setting the bounds to [0, 2^32-1].
mark_reg_unknown() is called before for mov32 though, resetting the bounds.
Consequently using mov32 always results in the bounds being [0, 2^32-1].

> Could you explain (and add to the commit messages eventually) what
> are these unexpected errors?

A good example is:

        BPF_MOV32_IMM(BPF_REG_2, 0),
        BPF_MOV32_REG(BPF_REG_2, BPF_REG_2),
        BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_2),
        BPF_MOV64_IMM(BPF_REG_0, 0),
        BPF_EXIT_INSN(),

The 3rd instruction results in:

       math between ctx pointer and register with unbounded min value
is not allowed