netdev - Re: Self-XORing BPF registers is undefined behavior

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4cdabfb9-afe6-3180-28c9-60507dcdc55e@gmail.com>
Date:   Thu, 13 Dec 2018 03:06:30 -0800
From:   Eric Dumazet <eric.dumazet@...il.com>
To:     Alexander Potapenko <glider@...gle.com>, ast@...nel.org,
        daniel@...earbox.net
Cc:     Dmitriy Vyukov <dvyukov@...gle.com>,
        Networking <netdev@...r.kernel.org>
Subject: Re: Self-XORing BPF registers is undefined behavior



On 12/13/2018 03:00 AM, Alexander Potapenko wrote:
> Hi BPF maintainers,
> 
> some time ago KMSAN found an issue in BPF code which we decided to
> suppress at that point, but now I'd like to bring it to your
> attention.
> Namely, some BPF programs may contain instructions that XOR a register
> with itself.
> This effectively results in the following C code:
>   regs[BPF_REG_A] = regs[BPF_REG_A] ^ regs[BPF_REG_A];
> or
>   regs[BPF_REG_X] = regs[BPF_REG_X] ^ regs[BPF_REG_X];
> being executed.
> 
> According to the C11 standard this is undefined behavior, so KMSAN
> reports an error in this case.

eBPF is not C11 ;)

XOR boolean operation on a cpu is following boolean logic, which is much stronger than
any C standard.


> 
> Do you think it's feasible to explicitly initialize the register
> values like it's done here:
> https://github.com/google/kmsan/commit/813c0f3d45ebfa321d70b4b06cc054518dd1d90d
> ?
> 
> Thanks,
> Alexander Potapenko
> Software Engineer
> 
> Google Germany GmbH
> Erika-Mann-Straße, 33
> 80636 München
> 
> Geschäftsführer: Paul Manicle, Halimah DeLaine Prado
> Registergericht und -nummer: Hamburg, HRB 86891
> Sitz der Gesellschaft: Hamburg
>