netdev - Re: [PATCH bpf-next] bpf: add test cases for non-pointer sanitiation logic

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 1 Mar 2019 16:04:28 -0800
From:   Song Liu <liu.song.a23@...il.com>
To:     Daniel Borkmann <daniel@...earbox.net>
Cc:     Alexei Starovoitov <ast@...com>, afabre@...udflare.com,
        Marek Majkowski <marek@...udflare.com>,
        bpf <bpf@...r.kernel.org>, Networking <netdev@...r.kernel.org>
Subject: Re: [PATCH bpf-next] bpf: add test cases for non-pointer sanitiation logic

On Fri, Mar 1, 2019 at 3:27 PM Daniel Borkmann <daniel@...earbox.net> wrote:
>
> On 03/02/2019 12:22 AM, Song Liu wrote:
> > On Fri, Mar 1, 2019 at 1:10 PM Daniel Borkmann <daniel@...earbox.net> wrote:
> >>
> >> Add two additional tests for further asserting the
> >> BPF_ALU_NON_POINTER logic with cases that were missed
> >> previously.
> >>
> >> Signed-off-by: Daniel Borkmann <daniel@...earbox.net>
> >> Cc: Marek Majkowski <marek@...udflare.com>
> >> Cc: Arthur Fabre <afabre@...udflare.com>
> >> ---
> >>  .../selftests/bpf/verifier/value_ptr_arith.c  | 44 ++++++++++++++++++-
> >>  1 file changed, 43 insertions(+), 1 deletion(-)
> >>
> >> diff --git a/tools/testing/selftests/bpf/verifier/value_ptr_arith.c b/tools/testing/selftests/bpf/verifier/value_ptr_arith.c
> >> index 4b721a77bebb..c3de1a2c9dc5 100644
> >> --- a/tools/testing/selftests/bpf/verifier/value_ptr_arith.c
> >> +++ b/tools/testing/selftests/bpf/verifier/value_ptr_arith.c
> >> @@ -173,7 +173,7 @@
> >>         .retval = 0,
> >>  },
> >>  {
> >> -       "sanitation: alu with different scalars",
> >> +       "sanitation: alu with different scalars 1",
> >>         .insns = {
> >>         BPF_MOV64_IMM(BPF_REG_0, 1),
> >>         BPF_LD_MAP_FD(BPF_REG_ARG1, 0),
> >> @@ -198,6 +198,48 @@
> >>         .result = ACCEPT,
> >>         .retval = 0x100000,
> >>  },
> >> +{
> >> +       "sanitation: alu with different scalars 2",
> >> +       .insns = {
> >> +       BPF_MOV64_IMM(BPF_REG_0, 1),
> >> +       BPF_LD_MAP_FD(BPF_REG_1, 0),
> >> +       BPF_MOV64_REG(BPF_REG_6, BPF_REG_1),
> >> +       BPF_MOV64_REG(BPF_REG_2, BPF_REG_FP),
> >> +       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
> >> +       BPF_ST_MEM(BPF_DW, BPF_REG_FP, -16, 0),
> >> +       BPF_EMIT_CALL(BPF_FUNC_map_delete_elem),
> >> +       BPF_MOV64_REG(BPF_REG_7, BPF_REG_0),
> >> +       BPF_MOV64_REG(BPF_REG_1, BPF_REG_6),
> >> +       BPF_MOV64_REG(BPF_REG_2, BPF_REG_FP),
> >> +       BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -16),
> >> +       BPF_EMIT_CALL(BPF_FUNC_map_delete_elem),
> >> +       BPF_MOV64_REG(BPF_REG_6, BPF_REG_0),
> >> +       BPF_MOV64_REG(BPF_REG_8, BPF_REG_6),
> >> +       BPF_ALU64_REG(BPF_ADD, BPF_REG_8, BPF_REG_7),
> >> +       BPF_MOV64_REG(BPF_REG_0, BPF_REG_8),
> >> +       BPF_EXIT_INSN(),
> >> +       },
> >> +       .fixup_map_array_48b = { 1 },
> >> +       .result = ACCEPT,
> >> +       .retval = -EINVAL * 2,
> >
> > Why "-EINVAL * 2" here?
>
> This is array map so deletion will return -EINVAL, basically I
> wanted to get a test case under socket filters where helper
> returns a stable value which is then unknown scalar to do some
> alu64 op with where sanitation logic triggers. So map_delete_elem()
> came in handy for that test.

I see, so the *2 comes from

BPF_ALU64_REG(BPF_ADD, BPF_REG_8, BPF_REG_7)

Thanks for the explanation.

Acked-by: Song Liu <songliubraving@...com>