netdev - Re: [PATCH bpf-next 1/6] libbpf: Sanitize BTF_KIND

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <d2fab68b-cd03-7a15-e353-c614f6079b89@fb.com>
Date:   Wed, 8 Jan 2020 18:57:18 +0000
From:   Yonghong Song <yhs@...com>
To:     Alexei Starovoitov <ast@...nel.org>,
        "davem@...emloft.net" <davem@...emloft.net>
CC:     "daniel@...earbox.net" <daniel@...earbox.net>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>,
        "bpf@...r.kernel.org" <bpf@...r.kernel.org>,
        "Kernel Team" <Kernel-team@...com>
Subject: Re: [PATCH bpf-next 1/6] libbpf: Sanitize BTF_KIND_FUNC linkage



On 1/7/20 11:25 PM, Alexei Starovoitov wrote:
> In case kernel doesn't support static/global/extern liknage of BTF_KIND_FUNC
> sanitize BTF produced by llvm.
> 
> Signed-off-by: Alexei Starovoitov <ast@...nel.org>
> ---
>   tools/include/uapi/linux/btf.h |  6 ++++++
>   tools/lib/bpf/libbpf.c         | 35 +++++++++++++++++++++++++++++++++-
>   2 files changed, 40 insertions(+), 1 deletion(-)
> 
> diff --git a/tools/include/uapi/linux/btf.h b/tools/include/uapi/linux/btf.h
> index 1a2898c482ee..5a667107ad2c 100644
> --- a/tools/include/uapi/linux/btf.h
> +++ b/tools/include/uapi/linux/btf.h
> @@ -146,6 +146,12 @@ enum {
>   	BTF_VAR_GLOBAL_EXTERN = 2,
>   };
>   
> +enum btf_func_linkage {
> +	BTF_FUNC_STATIC = 0,
> +	BTF_FUNC_GLOBAL = 1,
> +	BTF_FUNC_EXTERN = 2,
> +};
> +
>   /* BTF_KIND_VAR is followed by a single "struct btf_var" to describe
>    * additional information related to the variable such as its linkage.
>    */
> diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
> index 7513165b104f..f72b3ed6c34b 100644
> --- a/tools/lib/bpf/libbpf.c
> +++ b/tools/lib/bpf/libbpf.c
> @@ -166,6 +166,8 @@ struct bpf_capabilities {
>   	__u32 btf_datasec:1;
>   	/* BPF_F_MMAPABLE is supported for arrays */
>   	__u32 array_mmap:1;
> +	/* static/global/extern is supported for BTF_KIND_FUNC */
> +	__u32 btf_func_linkage:1;
>   };
>   
>   enum reloc_type {
> @@ -1817,13 +1819,14 @@ static bool section_have_execinstr(struct bpf_object *obj, int idx)
>   
>   static void bpf_object__sanitize_btf(struct bpf_object *obj)
>   {
> +	bool has_func_linkage = obj->caps.btf_func_linkage;
>   	bool has_datasec = obj->caps.btf_datasec;
>   	bool has_func = obj->caps.btf_func;
>   	struct btf *btf = obj->btf;
>   	struct btf_type *t;
>   	int i, j, vlen;
>   
> -	if (!obj->btf || (has_func && has_datasec))
> +	if (!obj->btf || (has_func && has_datasec && has_func_linkage))
>   		return;
>   
>   	for (i = 1; i <= btf__get_nr_types(btf); i++) {
> @@ -1871,6 +1874,9 @@ static void bpf_object__sanitize_btf(struct bpf_object *obj)
>   		} else if (!has_func && btf_is_func(t)) {
>   			/* replace FUNC with TYPEDEF */
>   			t->info = BTF_INFO_ENC(BTF_KIND_TYPEDEF, 0, 0);
> +		} else if (!has_func_linkage && btf_is_func(t)) {
> +			/* replace BTF_FUNC_GLOBAL with BTF_FUNC_STATIC */
> +			t->info = BTF_INFO_ENC(BTF_KIND_FUNC, 0, 0);

The comment says we only sanitize BTF_FUNC_GLOBAL here.
Actually, it also sanitize BTF_FUNC_EXTERN.

Currently, in kernel/bpf/btf.c, we have
static int btf_check_all_types(struct btf_verifier_env *env)
{
		...
                 if (btf_type_is_func(t)) {
                         err = btf_func_check(env, t);
                         if (err)
                                 return err;
                 }
		...
}

btf_func_check() will ensure func btf_type->type is a func_proto
and all arguments of func_proto has a name except void which is
considered as varg.

For extern function, the argument name is lost in llvm/clang.

-bash-4.4$ cat test.c 

extern int foo(int a);
int test() { return foo(5); }
-bash-4.4$
-bash-4.4$ clang -target bpf -O2 -g -S -emit-llvm test.c

!2 = !{}
!4 = !DISubprogram(name: "foo", scope: !1, file: !1, line: 1, type: !5, 
flags: DIFlagPrototyped, spFlags: DISPFlagOptimized, retainedNodes: !2)
!5 = !DISubroutineType(types: !6)
!6 = !{!7, !7}
!7 = !DIBasicType(name: "int", size: 32, encoding: DW_ATE_signed)

To avoid kernel complaints, we need to sanitize in a different way.
For example extern BTF_KIND_FUNC could be rewritten to a
BTF_KIND_PTR to void.

>   		}
>   	}
>   }
> @@ -2804,6 +2810,32 @@ static int bpf_object__probe_btf_func(struct bpf_object *obj)
>   	return 0;
>   }
>   
> +static int bpf_object__probe_btf_func_linkage(struct bpf_object *obj)
> +{
> +	static const char strs[] = "\0int\0x\0a";
> +	/* static void x(int a) {} */
> +	__u32 types[] = {
> +		/* int */
> +		BTF_TYPE_INT_ENC(1, BTF_INT_SIGNED, 0, 32, 4),  /* [1] */
> +		/* FUNC_PROTO */                                /* [2] */
> +		BTF_TYPE_ENC(0, BTF_INFO_ENC(BTF_KIND_FUNC_PROTO, 0, 1), 0),
> +		BTF_PARAM_ENC(7, 1),
> +		/* FUNC x BTF_FUNC_GLOBAL */                    /* [3] */
> +		BTF_TYPE_ENC(5, BTF_INFO_ENC(BTF_KIND_FUNC, 0, 1), 2),
> +	};
> +	int btf_fd;
> +
> +	btf_fd = libbpf__load_raw_btf((char *)types, sizeof(types),
> +				      strs, sizeof(strs));
> +	if (btf_fd >= 0) {
> +		obj->caps.btf_func_linkage = 1;
> +		close(btf_fd);
> +		return 1;
> +	}
> +
> +	return 0;
> +}
> +
>   static int bpf_object__probe_btf_datasec(struct bpf_object *obj)
>   {
>   	static const char strs[] = "\0x\0.data";
> @@ -2859,6 +2891,7 @@ bpf_object__probe_caps(struct bpf_object *obj)
>   		bpf_object__probe_name,
>   		bpf_object__probe_global_data,
>   		bpf_object__probe_btf_func,
> +		bpf_object__probe_btf_func_linkage,
>   		bpf_object__probe_btf_datasec,
>   		bpf_object__probe_array_mmap,
>   	};
>