netdev - Re: [PATCH v2 bpf-next 3/7] bpf: track reference type in verifier

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 22 May 2020 11:53:26 -0700
From:   Andrii Nakryiko <andrii.nakryiko@...il.com>
To:     Alexei Starovoitov <alexei.starovoitov@...il.com>
Cc:     Andrii Nakryiko <andriin@...com>, bpf <bpf@...r.kernel.org>,
        Networking <netdev@...r.kernel.org>,
        Alexei Starovoitov <ast@...com>,
        Daniel Borkmann <daniel@...earbox.net>,
        Kernel Team <kernel-team@...com>,
        "Paul E . McKenney" <paulmck@...nel.org>,
        Jonathan Lemon <jonathan.lemon@...il.com>
Subject: Re: [PATCH v2 bpf-next 3/7] bpf: track reference type in verifier

On Thu, May 21, 2020 at 6:13 PM Alexei Starovoitov
<alexei.starovoitov@...il.com> wrote:
>
> On Sun, May 17, 2020 at 12:57:23PM -0700, Andrii Nakryiko wrote:
> >
> > +static enum bpf_ref_type get_release_ref_type(enum bpf_func_id func_id)
> > +{
> > +     switch (func_id) {
> > +     case BPF_FUNC_sk_release:
> > +             return BPF_REF_SOCKET;
> > +     case BPF_FUNC_ringbuf_submit:
> > +     case BPF_FUNC_ringbuf_discard:
> > +             return BPF_REF_RINGBUF;
> > +     default:
> > +             return BPF_REF_INVALID;
> > +     }
> > +}
> > +
> >  static bool may_be_acquire_function(enum bpf_func_id func_id)
> >  {
> >       return func_id == BPF_FUNC_sk_lookup_tcp ||
> > @@ -464,6 +477,28 @@ static bool is_acquire_function(enum bpf_func_id func_id,
> >       return false;
> >  }
> >
> > +static enum bpf_ref_type get_acquire_ref_type(enum bpf_func_id func_id,
> > +                                           const struct bpf_map *map)
> > +{
> > +     enum bpf_map_type map_type = map ? map->map_type : BPF_MAP_TYPE_UNSPEC;
> > +
> > +     switch (func_id) {
> > +     case BPF_FUNC_sk_lookup_tcp:
> > +     case BPF_FUNC_sk_lookup_udp:
> > +     case BPF_FUNC_skc_lookup_tcp:
> > +             return BPF_REF_SOCKET;
> > +     case BPF_FUNC_map_lookup_elem:
> > +             if (map_type == BPF_MAP_TYPE_SOCKMAP ||
> > +                 map_type == BPF_MAP_TYPE_SOCKHASH)
> > +                     return BPF_REF_SOCKET;
> > +             return BPF_REF_INVALID;
> > +     case BPF_FUNC_ringbuf_reserve:
> > +             return BPF_REF_RINGBUF;
> > +     default:
> > +             return BPF_REF_INVALID;
> > +     }
> > +}
>
> Two switch() stmts to convert helpers to REF is kinda hacky.
> I think get_release_ref_type() could have got the ref's type as btf_id from its
> arguments which would have made it truly generic and 'enum bpf_ref_type' would
> be unnecessary, but sk_lookup_* helpers return u64 and don't have btf_id of
> return value. I think we better fix that. Then btf_id would be that ref type.

True, sure. I'll drop this patch in next version, because everything
works without it. Then we can generalize this eventually.