lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <ff1e49a8-57bb-a323-f477-018f9a6f0597@fb.com> Date: Sat, 20 Jun 2020 00:04:13 -0700 From: Yonghong Song <yhs@...com> To: Andrii Nakryiko <andriin@...com>, <bpf@...r.kernel.org>, <netdev@...r.kernel.org>, <ast@...com>, <daniel@...earbox.net> CC: <andrii.nakryiko@...il.com>, <kernel-team@...com> Subject: Re: [PATCH bpf] libbpf: fix CO-RE relocs against .text section On 6/19/20 4:04 PM, Andrii Nakryiko wrote: > bpf_object__find_program_by_title(), used by CO-RE relocation code, doesn't > return .text "BPF program", if it is a function storage for sub-programs. > Because of that, any CO-RE relocation in helper non-inlined functions will > fail. Fix this by searching for .text-corresponding BPF program manually. > > Adjust one of bpf_iter selftest to exhibit this pattern. > > Reported-by: Yonghong Song <yhs@...com> > Fixes: ddc7c3042614 ("libbpf: implement BPF CO-RE offset relocation algorithm") > Signed-off-by: Andrii Nakryiko <andriin@...com> Acked-by: Yonghong Song <yhs@...com> But the fix here only fixed the issue for interpreter mode. For jit only mode, we still have issues. The following patch can fix the jit mode issue, ============= From 4d66814513ec45b86a30a1231b8a000d4bfc6f1a Mon Sep 17 00:00:00 2001 From: Yonghong Song <yhs@...com> Date: Fri, 19 Jun 2020 23:26:13 -0700 Subject: [PATCH bpf] bpf: set the number of exception entries properly for subprograms Currently, if a bpf program has more than one subprograms, each program will be jitted separately. For tracing problem, the prog->aux->num_exentries is not setup properly. For example, with bpf_iter_netlink.c modified to force one function not inlined, and with proper libbpf fix, with CONFIG_BPF_JIT_ALWAYS_ON, we will have error like below: $ ./test_progs -n 3/3 ... libbpf: failed to load program 'iter/netlink' libbpf: failed to load object 'bpf_iter_netlink' libbpf: failed to load BPF skeleton 'bpf_iter_netlink': -4007 test_netlink:FAIL:bpf_iter_netlink__open_and_load skeleton open_and_load failed #3/3 netlink:FAIL The dmesg shows the following errors: ex gen bug which is triggered by the following code in arch/x86/net/bpf_jit_comp.c: if (excnt >= bpf_prog->aux->num_exentries) { pr_err("ex gen bug\n"); return -EFAULT; } If the program has more than one subprograms, num_exentries is actually 0 since it is not setup. This patch fixed the issue by setuping proper num_exentries for each subprogram before calling jit function. Signed-off-by: Yonghong Song <yhs@...com> --- kernel/bpf/verifier.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 34cde841ab68..7d8b23ba825c 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -9801,7 +9801,7 @@ static int jit_subprogs(struct bpf_verifier_env *env) int i, j, subprog_start, subprog_end = 0, len, subprog; struct bpf_insn *insn; void *old_bpf_func; - int err; + int err, num_exentries; if (env->subprog_cnt <= 1) return 0; @@ -9876,6 +9876,16 @@ static int jit_subprogs(struct bpf_verifier_env *env) func[i]->aux->nr_linfo = prog->aux->nr_linfo; func[i]->aux->jited_linfo = prog->aux->jited_linfo; func[i]->aux->linfo_idx = env->subprog_info[i].linfo_idx; + + num_exentries = 0; + insn = func[i]->insnsi; + for (j = 0; j < func[i]->len; j++, insn++) { + if (BPF_CLASS(insn->code) == BPF_LDX && + BPF_MODE(insn->code) == BPF_PROBE_MEM) + num_exentries++; + } + func[i]->aux->num_exentries = num_exentries; + func[i] = bpf_int_jit_compile(func[i]); if (!func[i]->jited) { err = -ENOTSUPP; -- 2.24.1 ================ We need this (or similar fixes) go in together with libbpf fix to avoid bpf_iter_netlink.c test failure at jit only mode. Do we need a separate patch for the above fix? Or Andrii can fold this into his patch and resubmit? Maybe the latter is better. > --- > tools/lib/bpf/libbpf.c | 8 +++++++- > tools/testing/selftests/bpf/progs/bpf_iter_netlink.c | 2 +- > 2 files changed, 8 insertions(+), 2 deletions(-) > > diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c > index 477c679ed945..f17151d866e6 100644 > --- a/tools/lib/bpf/libbpf.c > +++ b/tools/lib/bpf/libbpf.c > @@ -4818,7 +4818,13 @@ bpf_core_reloc_fields(struct bpf_object *obj, const char *targ_btf_path) > err = -EINVAL; > goto out; > } > - prog = bpf_object__find_program_by_title(obj, sec_name); > + prog = NULL; > + for (i = 0; i < obj->nr_programs; i++) { > + if (!strcmp(obj->programs[i].section_name, sec_name)) { > + prog = &obj->programs[i]; > + break; > + } > + } > if (!prog) { > pr_warn("failed to find program '%s' for CO-RE offset relocation\n", > sec_name); > diff --git a/tools/testing/selftests/bpf/progs/bpf_iter_netlink.c b/tools/testing/selftests/bpf/progs/bpf_iter_netlink.c > index e7b8753eac0b..75ecf956a2df 100644 > --- a/tools/testing/selftests/bpf/progs/bpf_iter_netlink.c > +++ b/tools/testing/selftests/bpf/progs/bpf_iter_netlink.c > @@ -25,7 +25,7 @@ struct bpf_iter__netlink { > struct netlink_sock *sk; > } __attribute__((preserve_access_index)); > > -static inline struct inode *SOCK_INODE(struct socket *socket) > +static __attribute__((noinline)) struct inode *SOCK_INODE(struct socket *socket) > { > return &container_of(socket, struct socket_alloc, socket)->vfs_inode; > } >
Powered by blists - more mailing lists