netdev - Re: [PATCH bpf-next 2/5] bpf: allow for tailcalls in BPF subprograms

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <912b5e97-1951-5a7c-e3c1-41bc3bf4b58a@iogearbox.net>
Date:   Thu, 16 Jul 2020 23:29:28 +0200
From:   Daniel Borkmann <daniel@...earbox.net>
To:     Maciej Fijalkowski <maciej.fijalkowski@...el.com>, ast@...nel.org
Cc:     bpf@...r.kernel.org, netdev@...r.kernel.org, bjorn.topel@...el.com,
        magnus.karlsson@...el.com
Subject: Re: [PATCH bpf-next 2/5] bpf: allow for tailcalls in BPF subprograms

On 7/16/20 1:36 AM, Maciej Fijalkowski wrote:
> Relax verifier's restriction that was meant to forbid tailcall usage
> when subprog count was higher than 1.
> 
> Also, do not max out the stack depth of program that utilizes tailcalls.
> 
> Signed-off-by: Maciej Fijalkowski <maciej.fijalkowski@...el.com>
> ---
>   kernel/bpf/verifier.c | 5 -----
>   1 file changed, 5 deletions(-)
> 
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 3c1efc9d08fd..6481342b31ba 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -4172,10 +4172,6 @@ static int check_map_func_compatibility(struct bpf_verifier_env *env,
>   	case BPF_FUNC_tail_call:
>   		if (map->map_type != BPF_MAP_TYPE_PROG_ARRAY)
>   			goto error;
> -		if (env->subprog_cnt > 1) {
> -			verbose(env, "tail_calls are not allowed in programs with bpf-to-bpf calls\n");
> -			return -EINVAL;
> -		}
>   		break;
>   	case BPF_FUNC_perf_event_read:
>   	case BPF_FUNC_perf_event_output:
> @@ -10252,7 +10248,6 @@ static int fixup_bpf_calls(struct bpf_verifier_env *env)
>   			 * the program array.
>   			 */
>   			prog->cb_access = 1;
> -			env->prog->aux->stack_depth = MAX_BPF_STACK;
>   			env->prog->aux->max_pkt_offset = MAX_PACKET_OFF;
>   
>   			/* mark bpf_tail_call as different opcode to avoid

Also, isn't this broken when JIT is not used (as in stack oob access)?