netdev - Re: [PATCH bpf-next 2/5] bpf: allow for tailcalls in BPF subprograms

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 17 Jul 2020 00:46:19 +0200
From:   Daniel Borkmann <daniel@...earbox.net>
To:     Maciej Fijalkowski <maciej.fijalkowski@...el.com>, ast@...nel.org
Cc:     bpf@...r.kernel.org, netdev@...r.kernel.org, bjorn.topel@...el.com,
        magnus.karlsson@...el.com
Subject: Re: [PATCH bpf-next 2/5] bpf: allow for tailcalls in BPF subprograms

On 7/16/20 11:29 PM, Daniel Borkmann wrote:
> On 7/16/20 1:36 AM, Maciej Fijalkowski wrote:
>> Relax verifier's restriction that was meant to forbid tailcall usage
>> when subprog count was higher than 1.
>>
>> Also, do not max out the stack depth of program that utilizes tailcalls.
>>
>> Signed-off-by: Maciej Fijalkowski <maciej.fijalkowski@...el.com>
>> ---
>>   kernel/bpf/verifier.c | 5 -----
>>   1 file changed, 5 deletions(-)
>>
>> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
>> index 3c1efc9d08fd..6481342b31ba 100644
>> --- a/kernel/bpf/verifier.c
>> +++ b/kernel/bpf/verifier.c
>> @@ -4172,10 +4172,6 @@ static int check_map_func_compatibility(struct bpf_verifier_env *env,
>>       case BPF_FUNC_tail_call:
>>           if (map->map_type != BPF_MAP_TYPE_PROG_ARRAY)
>>               goto error;
>> -        if (env->subprog_cnt > 1) {
>> -            verbose(env, "tail_calls are not allowed in programs with bpf-to-bpf calls\n");
>> -            return -EINVAL;
>> -        }
>>           break;
>>       case BPF_FUNC_perf_event_read:
>>       case BPF_FUNC_perf_event_output:
>> @@ -10252,7 +10248,6 @@ static int fixup_bpf_calls(struct bpf_verifier_env *env)
>>                * the program array.
>>                */
>>               prog->cb_access = 1;
>> -            env->prog->aux->stack_depth = MAX_BPF_STACK;
>>               env->prog->aux->max_pkt_offset = MAX_PACKET_OFF;
>>               /* mark bpf_tail_call as different opcode to avoid
> 
> Also, isn't this broken when JIT is not used (as in stack oob access)?

(Similarly for non-x86 archs after this set.)