netdev - Re: [bpf PATCH v2 2/5] bpf: sock_ops sk access may stomp registers when dst_reg = src

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAPhsuW4W8MsyhvxHmh-i50PShO9Gz0HK1G6rRViO-aHwXy4Uyg@mail.gmail.com>
Date:   Wed, 29 Jul 2020 14:30:27 -0700
From:   Song Liu <song@...nel.org>
To:     John Fastabend <john.fastabend@...il.com>
Cc:     Martin KaFai Lau <kafai@...com>,
        Daniel Borkmann <daniel@...earbox.net>,
        Alexei Starovoitov <ast@...nel.org>,
        Networking <netdev@...r.kernel.org>, bpf <bpf@...r.kernel.org>
Subject: Re: [bpf PATCH v2 2/5] bpf: sock_ops sk access may stomp registers
 when dst_reg = src_reg

On Wed, Jul 29, 2020 at 9:25 AM John Fastabend <john.fastabend@...il.com> wrote:
>
> Similar to patch ("bpf: sock_ops ctx access may stomp registers") if the
> src_reg = dst_reg when reading the sk field of a sock_ops struct we
> generate xlated code,
>
>   53: (61) r9 = *(u32 *)(r9 +28)
>   54: (15) if r9 == 0x0 goto pc+3
>   56: (79) r9 = *(u64 *)(r9 +0)
>
> This stomps on the r9 reg to do the sk_fullsock check and then when
> reading the skops->sk field instead of the sk pointer we get the
> sk_fullsock. To fix use similar pattern noted in the previous fix
> and use the temp field to save/restore a register used to do
> sk_fullsock check.
>
> After the fix the generated xlated code reads,
>
>   52: (7b) *(u64 *)(r9 +32) = r8
>   53: (61) r8 = *(u32 *)(r9 +28)
>   54: (15) if r9 == 0x0 goto pc+3
>   55: (79) r8 = *(u64 *)(r9 +32)
>   56: (79) r9 = *(u64 *)(r9 +0)
>   57: (05) goto pc+1
>   58: (79) r8 = *(u64 *)(r9 +32)
>
> Here r9 register was in-use so r8 is chosen as the temporary register.
> In line 52 r8 is saved in temp variable and at line 54 restored in case
> fullsock != 0. Finally we handle fullsock == 0 case by restoring at
> line 58.
>
> This adds a new macro SOCK_OPS_GET_SK it is almost possible to merge
> this with SOCK_OPS_GET_FIELD, but I found the extra branch logic a
> bit more confusing than just adding a new macro despite a bit of
> duplicating code.
>
> Fixes: 1314ef561102e ("bpf: export bpf_sock for BPF_PROG_TYPE_SOCK_OPS prog type")
> Signed-off-by: John Fastabend <john.fastabend@...il.com>

Acked-by: Song Liu <songliubraving@...com>
[...]