| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Thu, 20 Aug 2020 09:43:24 -0700
From: Yonghong Song <yhs@...com>
To: Hao Luo <haoluo@...gle.com>, <netdev@...r.kernel.org>,
<bpf@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
<linux-kselftest@...r.kernel.org>
CC: Shuah Khan <shuah@...nel.org>, Alexei Starovoitov <ast@...nel.org>,
Andrii Nakryiko <andriin@...com>,
Daniel Borkmann <daniel@...earbox.net>,
Martin KaFai Lau <kafai@...com>,
Song Liu <songliubraving@...com>,
John Fastabend <john.fastabend@...il.com>,
KP Singh <kpsingh@...omium.org>,
Quentin Monnet <quentin@...valent.com>,
Steven Rostedt <rostedt@...dmis.org>,
Ingo Molnar <mingo@...hat.com>, Andrey Ignatov <rdna@...com>,
Jakub Sitnicki <jakub@...udflare.com>
Subject: Re: [PATCH bpf-next v1 1/8] bpf: Introduce pseudo_btf_id
On 8/19/20 3:40 PM, Hao Luo wrote:
> Pseudo_btf_id is a type of ld_imm insn that associates a btf_id to a
> ksym so that further dereferences on the ksym can use the BTF info
> to validate accesses. Internally, when seeing a pseudo_btf_id ld insn,
> the verifier reads the btf_id stored in the insn[0]'s imm field and
> marks the dst_reg as PTR_TO_BTF_ID. The btf_id points to a VAR_KIND,
> which is encoded in btf_vminux by pahole. If the VAR is not of a struct
> type, the dst reg will be marked as PTR_TO_MEM instead of PTR_TO_BTF_ID
> and the mem_size is resolved to the size of the VAR's type.
>
> From the VAR btf_id, the verifier can also read the address of the
> ksym's corresponding kernel var from kallsyms and use that to fill
> dst_reg.
>
> Therefore, the proper functionality of pseudo_btf_id depends on (1)
> kallsyms and (2) the encoding of kernel global VARs in pahole, which
> should be available since pahole v1.18.
>
> Signed-off-by: Hao Luo <haoluo@...gle.com>
> ---
> include/linux/btf.h | 15 +++++++++
> include/uapi/linux/bpf.h | 38 ++++++++++++++++------
> kernel/bpf/btf.c | 15 ---------
> kernel/bpf/verifier.c | 68 ++++++++++++++++++++++++++++++++++++++++
> 4 files changed, 112 insertions(+), 24 deletions(-)
>
> diff --git a/include/linux/btf.h b/include/linux/btf.h
> index 8b81fbb4497c..cee4089e83c0 100644
> --- a/include/linux/btf.h
> +++ b/include/linux/btf.h
> @@ -107,6 +107,21 @@ static inline bool btf_type_is_func_proto(const struct btf_type *t)
> return BTF_INFO_KIND(t->info) == BTF_KIND_FUNC_PROTO;
> }
>
> +static inline bool btf_type_is_var(const struct btf_type *t)
> +{
> + return BTF_INFO_KIND(t->info) == BTF_KIND_VAR;
> +}
> +
> +/* union is only a special case of struct:
> + * all its offsetof(member) == 0
> + */
> +static inline bool btf_type_is_struct(const struct btf_type *t)
> +{
> + u8 kind = BTF_INFO_KIND(t->info);
> +
> + return kind == BTF_KIND_STRUCT || kind == BTF_KIND_UNION;
> +}
> +
> static inline u16 btf_type_vlen(const struct btf_type *t)
> {
> return BTF_INFO_VLEN(t->info);
> diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
> index 0480f893facd..468376f2910b 100644
> --- a/include/uapi/linux/bpf.h
> +++ b/include/uapi/linux/bpf.h
> @@ -346,18 +346,38 @@ enum bpf_link_type {
> #define BPF_F_TEST_STATE_FREQ (1U << 3)
>
> /* When BPF ldimm64's insn[0].src_reg != 0 then this can have
> - * two extensions:
> - *
> - * insn[0].src_reg: BPF_PSEUDO_MAP_FD BPF_PSEUDO_MAP_VALUE
> - * insn[0].imm: map fd map fd
> - * insn[1].imm: 0 offset into value
> - * insn[0].off: 0 0
> - * insn[1].off: 0 0
> - * ldimm64 rewrite: address of map address of map[0]+offset
> - * verifier type: CONST_PTR_TO_MAP PTR_TO_MAP_VALUE
> + * the following extensions:
> + *
> + * insn[0].src_reg: BPF_PSEUDO_MAP_FD
> + * insn[0].imm: map fd
> + * insn[1].imm: 0
> + * insn[0].off: 0
> + * insn[1].off: 0
> + * ldimm64 rewrite: address of map
> + * verifier type: CONST_PTR_TO_MAP
> */
> #define BPF_PSEUDO_MAP_FD 1
> +/*
> + * insn[0].src_reg: BPF_PSEUDO_MAP_VALUE
> + * insn[0].imm: map fd
> + * insn[1].imm: offset into value
> + * insn[0].off: 0
> + * insn[1].off: 0
> + * ldimm64 rewrite: address of map[0]+offset
> + * verifier type: PTR_TO_MAP_VALUE
> + */
> #define BPF_PSEUDO_MAP_VALUE 2
> +/*
> + * insn[0].src_reg: BPF_PSEUDO_BTF_ID
> + * insn[0].imm: kernel btd id of VAR
> + * insn[1].imm: 0
> + * insn[0].off: 0
> + * insn[1].off: 0
> + * ldimm64 rewrite: address of the kernel variable
> + * verifier type: PTR_TO_BTF_ID or PTR_TO_MEM, depending on whether the var
> + * is struct/union.
> + */
> +#define BPF_PSEUDO_BTF_ID 3
>
> /* when bpf_call->src_reg == BPF_PSEUDO_CALL, bpf_call->imm == pc-relative
> * offset to another bpf function
> diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
> index 91afdd4c82e3..b6d8f653afe2 100644
> --- a/kernel/bpf/btf.c
> +++ b/kernel/bpf/btf.c
> @@ -353,16 +353,6 @@ static bool btf_type_nosize_or_null(const struct btf_type *t)
> return !t || btf_type_nosize(t);
> }
>
> -/* union is only a special case of struct:
> - * all its offsetof(member) == 0
> - */
> -static bool btf_type_is_struct(const struct btf_type *t)
> -{
> - u8 kind = BTF_INFO_KIND(t->info);
> -
> - return kind == BTF_KIND_STRUCT || kind == BTF_KIND_UNION;
> -}
> -
> static bool __btf_type_is_struct(const struct btf_type *t)
> {
> return BTF_INFO_KIND(t->info) == BTF_KIND_STRUCT;
> @@ -373,11 +363,6 @@ static bool btf_type_is_array(const struct btf_type *t)
> return BTF_INFO_KIND(t->info) == BTF_KIND_ARRAY;
> }
>
> -static bool btf_type_is_var(const struct btf_type *t)
> -{
> - return BTF_INFO_KIND(t->info) == BTF_KIND_VAR;
> -}
> -
> static bool btf_type_is_datasec(const struct btf_type *t)
> {
> return BTF_INFO_KIND(t->info) == BTF_KIND_DATASEC;
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index ef938f17b944..47badde71f83 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -7205,6 +7205,68 @@ static int check_cond_jmp_op(struct bpf_verifier_env *env,
> return 0;
> }
>
> +/* verify ld_imm64 insn of type PSEUDO_BTF_ID is valid */
> +static inline int check_pseudo_btf_id(struct bpf_verifier_env *env,
> + struct bpf_insn *insn)
> +{
> + struct bpf_reg_state *regs = cur_regs(env);
> + u32 type, id = insn->imm;
> + u64 addr;
> + const char *sym_name;
> + const struct btf_type *t = btf_type_by_id(btf_vmlinux, id);
Since this is new code, please try to conform to reverse christmas tree
coding style. For the last one, the assignment no need to be in
declaration, you can put "t = ..." right before the first use of "t".
same for other places.
> +
> + if (!t) {
> + verbose(env, "%s: invalid btf_id %d\n", __func__, id);
> + return -ENOENT;
> + }
> +
> + if (insn[1].imm != 0) {
> + verbose(env, "%s: BPF_PSEUDO_BTF_ID uses reserved fields\n",
> + __func__);
> + return -EINVAL;
> + }
> +
> + if (!btf_type_is_var(t)) {
> + verbose(env, "%s: btf_id %d isn't KIND_VAR\n", __func__, id);
> + return -EINVAL;
> + }
> +
> + sym_name = btf_name_by_offset(btf_vmlinux, t->name_off);
> + addr = kallsyms_lookup_name(sym_name);
> + if (!addr) {
> + verbose(env, "%s: failed to find the address of symbol '%s'.\n",
> + __func__, sym_name);
> + return -ENOENT;
> + }
> +
> + insn[0].imm = (u32)addr;
> + insn[1].imm = addr >> 32;
> + mark_reg_known_zero(env, regs, insn->dst_reg);
> +
> + type = t->type;
> + t = btf_type_skip_modifiers(btf_vmlinux, type, NULL);
> + if (!btf_type_is_struct(t)) {
> + u32 tsize;
> + const struct btf_type *ret;
> + const char *tname; > +
> + /* resolve the type size of ksym. */
> + ret = btf_resolve_size(btf_vmlinux, t, &tsize, NULL, NULL);
> + if (IS_ERR(ret)) {
> + tname = btf_name_by_offset(btf_vmlinux, t->name_off);
> + verbose(env, "unable to resolve the size of type '%s': %ld\n",
> + tname, PTR_ERR(ret));
> + return -EINVAL;
> + }
> + regs[insn->dst_reg].type = PTR_TO_MEM;
> + regs[insn->dst_reg].mem_size = tsize;
> + } else {
> + regs[insn->dst_reg].type = PTR_TO_BTF_ID;
> + regs[insn->dst_reg].btf_id = type;
> + }
> + return 0;
> +}
> +
> /* verify BPF_LD_IMM64 instruction */
[...]
Powered by blists - more mailing lists