| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Tue, 10 Nov 2020 20:47:13 -0800
From: Andrii Nakryiko <andrii.nakryiko@...il.com>
To: Dmitrii Banshchikov <me@...que.spb.ru>
Cc: bpf <bpf@...r.kernel.org>, Kernel Team <kernel-team@...com>,
Andrey Ignatov <rdna@...com>,
Alexei Starovoitov <ast@...nel.org>,
Daniel Borkmann <daniel@...earbox.net>,
Martin Lau <kafai@...com>, Song Liu <songliubraving@...com>,
Yonghong Song <yhs@...com>,
Andrii Nakryiko <andrii@...nel.org>,
john fastabend <john.fastabend@...il.com>,
KP Singh <kpsingh@...omium.org>,
Toke Høiland-Jørgensen <toke@...hat.com>,
Networking <netdev@...r.kernel.org>
Subject: Re: [PATCH] bpf: relax return code check for subprograms
On Tue, Nov 10, 2020 at 1:03 PM Dmitrii Banshchikov <me@...que.spb.ru> wrote:
>
> Currently verifier enforces return code checks for subprograms in the
> same manner as it does for program entry points. This prevents returning
> arbitrary scalar values from subprograms. Scalar type of returned values
> is checked by btf_prepare_func_args() and hence it should be safe to
> allow only scalars for now. Relax return code checks for subprograms and
> allow any correct scalar values.
>
> Signed-off-by: Dmitrii Banshchikov <me@...que.spb.ru>
> Fixes: 51c39bb1d5d10 (bpf: Introduce function-by-function verification)
> ---
Please make sure that your subject has [PATCH bpf-next], if it's
targeted against bpf-next tree.
> kernel/bpf/verifier.c | 26 ++++++++++++++-----
> .../bpf/prog_tests/test_global_funcs.c | 1 +
> .../selftests/bpf/progs/test_global_func8.c | 25 ++++++++++++++++++
> 3 files changed, 45 insertions(+), 7 deletions(-)
> create mode 100644 tools/testing/selftests/bpf/progs/test_global_func8.c
>
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 10da26e55130..c108b19e1fad 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -7791,7 +7791,7 @@ static int check_ld_abs(struct bpf_verifier_env *env, struct bpf_insn *insn)
> return 0;
> }
>
> -static int check_return_code(struct bpf_verifier_env *env)
> +static int check_return_code(struct bpf_verifier_env *env, bool is_subprog)
> {
> struct tnum enforce_attach_type_range = tnum_unknown;
> const struct bpf_prog *prog = env->prog;
> @@ -7801,10 +7801,12 @@ static int check_return_code(struct bpf_verifier_env *env)
> int err;
>
> /* LSM and struct_ops func-ptr's return type could be "void" */
> - if ((prog_type == BPF_PROG_TYPE_STRUCT_OPS ||
> - prog_type == BPF_PROG_TYPE_LSM) &&
> - !prog->aux->attach_func_proto->type)
> - return 0;
> + if (!is_subprog) {
I think just adding `!is_subprog` && to existing if is cleaner and
more succinct.
> + if ((prog_type == BPF_PROG_TYPE_STRUCT_OPS ||
> + prog_type == BPF_PROG_TYPE_LSM) &&
> + !prog->aux->attach_func_proto->type)
> + return 0;
> + }
>
> /* eBPF calling convetion is such that R0 is used
> * to return the value from eBPF program.
> @@ -7821,6 +7823,16 @@ static int check_return_code(struct bpf_verifier_env *env)
> return -EACCES;
> }
>
> + reg = cur_regs(env) + BPF_REG_0;
> + if (is_subprog) {
> + if (reg->type != SCALAR_VALUE) {
> + verbose(env, "At subprogram exit the register R0 is not a scalar value (%s)\n",
> + reg_type_str[reg->type]);
> + return -EINVAL;
> + }
> + return 0;
> + }
> +
It's not clear why reg->type != SCALAR_VALUE check is done after
prog_type-specific check. Is there any valid case where we'd allow
non-scalar return? Maybe Alexei can chime in here.
If not, then I'd just move the existing SCALAR_VALUE check below up
here, unconditionally for subprog and non-subprog. And then just exit
after that, if we are processing a subprog.
> switch (prog_type) {
> case BPF_PROG_TYPE_CGROUP_SOCK_ADDR:
> if (env->prog->expected_attach_type == BPF_CGROUP_UDP4_RECVMSG ||
> @@ -7874,7 +7886,6 @@ static int check_return_code(struct bpf_verifier_env *env)
> return 0;
> }
>
> - reg = cur_regs(env) + BPF_REG_0;
> if (reg->type != SCALAR_VALUE) {
> verbose(env, "At program exit the register R0 is not a known value (%s)\n",
> reg_type_str[reg->type]);
> @@ -9266,6 +9277,7 @@ static int do_check(struct bpf_verifier_env *env)
> int insn_cnt = env->prog->len;
> bool do_print_state = false;
> int prev_insn_idx = -1;
> + const bool is_subprog = env->cur_state->frame[0]->subprogno;
this can probably be done inside check_return_code(), no?
>
> for (;;) {
> struct bpf_insn *insn;
> @@ -9530,7 +9542,7 @@ static int do_check(struct bpf_verifier_env *env)
> if (err)
> return err;
>
> - err = check_return_code(env);
> + err = check_return_code(env, is_subprog);
> if (err)
> return err;
> process_bpf_exit:
> diff --git a/tools/testing/selftests/bpf/prog_tests/test_global_funcs.c b/tools/testing/selftests/bpf/prog_tests/test_global_funcs.c
> index 193002b14d7f..32e4348b714b 100644
> --- a/tools/testing/selftests/bpf/prog_tests/test_global_funcs.c
> +++ b/tools/testing/selftests/bpf/prog_tests/test_global_funcs.c
> @@ -60,6 +60,7 @@ void test_test_global_funcs(void)
> { "test_global_func5.o" , "expected pointer to ctx, but got PTR" },
> { "test_global_func6.o" , "modified ctx ptr R2" },
> { "test_global_func7.o" , "foo() doesn't return scalar" },
> + { "test_global_func8.o" },
> };
> libbpf_print_fn_t old_print_fn = NULL;
> int err, i, duration = 0;
> diff --git a/tools/testing/selftests/bpf/progs/test_global_func8.c b/tools/testing/selftests/bpf/progs/test_global_func8.c
> new file mode 100644
> index 000000000000..1e9a87f30b7c
> --- /dev/null
> +++ b/tools/testing/selftests/bpf/progs/test_global_func8.c
> @@ -0,0 +1,25 @@
> +// SPDX-License-Identifier: GPL-2.0-only
> +/* Copyright (c) 2020 Facebook */
> +#include <stddef.h>
> +#include <linux/bpf.h>
> +#include <bpf/bpf_helpers.h>
> +
> +__attribute__ ((noinline))
nit: use __noinline, it's defined in bpf_helpers.h
> +int bar(struct __sk_buff *skb)
> +{
> + return bpf_get_prandom_u32();
> +}
> +
> +static __always_inline int foo(struct __sk_buff *skb)
foo is not essential, just inline it in test_cls below
> +{
> + if (!bar(skb))
> + return 0;
> +
> + return 1;
> +}
> +
> +SEC("cgroup_skb/ingress")
> +int test_cls(struct __sk_buff *skb)
> +{
> + return foo(skb);
> +}
I also wonder what happens if __noinline function has return type
void? Do you mind adding another BPF program that uses non-inline
global void function? We might need to handle that case in the
verifier explicitly.
> --
> 2.24.1
>
Powered by blists - more mailing lists