netdev - Re: [PATCH] bpf: relax return code check for subprograms

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date:   Thu, 12 Nov 2020 13:03:12 +0000
From:   Dmitrii Banshchikov <me@...que.spb.ru>
To:     Andrii Nakryiko <andrii.nakryiko@...il.com>
Cc:     bpf <bpf@...r.kernel.org>, Kernel Team <kernel-team@...com>,
        Andrey Ignatov <rdna@...com>,
        Alexei Starovoitov <ast@...nel.org>,
        Daniel Borkmann <daniel@...earbox.net>,
        Martin Lau <kafai@...com>, Song Liu <songliubraving@...com>,
        Yonghong Song <yhs@...com>,
        Andrii Nakryiko <andrii@...nel.org>,
        john fastabend <john.fastabend@...il.com>,
        KP Singh <kpsingh@...omium.org>,
        Toke Høiland-Jørgensen <toke@...hat.com>,
        Networking <netdev@...r.kernel.org>
Subject: Re: [PATCH] bpf: relax return code check for subprograms

On Wed, Nov 11, 2020 at 02:33:11PM -0800, Andrii Nakryiko wrote:

> >
> > >
> > > >         switch (prog_type) {
> > > >         case BPF_PROG_TYPE_CGROUP_SOCK_ADDR:
> > > >                 if (env->prog->expected_attach_type == BPF_CGROUP_UDP4_RECVMSG ||
> > > > @@ -7874,7 +7886,6 @@ static int check_return_code(struct bpf_verifier_env *env)
> > > >                 return 0;
> > > >         }
> > > >
> > > > -       reg = cur_regs(env) + BPF_REG_0;
> > > >         if (reg->type != SCALAR_VALUE) {
> > > >                 verbose(env, "At program exit the register R0 is not a known value (%s)\n",
> > > >                         reg_type_str[reg->type]);
> > > > @@ -9266,6 +9277,7 @@ static int do_check(struct bpf_verifier_env *env)
> > > >         int insn_cnt = env->prog->len;
> > > >         bool do_print_state = false;
> > > >         int prev_insn_idx = -1;
> > > > +       const bool is_subprog = env->cur_state->frame[0]->subprogno;
> > >
> > > this can probably be done inside check_return_code(), no?
> >
> > No.
> > Frame stack may be empty when check_return_code() is called.
> 
> How can that happen? check_reg_arg() in check_return_code() relies on
> having a frame available. So does cur_regs() function, also used
> there. What am I missing?

Yes, sorry, you are right.

Verifier doesn't create a new frame for call to a global function
and frames are freed only for nested function calls. The frame[0]
with subprogno is prepared and freed in do_check_common() hence
it should be safe for access it from check_return_code().

Yes, it is simplier to move this check in check_return_code().



> 
> >
> >
> > >
> > > >
> > > >         for (;;) {
> > > >                 struct bpf_insn *insn;
> > > > @@ -9530,7 +9542,7 @@ static int do_check(struct bpf_verifier_env *env)
> > > >                                 if (err)
> > > >                                         return err;
> > > >
> > > > -                               err = check_return_code(env);
> > > > +                               err = check_return_code(env, is_subprog);
> > > >                                 if (err)
> > > >                                         return err;
> > > >  process_bpf_exit:
> > > > diff --git a/tools/testing/selftests/bpf/prog_tests/test_global_funcs.c b/tools/testing/selftests/bpf/prog_tests/test_global_funcs.c
> > > > index 193002b14d7f..32e4348b714b 100644
> > > > --- a/tools/testing/selftests/bpf/prog_tests/test_global_funcs.c
> > > > +++ b/tools/testing/selftests/bpf/prog_tests/test_global_funcs.c
> > > > @@ -60,6 +60,7 @@ void test_test_global_funcs(void)
> > > >                 { "test_global_func5.o" , "expected pointer to ctx, but got PTR" },
> > > >                 { "test_global_func6.o" , "modified ctx ptr R2" },
> > > >                 { "test_global_func7.o" , "foo() doesn't return scalar" },
> > > > +               { "test_global_func8.o" },
> > > >         };
> > > >         libbpf_print_fn_t old_print_fn = NULL;
> > > >         int err, i, duration = 0;
> > > > diff --git a/tools/testing/selftests/bpf/progs/test_global_func8.c b/tools/testing/selftests/bpf/progs/test_global_func8.c
> > > > new file mode 100644
> > > > index 000000000000..1e9a87f30b7c
> > > > --- /dev/null
> > > > +++ b/tools/testing/selftests/bpf/progs/test_global_func8.c
> > > > @@ -0,0 +1,25 @@
> > > > +// SPDX-License-Identifier: GPL-2.0-only
> > > > +/* Copyright (c) 2020 Facebook */
> > > > +#include <stddef.h>
> > > > +#include <linux/bpf.h>
> > > > +#include <bpf/bpf_helpers.h>
> > > > +
> > > > +__attribute__ ((noinline))
> > >
> > > nit: use __noinline, it's defined in bpf_helpers.h
> > >
> > > > +int bar(struct __sk_buff *skb)
> > > > +{
> > > > +       return bpf_get_prandom_u32();
> > > > +}
> > > > +
> > > > +static __always_inline int foo(struct __sk_buff *skb)
> > >
> > > foo is not essential, just inline it in test_cls below
> > >
> > > > +{
> > > > +       if (!bar(skb))
> > > > +               return 0;
> > > > +
> > > > +       return 1;
> > > > +}
> > > > +
> > > > +SEC("cgroup_skb/ingress")
> > > > +int test_cls(struct __sk_buff *skb)
> > > > +{
> > > > +       return foo(skb);
> > > > +}
> > >
> > > I also wonder what happens if __noinline function has return type
> > > void? Do you mind adding another BPF program that uses non-inline
> > > global void function? We might need to handle that case in the
> > > verifier explicitly.
> >
> > btf_prepare_func_args() guarantees that a subprogram may have only
> > SCALAR return type.
> 
> Right, I didn't know about this, thanks. We might want to lift that
> restriction eventually.
> 
> >
> > >
> > >
> > > > --
> > > > 2.24.1
> > > >