netdev - Re: Curious bpf regression in 5.18 already fixed in stable 5.18.3

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <YqpDcD6vkZZfWH4L@google.com>
Date:   Wed, 15 Jun 2022 13:39:12 -0700
From:   sdf@...gle.com
To:     "Maciej Żenczykowski" <maze@...gle.com>
Cc:     Alexei Starovoitov <alexei.starovoitov@...il.com>,
        Linux NetDev <netdev@...r.kernel.org>,
        BPF Mailing List <bpf@...r.kernel.org>,
        Alexei Starovoitov <ast@...nel.org>,
        Martin KaFai Lau <kafai@...com>,
        Sasha Levin <sashal@...nel.org>,
        Carlos Llamas <cmllamas@...gle.com>, zhuyifei@...gle.com
Subject: Re: Curious bpf regression in 5.18 already fixed in stable 5.18.3

On 06/15, Stanislav Fomichev wrote:
> On 06/15, Stanislav Fomichev wrote:
> > On 06/15, sdf@...gle.com wrote:
> > > On 06/15, Maciej Żenczykowski wrote:
> > > > On Wed, Jun 15, 2022 at 10:38 AM Alexei Starovoitov
> > > > <alexei.starovoitov@...il.com> wrote:
> > > > >
> > > > > On Wed, Jun 15, 2022 at 9:57 AM Maciej Żenczykowski  
> <maze@...gle.com>
> > > > wrote:
> > > > > > >
> > > > > > > I've confirmed vanilla 5.18.0 is broken, and all it takes is
> > > > > > > cherrypicking that specific stable 5.18.x patch [
> > > > > > > 710a8989b4b4067903f5b61314eda491667b6ab3 ] to fix behaviour.
> > > > > ...
> > > > > > b8bd3ee1971d1edbc53cf322c149ca0227472e56 this is where we added
> > > > EFAULT in 5.16
> > > > >
> > > > > There are no such sha-s in the upstream kernel.
> > > > > Sorry we cannot help with debugging of android kernels.
> > >
> > > > Yes, sdf@ quoted the wrong sha1, it's a clean cherrypick to an
> > > > internal branch of
> > > > 'bpf: Add cgroup helpers bpf_{get,set}_retval to get/set syscall  
> return
> > > > value'
> > > > commit b44123b4a3dcad4664d3a0f72c011ffd4c9c4d93.
> > >
> > > >  
> https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-5.16.y&id=b44123b4a3dcad4664d3a0f72c011ffd4c9c4d93
> > >
> > > > Anyway, I think it's unrelated - or at least not the immediate root  
> cause.
> > >
> > > > Also there's *no* Android kernels involved here.
> > > > This is the android net tests failing on vanilla 5.18 and passing on
> > > > 5.18.3.
> > >
> > > Yeah, sorry, didn't mean to send those outside :-)
> > >
> > > Attached un-android-ified testcase. Passes on bpf-next, trying to see
> > > what happens on vanilla 5.18. Will update once I get more data..
> >
> > I've bisected the original issue to:
> >
> > b44123b4a3dc ("bpf: Add cgroup helpers bpf_{get,set}_retval to get/set
> > syscall return value")
> >
> > And I believe it's these two lines from the original patch:
> >
> >  #define BPF_PROG_CGROUP_INET_EGRESS_RUN_ARRAY(array, ctx, func)		\
> >  	({						\
> > @@ -1398,10 +1398,12 @@ out:
> >  		u32 _ret;				\
> >  		_ret = BPF_PROG_RUN_ARRAY_CG_FLAGS(array, ctx, func, 0, &_flags); \
> >  		_cn = _flags & BPF_RET_SET_CN;		\
> > +		if (_ret && !IS_ERR_VALUE((long)_ret))	\
> > +			_ret = -EFAULT;	
> >
> > _ret is u32 and ret gets -1 (ffffffff). IS_ERR_VALUE((long)ffffffff)  
> returns
> > false in this case because it doesn't sign-expand the argument and  
> internally
> > does ffff_ffff >= ffff_ffff_ffff_f001 comparison.
> >
> > I'll try to see what I've changed in my unrelated patch to fix it. But  
> I think
> > we should audit all these IS_ERR_VALUE((long)_ret) regardless; they  
> don't
> > seem to work the way we want them to...

> Ok, and my patch fixes it because I'm replacing 'u32 _ret' with 'int ret'.

> So, basically, with u32 _ret we have to do IS_ERR_VALUE((long)(int)_ret).

> Sigh..

And to follow up on that, the other two places we have are fine:

IS_ERR_VALUE((long)run_ctx.retval))

run_ctx.retval is an int.