netdev - Re: [PATCH v8 bpf-next 3/5] bpf: Add skb dynptrs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAJnrk1bs5y_XDTHYzha_fNVQSbHF6hguewHOd=vm5cnimGTtOw@mail.gmail.com>
Date:   Fri, 27 Jan 2023 10:07:32 -0800
From:   Joanne Koong <joannelkoong@...il.com>
To:     Martin KaFai Lau <martin.lau@...ux.dev>
Cc:     daniel@...earbox.net, andrii@...nel.org, martin.lau@...nel.org,
        ast@...nel.org, netdev@...r.kernel.org, memxor@...il.com,
        kernel-team@...com, bpf <bpf@...r.kernel.org>
Subject: Re: [PATCH v8 bpf-next 3/5] bpf: Add skb dynptrs

On Thu, Jan 26, 2023 at 11:58 PM Martin KaFai Lau <martin.lau@...ux.dev> wrote:
>
> On 1/26/23 3:34 PM, Joanne Koong wrote:
> > +static enum bpf_dynptr_type dynptr_get_type(struct bpf_verifier_env *env,
> > +                                         struct bpf_reg_state *reg)
> > +{
> > +     struct bpf_func_state *state = func(env, reg);
> > +     int spi = __get_spi(reg->off);
> > +
> > +     if (spi < 0) {
> > +             verbose(env, "verifier internal error: invalid spi when querying dynptr type\n");
> > +             return BPF_DYNPTR_TYPE_INVALID;
> > +     }
> > +
> > +     return state->stack[spi].spilled_ptr.dynptr.type;
> > +}
>
> CI fails:
> https://github.com/kernel-patches/bpf/actions/runs/4020275998/jobs/6908210555
>
> My local KASAN also reports the error.

Ooh thanks for flagging. user_ringbuf() test was failing because
dynptr_get_type didn't account for CONST_PTR_TO_DYNPTR type. This
fixes it:

@@ -6644,8 +6644,12 @@ static enum bpf_dynptr_type
dynptr_get_type(struct bpf_verifier_env *env,
                                            struct bpf_reg_state *reg)
 {
        struct bpf_func_state *state = func(env, reg);
-       int spi = __get_spi(reg->off);
+       int spi;
+
+       if (reg->type == CONST_PTR_TO_DYNPTR)
+               return reg->dynptr.type;

+       spi = __get_spi(reg->off);
        if (spi < 0) {
                verbose(env, "verifier internal error: invalid spi
when querying dynptr type\n");

I will add this and respin v9.