* [toke:bpf-freplace-multi-attach-alt-04 3/8] kernel/bpf/verifier.c:11344 check_attach_btf_id() error: we previously assumed 'prog->aux->tgt_link' could be null (see line 11286)
@ 2020-09-16 14:51 kernel test robot
0 siblings, 0 replies; 2+ messages in thread
From: kernel test robot @ 2020-09-16 14:51 UTC (permalink / raw)
To: kbuild
[-- Attachment #1: Type: text/plain, Size: 7813 bytes --]
CC: kbuild-all(a)lists.01.org
TO: "Toke Høiland-Jørgensen" <toke@redhat.com>
tree: https://git.kernel.org/pub/scm/linux/kernel/git/toke/linux.git bpf-freplace-multi-attach-alt-04
head: 4b32f3fa732bbc5ab739fc9a0b9864c66a6183fd
commit: b166eea4ca70570e9998331165242454c2a357c0 [3/8] bpf: wrap prog->aux->linked_prog in a bpf_tracing_link
:::::: branch date: 2 days ago
:::::: commit date: 2 days ago
config: x86_64-randconfig-m001-20200916 (attached as .config)
compiler: gcc-9 (Debian 9.3.0-15) 9.3.0
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
smatch warnings:
kernel/bpf/verifier.c:11344 check_attach_btf_id() error: we previously assumed 'prog->aux->tgt_link' could be null (see line 11286)
# https://git.kernel.org/pub/scm/linux/kernel/git/toke/linux.git/commit/?id=b166eea4ca70570e9998331165242454c2a357c0
git remote add toke https://git.kernel.org/pub/scm/linux/kernel/git/toke/linux.git
git fetch --no-tags toke bpf-freplace-multi-attach-alt-04
git checkout b166eea4ca70570e9998331165242454c2a357c0
vim +11344 kernel/bpf/verifier.c
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11272
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11273 static int check_attach_btf_id(struct bpf_verifier_env *env)
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11274 {
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11275 struct bpf_prog *prog = env->prog;
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11276 u32 btf_id = prog->aux->attach_btf_id;
b166eea4ca70570 Toke Høiland-Jørgensen 2020-09-01 11277 struct bpf_prog *tgt_prog = NULL;
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11278 struct btf_func_model fmodel;
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11279 struct bpf_trampoline *tr;
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11280 const struct btf_type *t;
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11281 const char *tname;
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11282 long addr;
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11283 int ret;
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11284 u64 key;
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11285
b166eea4ca70570 Toke Høiland-Jørgensen 2020-09-01 @11286 if (prog->aux->tgt_link)
b166eea4ca70570 Toke Høiland-Jørgensen 2020-09-01 11287 tgt_prog = prog->aux->tgt_link->tgt_prog;
b166eea4ca70570 Toke Høiland-Jørgensen 2020-09-01 11288
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11289 if (prog->aux->sleepable && prog->type != BPF_PROG_TYPE_TRACING &&
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11290 prog->type != BPF_PROG_TYPE_LSM) {
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11291 verbose(env, "Only fentry/fexit/fmod_ret and lsm programs can be sleepable\n");
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11292 return -EINVAL;
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11293 }
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11294
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11295 if (prog->type == BPF_PROG_TYPE_STRUCT_OPS)
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11296 return check_struct_ops_btf_id(env);
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11297
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11298 if (prog->type != BPF_PROG_TYPE_TRACING &&
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11299 prog->type != BPF_PROG_TYPE_LSM &&
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11300 prog->type != BPF_PROG_TYPE_EXT)
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11301 return 0;
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11302
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11303 ret = bpf_check_attach_target(&env->log, prog, tgt_prog, btf_id,
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11304 &fmodel, &addr, &tname, &t);
18644cec714aabb Alexei Starovoitov 2020-05-28 11305 if (ret)
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11306 return ret;
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11307
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11308 if (tgt_prog) {
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11309 if (prog->type == BPF_PROG_TYPE_EXT) {
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11310 env->ops = bpf_verifier_ops[tgt_prog->type];
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11311 prog->expected_attach_type =
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11312 tgt_prog->expected_attach_type;
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11313 }
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11314 key = ((u64)tgt_prog->aux->id) << 32 | btf_id;
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11315 } else {
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11316 key = btf_id;
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11317 }
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11318
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11319 /* remember two read only pointers that are valid for
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11320 * the life time of the kernel
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11321 */
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11322 prog->aux->attach_func_proto = t;
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11323 prog->aux->attach_func_name = tname;
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11324
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11325 if (prog->expected_attach_type == BPF_TRACE_RAW_TP) {
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11326 prog->aux->attach_btf_trace = true;
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11327 return 0;
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11328 } else if (prog->expected_attach_type == BPF_TRACE_ITER) {
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11329 if (!bpf_iter_prog_supported(prog))
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11330 return -EINVAL;
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11331 return 0;
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11332 }
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11333
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11334 if (prog->type == BPF_PROG_TYPE_LSM) {
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11335 ret = bpf_lsm_verify_prog(&env->log, prog);
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11336 if (ret < 0)
fec56f5890d93fc Alexei Starovoitov 2019-11-14 11337 return ret;
f1b9509c2fb0ef4 Alexei Starovoitov 2019-10-30 11338 }
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11339
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11340 tr = bpf_trampoline_get(key, (void *)addr, &fmodel);
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11341 if (IS_ERR(tr))
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11342 return PTR_ERR(tr);
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11343
b166eea4ca70570 Toke Høiland-Jørgensen 2020-09-01 @11344 prog->aux->tgt_link->trampoline = tr;
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11345 return 0;
382072916044015 Martin KaFai Lau 2019-10-24 11346 }
382072916044015 Martin KaFai Lau 2019-10-24 11347
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all(a)lists.01.org
[-- Attachment #2: config.gz --]
[-- Type: application/gzip, Size: 31858 bytes --]
^ permalink raw reply [flat|nested] 2+ messages in thread* [toke:bpf-freplace-multi-attach-alt-04 3/8] kernel/bpf/verifier.c:11344 check_attach_btf_id() error: we previously assumed 'prog->aux->tgt_link' could be null (see line 11286)
@ 2020-09-16 14:58 Dan Carpenter
0 siblings, 0 replies; 2+ messages in thread
From: Dan Carpenter @ 2020-09-16 14:58 UTC (permalink / raw)
To: kbuild
[-- Attachment #1: Type: text/plain, Size: 7968 bytes --]
tree: https://git.kernel.org/pub/scm/linux/kernel/git/toke/linux.git bpf-freplace-multi-attach-alt-04
head: 4b32f3fa732bbc5ab739fc9a0b9864c66a6183fd
commit: b166eea4ca70570e9998331165242454c2a357c0 [3/8] bpf: wrap prog->aux->linked_prog in a bpf_tracing_link
config: x86_64-randconfig-m001-20200916 (attached as .config)
compiler: gcc-9 (Debian 9.3.0-15) 9.3.0
If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
smatch warnings:
kernel/bpf/verifier.c:11344 check_attach_btf_id() error: we previously assumed 'prog->aux->tgt_link' could be null (see line 11286)
# https://git.kernel.org/pub/scm/linux/kernel/git/toke/linux.git/commit/?id=b166eea4ca70570e9998331165242454c2a357c0
git remote add toke https://git.kernel.org/pub/scm/linux/kernel/git/toke/linux.git
git fetch --no-tags toke bpf-freplace-multi-attach-alt-04
git checkout b166eea4ca70570e9998331165242454c2a357c0
vim +11344 kernel/bpf/verifier.c
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11273 static int check_attach_btf_id(struct bpf_verifier_env *env)
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11274 {
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11275 struct bpf_prog *prog = env->prog;
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11276 u32 btf_id = prog->aux->attach_btf_id;
b166eea4ca70570 Toke Høiland-Jørgensen 2020-09-01 11277 struct bpf_prog *tgt_prog = NULL;
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11278 struct btf_func_model fmodel;
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11279 struct bpf_trampoline *tr;
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11280 const struct btf_type *t;
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11281 const char *tname;
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11282 long addr;
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11283 int ret;
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11284 u64 key;
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11285
b166eea4ca70570 Toke Høiland-Jørgensen 2020-09-01 @11286 if (prog->aux->tgt_link)
^^^^^^^^^^^^^^^^^^^
This code assumed ->tgt_link can be NULL.
b166eea4ca70570 Toke Høiland-Jørgensen 2020-09-01 11287 tgt_prog = prog->aux->tgt_link->tgt_prog;
b166eea4ca70570 Toke Høiland-Jørgensen 2020-09-01 11288
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11289 if (prog->aux->sleepable && prog->type != BPF_PROG_TYPE_TRACING &&
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11290 prog->type != BPF_PROG_TYPE_LSM) {
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11291 verbose(env, "Only fentry/fexit/fmod_ret and lsm programs can be sleepable\n");
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11292 return -EINVAL;
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11293 }
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11294
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11295 if (prog->type == BPF_PROG_TYPE_STRUCT_OPS)
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11296 return check_struct_ops_btf_id(env);
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11297
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11298 if (prog->type != BPF_PROG_TYPE_TRACING &&
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11299 prog->type != BPF_PROG_TYPE_LSM &&
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11300 prog->type != BPF_PROG_TYPE_EXT)
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11301 return 0;
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11302
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11303 ret = bpf_check_attach_target(&env->log, prog, tgt_prog, btf_id,
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11304 &fmodel, &addr, &tname, &t);
18644cec714aabb Alexei Starovoitov 2020-05-28 11305 if (ret)
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11306 return ret;
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11307
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11308 if (tgt_prog) {
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11309 if (prog->type == BPF_PROG_TYPE_EXT) {
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11310 env->ops = bpf_verifier_ops[tgt_prog->type];
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11311 prog->expected_attach_type =
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11312 tgt_prog->expected_attach_type;
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11313 }
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11314 key = ((u64)tgt_prog->aux->id) << 32 | btf_id;
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11315 } else {
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11316 key = btf_id;
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11317 }
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11318
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11319 /* remember two read only pointers that are valid for
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11320 * the life time of the kernel
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11321 */
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11322 prog->aux->attach_func_proto = t;
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11323 prog->aux->attach_func_name = tname;
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11324
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11325 if (prog->expected_attach_type == BPF_TRACE_RAW_TP) {
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11326 prog->aux->attach_btf_trace = true;
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11327 return 0;
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11328 } else if (prog->expected_attach_type == BPF_TRACE_ITER) {
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11329 if (!bpf_iter_prog_supported(prog))
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11330 return -EINVAL;
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11331 return 0;
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11332 }
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11333
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11334 if (prog->type == BPF_PROG_TYPE_LSM) {
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11335 ret = bpf_lsm_verify_prog(&env->log, prog);
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11336 if (ret < 0)
fec56f5890d93fc Alexei Starovoitov 2019-11-14 11337 return ret;
f1b9509c2fb0ef4 Alexei Starovoitov 2019-10-30 11338 }
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11339
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11340 tr = bpf_trampoline_get(key, (void *)addr, &fmodel);
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11341 if (IS_ERR(tr))
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11342 return PTR_ERR(tr);
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11343
b166eea4ca70570 Toke Høiland-Jørgensen 2020-09-01 @11344 prog->aux->tgt_link->trampoline = tr;
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Unchecked dereference.
90c87648e09050a Toke Høiland-Jørgensen 2020-07-13 11345 return 0;
382072916044015 Martin KaFai Lau 2019-10-24 11346 }
---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all(a)lists.01.org
_______________________________________________
kbuild mailing list -- kbuild(a)lists.01.org
To unsubscribe send an email to kbuild-leave(a)lists.01.org
[-- Attachment #2: config.gz --]
[-- Type: application/gzip, Size: 31858 bytes --]
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2020-09-16 14:58 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-09-16 14:51 [toke:bpf-freplace-multi-attach-alt-04 3/8] kernel/bpf/verifier.c:11344 check_attach_btf_id() error: we previously assumed 'prog->aux->tgt_link' could be null (see line 11286) kernel test robot
-- strict thread matches above, loose matches on Subject: below --
2020-09-16 14:58 Dan Carpenter
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.