From: Hao Sun <sunhao.th@gmail.com>
To: bpf@vger.kernel.org
Cc: ast@kernel.org, daniel@iogearbox.net, john.fastabend@gmail.com,
andrii@kernel.org, martin.lau@linux.dev, song@kernel.org,
yhs@fb.com, kpsingh@kernel.org, sdf@google.com,
haoluo@google.com, jolsa@kernel.org, davem@davemloft.net,
linux-kernel@vger.kernel.org, Hao Sun <sunhao.th@gmail.com>
Subject: [PATCH bpf-next v3 3/3] selftests/bpf: Add tests for LDX/STX/ST sanitize
Date: Fri, 25 Nov 2022 20:29:12 +0800 [thread overview]
Message-ID: <20221125122912.54709-4-sunhao.th@gmail.com> (raw)
In-Reply-To: <20221125122912.54709-1-sunhao.th@gmail.com>
Add tests for LDX/STX/ST instrumentation in each possible case.
Five cases for STX/ST, nice cases for LDX. All new/existing
selftests can pass.
A slab-out-of-bounds read report is also availble, which is
achieved by exploiting CVE-2022-23222 and can be reproduced
in Linux v5.10: https://pastebin.com/raw/Ee1Cw492
Signed-off-by: Hao Sun <sunhao.th@gmail.com>
---
.../selftests/bpf/verifier/sanitize_st_ldx.c | 317 ++++++++++++++++++
1 file changed, 317 insertions(+)
create mode 100644 tools/testing/selftests/bpf/verifier/sanitize_st_ldx.c
diff --git a/tools/testing/selftests/bpf/verifier/sanitize_st_ldx.c b/tools/testing/selftests/bpf/verifier/sanitize_st_ldx.c
new file mode 100644
index 000000000000..dfd53f97eb95
--- /dev/null
+++ b/tools/testing/selftests/bpf/verifier/sanitize_st_ldx.c
@@ -0,0 +1,317 @@
+#ifdef CONFIG_BPF_PROG_KASAN
+
+#define __BACKUP_REG(n) \
+ BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_##n, INSN_OFF_MASK)
+#define BACKUP_SCRATCH_REGS \
+ __BACKUP_REG(1), __BACKUP_REG(2), __BACKUP_REG(3), __BACKUP_REG(4), \
+ __BACKUP_REG(5)
+
+#define __RESTORE_REG(n) \
+ BPF_LDX_MEM(BPF_DW, BPF_REG_##n, BPF_REG_10, INSN_OFF_MASK)
+#define RESTORE_SCRATCH_REGS \
+ __RESTORE_REG(1), __RESTORE_REG(2), __RESTORE_REG(3), \
+ __RESTORE_REG(4), __RESTORE_REG(5)
+
+{
+ "sanitize stx: dst is R1, off is zero",
+ .insns = {
+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
+ BPF_ST_MEM(BPF_DW, BPF_REG_1, 0, 1),
+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
+ BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 1, 1),
+ BPF_MOV64_IMM(BPF_REG_0, 2),
+ BPF_EXIT_INSN(),
+ },
+ .result = ACCEPT,
+ .retval = 1,
+ .expected_insns = {
+ BACKUP_SCRATCH_REGS,
+ BPF_MOV64_REG(MAX_BPF_REG, BPF_REG_0),
+ BPF_EMIT_CALL(INSN_IMM_MASK),
+ RESTORE_SCRATCH_REGS,
+ BPF_MOV64_REG(BPF_REG_0, MAX_BPF_REG),
+ BPF_ST_MEM(BPF_DW, BPF_REG_1, 0, 1),
+ },
+},
+{
+ "sanitize stx: dst is R1",
+ .insns = {
+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+ BPF_ST_MEM(BPF_DW, BPF_REG_1, -8, 1),
+ BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1, -8),
+ BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 1, 2),
+ BPF_MOV64_IMM(BPF_REG_0, 2),
+ BPF_EXIT_INSN(),
+ BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
+ BPF_EXIT_INSN(),
+ },
+ .result = ACCEPT,
+ .retval = 1,
+ .expected_insns = {
+ BACKUP_SCRATCH_REGS,
+ BPF_MOV64_REG(MAX_BPF_REG, BPF_REG_0),
+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
+ BPF_EMIT_CALL(INSN_IMM_MASK),
+ RESTORE_SCRATCH_REGS,
+ BPF_MOV64_REG(BPF_REG_0, MAX_BPF_REG),
+ BPF_ST_MEM(BPF_DW, BPF_REG_1, -8, 1),
+ },
+},
+{
+ "sanitize stx: dst is other regs, off is zero",
+ .insns = {
+ BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+ BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 1),
+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, 0),
+ BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 1, 1),
+ BPF_MOV64_IMM(BPF_REG_0, 2),
+ BPF_EXIT_INSN(),
+ },
+ .result = ACCEPT,
+ .retval = 1,
+ .expected_insns = {
+ BACKUP_SCRATCH_REGS,
+ BPF_MOV64_REG(MAX_BPF_REG, BPF_REG_0),
+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
+ BPF_EMIT_CALL(INSN_IMM_MASK),
+ RESTORE_SCRATCH_REGS,
+ BPF_MOV64_REG(BPF_REG_0, MAX_BPF_REG),
+ BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 1),
+ },
+},
+{
+ "sanitize stx: dst is other regs",
+ .insns = {
+ BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+ BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 1),
+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, -8),
+ BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 1, 1),
+ BPF_MOV64_IMM(BPF_REG_0, 2),
+ BPF_EXIT_INSN(),
+ },
+ .result = ACCEPT,
+ .retval = 1,
+ .expected_insns = {
+ BACKUP_SCRATCH_REGS,
+ BPF_MOV64_REG(MAX_BPF_REG, BPF_REG_0),
+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
+ BPF_EMIT_CALL(INSN_IMM_MASK),
+ RESTORE_SCRATCH_REGS,
+ BPF_MOV64_REG(BPF_REG_0, MAX_BPF_REG),
+ BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 1),
+ },
+},
+{
+ "sanitize stx: dst is R10",
+ .insns = {
+ BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 1),
+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
+ BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 1, 1),
+ BPF_MOV64_IMM(BPF_REG_0, 2),
+ BPF_EXIT_INSN(),
+ },
+ .result = ACCEPT,
+ .retval = 1,
+ .unexpected_insns = {
+ BPF_EMIT_CALL(INSN_IMM_MASK),
+ },
+},
+{
+ "sanitize ldx: src is R1, dst is R0, off is zero",
+ .insns = {
+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
+ BPF_ST_MEM(BPF_DW, BPF_REG_1, 0, 1),
+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
+ BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 1, 1),
+ BPF_MOV64_IMM(BPF_REG_0, 2),
+ BPF_EXIT_INSN(),
+ },
+ .result = ACCEPT,
+ .retval = 1,
+ .expected_insns = {
+ BACKUP_SCRATCH_REGS,
+ BPF_EMIT_CALL(INSN_IMM_MASK),
+ RESTORE_SCRATCH_REGS,
+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 0),
+ },
+},
+{
+ "sanitize ldx: src is R1, dst is R0",
+ .insns = {
+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+ BPF_ST_MEM(BPF_DW, BPF_REG_1, -8, 1),
+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
+ BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 1, 1),
+ BPF_MOV64_IMM(BPF_REG_0, 2),
+ BPF_EXIT_INSN(),
+ },
+ .result = ACCEPT,
+ .retval = 1,
+ .expected_insns = {
+ BACKUP_SCRATCH_REGS,
+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
+ BPF_EMIT_CALL(INSN_IMM_MASK),
+ RESTORE_SCRATCH_REGS,
+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, -8),
+ },
+},
+{
+ "sanitize ldx: src is R1, dst is others, off is zero",
+ .insns = {
+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
+ BPF_ST_MEM(BPF_DW, BPF_REG_1, 0, 1),
+ BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1, 0),
+ BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 1, 2),
+ BPF_MOV64_IMM(BPF_REG_0, 2),
+ BPF_EXIT_INSN(),
+ BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
+ BPF_EXIT_INSN(),
+ },
+ .result = ACCEPT,
+ .retval = 1,
+ .expected_insns = {
+ BACKUP_SCRATCH_REGS,
+ BPF_MOV64_REG(MAX_BPF_REG, BPF_REG_0),
+ BPF_EMIT_CALL(INSN_IMM_MASK),
+ RESTORE_SCRATCH_REGS,
+ BPF_MOV64_REG(BPF_REG_0, MAX_BPF_REG),
+ BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1, 0),
+ },
+},
+{
+ "sanitize ldx: src is R1, dst is others",
+ .insns = {
+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
+ BPF_ST_MEM(BPF_DW, BPF_REG_1, -8, 1),
+ BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1, -8),
+ BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 1, 2),
+ BPF_MOV64_IMM(BPF_REG_0, 2),
+ BPF_EXIT_INSN(),
+ BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
+ BPF_EXIT_INSN(),
+ },
+ .result = ACCEPT,
+ .retval = 1,
+ .expected_insns = {
+ BACKUP_SCRATCH_REGS,
+ BPF_MOV64_REG(MAX_BPF_REG, BPF_REG_0),
+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
+ BPF_EMIT_CALL(INSN_IMM_MASK),
+ RESTORE_SCRATCH_REGS,
+ BPF_MOV64_REG(BPF_REG_0, MAX_BPF_REG),
+ BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_1, -8),
+ },
+},
+{
+ "sanitize ldx: src is others, dst is R0, off is zero",
+ .insns = {
+ BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+ BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 1),
+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, 0),
+ BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 1, 1),
+ BPF_MOV64_IMM(BPF_REG_0, 2),
+ BPF_EXIT_INSN(),
+ },
+ .result = ACCEPT,
+ .retval = 1,
+ .expected_insns = {
+ BACKUP_SCRATCH_REGS,
+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
+ BPF_EMIT_CALL(INSN_IMM_MASK),
+ RESTORE_SCRATCH_REGS,
+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, 0),
+ },
+},
+{
+ "sanitize ldx: src is others, dst is R0",
+ .insns = {
+ BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+ BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 1),
+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, -8),
+ BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 1, 1),
+ BPF_MOV64_IMM(BPF_REG_0, 2),
+ BPF_EXIT_INSN(),
+ },
+ .result = ACCEPT,
+ .retval = 1,
+ .expected_insns = {
+ BACKUP_SCRATCH_REGS,
+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
+ BPF_EMIT_CALL(INSN_IMM_MASK),
+ RESTORE_SCRATCH_REGS,
+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_2, -8),
+ },
+},
+{
+ "sanitize ldx: src is others, dst is others, off is zero",
+ .insns = {
+ BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
+ BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 1),
+ BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, 0),
+ BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 1, 2),
+ BPF_MOV64_IMM(BPF_REG_0, 2),
+ BPF_EXIT_INSN(),
+ BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
+ BPF_EXIT_INSN(),
+ },
+ .result = ACCEPT,
+ .retval = 1,
+ .expected_insns = {
+ BACKUP_SCRATCH_REGS,
+ BPF_MOV64_REG(MAX_BPF_REG, BPF_REG_0),
+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
+ BPF_EMIT_CALL(INSN_IMM_MASK),
+ RESTORE_SCRATCH_REGS,
+ BPF_MOV64_REG(BPF_REG_0, MAX_BPF_REG),
+ BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, 0),
+ },
+},
+{
+ "sanitize ldx: src is others, dst is others",
+ .insns = {
+ BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
+ BPF_ST_MEM(BPF_DW, BPF_REG_2, -8, 1),
+ BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -8),
+ BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 1, 2),
+ BPF_MOV64_IMM(BPF_REG_0, 2),
+ BPF_EXIT_INSN(),
+ BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
+ BPF_EXIT_INSN(),
+ },
+ .result = ACCEPT,
+ .retval = 1,
+ .expected_insns = {
+ BACKUP_SCRATCH_REGS,
+ BPF_MOV64_REG(MAX_BPF_REG, BPF_REG_0),
+ BPF_MOV64_REG(BPF_REG_1, BPF_REG_2),
+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
+ BPF_EMIT_CALL(INSN_IMM_MASK),
+ RESTORE_SCRATCH_REGS,
+ BPF_MOV64_REG(BPF_REG_0, MAX_BPF_REG),
+ BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_2, -8),
+ },
+},
+{
+ "sanitize LDX: SRC is R10",
+ .insns = {
+ BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 1),
+ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
+ BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 1, 1),
+ BPF_MOV64_IMM(BPF_REG_0, 2),
+ BPF_EXIT_INSN(),
+ },
+ .result = ACCEPT,
+ .retval = 1,
+ .unexpected_insns = {
+ BPF_EMIT_CALL(INSN_IMM_MASK),
+ },
+},
+#endif /* CONFIG_BPF_PROG_KASAN */
--
2.38.1
next prev parent reply other threads:[~2022-11-25 12:29 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-11-25 12:29 [PATCH bpf-next v3 0/3] bpf: Add LDX/STX/ST sanitize in jited BPF progs Hao Sun
2022-11-25 12:29 ` [PATCH bpf-next v3 1/3] bpf: Sanitize STX/ST in jited BPF progs with KASAN Hao Sun
2022-11-25 12:29 ` [PATCH bpf-next v3 2/3] bpf: Sanitize LDX " Hao Sun
2022-11-25 12:29 ` Hao Sun [this message]
2022-11-28 0:38 ` [PATCH bpf-next v3 0/3] bpf: Add LDX/STX/ST sanitize in jited BPF progs Alexei Starovoitov
2022-11-28 1:41 ` Hao Sun
2022-11-28 2:12 ` Alexei Starovoitov
2022-11-28 2:58 ` Hao Sun
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20221125122912.54709-4-sunhao.th@gmail.com \
--to=sunhao.th@gmail.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=davem@davemloft.net \
--cc=haoluo@google.com \
--cc=john.fastabend@gmail.com \
--cc=jolsa@kernel.org \
--cc=kpsingh@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=martin.lau@linux.dev \
--cc=sdf@google.com \
--cc=song@kernel.org \
--cc=yhs@fb.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.