ebpf can allow sub-word load results to be used as 64-bit pointers

[rtm@csail.mit.edu]

When I modify the bpf_cubic_init() function from

  https://github.com/aroodgar/bpf-tcp-congestion-control-algorithm

to read:

SEC("struct_ops/bpf_cubic_init")
void BPF_PROG(bpf_cubic_init, struct sock *sk) 
{
  asm volatile("r2 = *(u16*)(r1 + 0)");     // verifier should demand u64
  asm volatile("*(u32 *)(r2 +1504) = 0");   // 1280 in some configs
}

the verifier accepts it, but the second line crashes when it runs during
a TCP connect() because the "*(u16*)" in the load from context yields
only the low bits of the pointer.

Linux ubuntu66 6.12.0-11677-g2ba9f676d0a2 #10 SMP Sat Nov 30 11:28:09 EST 2024 x86_64 x86_64 x86_64 GNU/Linux

BUG: unable to handle page fault for address: 0000000000001020
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
PGD 0 P4D 0
Oops: Oops: 0002 [#1] SMP PTI
CPU: 6 UID: 0 PID: 1546 Comm: a.out Not tainted 6.12.0-11677-g2ba9f676d0a2 #10
Hardware name: FreeBSD BHYVE/BHYVE, BIOS 14.0 10/17/2021
RIP: 0010:bpf_prog_0e20ff5294b59096_bpf_cubic_init+0x19/0x25
Code: 00 cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc f3 0f 1e fa 0f 1f 44 00
 00 0f 1f 00 55 48 89 e5 f3 0f 1e fa 48 0f b7 77 00 <c7> 86 e0 05 00 00 00 00 00
 00 c9 c3 cc cc cc cc cc cc cc cc cc cc
RSP: 0018:ffffc9000076bc58 EFLAGS: 00010202
RAX: 0000000000000001 RBX: 0000000000000001 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000a40 RDI: ffffc9000076bc88
RBP: ffffc9000076bc58 R08: ffffc9000076bc40 R09: ffffc9000076bc20
R10: ffffffff842f3200 R11: ffffffff827659c0 R12: 0000000000000004
R13: ffff888105493098 R14: 0000000000000000 R15: 00000000ffffff8d
FS:  00007fa5348d1740(0000) GS:ffff88842fb80000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000001020 CR3: 000000010bbfa003 CR4: 00000000003706f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 ? __die+0x1e/0x60
 ? page_fault_oops+0x157/0x450
 ? eth_header+0x25/0xb0
 ? exc_page_fault+0x66/0x140
 ? asm_exc_page_fault+0x26/0x30
 ? bpf_prog_0e20ff5294b59096_bpf_cubic_init+0x19/0x25
 ? __bpf_prog_enter+0x14/0x60
 bpf__tcp_congestion_ops_init+0x47/0xa3
 tcp_init_congestion_control+0x2a/0xe0
 tcp_init_transfer+0x2b2/0x2d0
 tcp_finish_connect+0x82/0x130
 tcp_rcv_state_process+0x352/0xf20
 tcp_v4_do_rcv+0xca/0x240
 __release_sock+0xc6/0xd0
 release_sock+0x2a/0x90
 __inet_stream_connect+0x208/0x3c0
 ? __pfx_woken_wake_function+0x10/0x10
 inet_stream_connect+0x35/0x50
 __sys_connect+0x93/0xb0
 ? ksys_write+0x67/0xe0
 __x64_sys_connect+0x13/0x20
 ? ksys_write+0x67/0xe0
 __x64_sys_connect+0x13/0x20
 do_syscall_64+0x3f/0xd0
 entry_SYSCALL_64_after_hwframe+0x76/0x7e

Robert Morris
rtm@mit.edu