Re: [PATCH v2 bpf-next 09/13] bpf: Allow fmod_ret on tagged functions and check the return value

[Anton Protopopov <a.s.protopopov@gmail.com>]

On 26/11/13 05:08AM, Alexei Starovoitov wrote:
> From: Anton Protopopov <a.s.protopopov@gmail.com>
> 
> 	SEC("fmod_ret/vfs_fallocate")
> 	int BPF_PROG(no_big_files, struct file *file, int mode,
> 		     loff_t offset, loff_t len, int ret)
> 	{
> 		return len > MAX_LEN ? -EFBIG : 0;
> 	}
> 
> This program keeps user space away from a bug below vfs_fallocate() until
> the fixed kernel runs. It does not load: "vfs_fallocate() is not
> modifiable". The build has tagged the function with the errors that it
> returns, the list: "bpf_fmodret_retval:-95,-29,-27,-26,-22,-21,-19,-9,-1".
> 
> Let an fmod_ret program that is not sleepable attach to a tagged function.
> The declared targets stay as they are: what a program returns there is not
> checked. A caller of a tagged function can get each error of the list from
> the function itself.
> The build knows nothing about other values:
> 
> 	R0 at an exit           the trampoline
> 	0                       calls the function
> 	an error of the list    skips it, the caller gets the error
> 	another value           -, the program does not load
> 
> With -EDQUOT in place of -EFBIG:
> 
>   At program exit the register R0 should be 0 or one of -95,-29,-27,..
> 
> The check is static: every value in the range of R0 is 0 or in the list.
> [-27, 0] has -25, which is not in the list. The program above gets to the
> exit in two states, R0 = -27 and R0 = 0. The verifier tests R0 at the
> exit, so flow_join_makes_up() does not join ranges that leave a gap.
> 
> R0 has a 64-bit and a 32-bit range. clang ends "return a && b ? -EPERM : 0"
> with "w0 &= 1; w0 = -w0; exit". That is [0, U32_MAX] and [-1, 0].
> 
> 	target returns   range     R0 at the exit
> 	int              32-bit    w0 = -22        -22, allowed
> 	                           r0 = 1 << 32    rejected
> 	long             64-bit    w0 = -22        4294967274, rejected
> 
> The caller of an int function reads the low 32 bits. The trampoline tests
> all 64 bits: 1 << 32 skips the function and the caller sees 0. So the
> 32-bit range decides only if the high 32 bits are known to be 0. That
> fits the ABI of x86-64 and arm64, see the comment.
> 
> 	What returns to the trampoline
> 	exit of the main program, of an exception callback    checked
> 	cookie of bpf_throw(), default callback               checked
> 	tail call                                             refused
> 	extension of the main program      refused by existing checks
> 
> Signed-off-by: Anton Protopopov <a.s.protopopov@gmail.com>
> Co-developed-by: Alexei Starovoitov <ast@kernel.org>
> Signed-off-by: Alexei Starovoitov <ast@kernel.org>

Please consider taking also this commit from v3, which requires JIT for fmodret functions: https://github.com/aspsk/bpf-next/commit/f8abd203106bc3f0cf978f2292148d4a63f66b26

> [...]