From: Martin KaFai Lau <martin.lau@linux.dev>
To: Hao Sun <sunhao.th@gmail.com>
Cc: ast@kernel.org, daniel@iogearbox.net, john.fastabend@gmail.com,
andrii@kernel.org, song@kernel.org, yhs@fb.com,
kpsingh@kernel.org, sdf@google.com, haoluo@google.com,
jolsa@kernel.org, davem@davemloft.net,
linux-kernel@vger.kernel.org, bpf@vger.kernel.org
Subject: Re: [PATCH bpf-next v3 1/2] bpf: fix nullness propagation for reg to reg comparisons
Date: Thu, 22 Dec 2022 17:31:02 -0800 [thread overview]
Message-ID: <e46452f4-a274-1b9e-2b33-668cc0f258b5@linux.dev> (raw)
In-Reply-To: <20221222024414.29539-1-sunhao.th@gmail.com>
On 12/21/22 6:44 PM, Hao Sun wrote:
> After befae75856ab, the verifier would propagate null information after
> JEQ/JNE, e.g., if two pointers, one is maybe_null and the other is not,
> the former would be marked as non-null in eq path. However, as comment
> "PTR_TO_BTF_ID points to a kernel struct that does not need to be null
> checked by the BPF program ... The verifier must keep this in mind and
> can make no assumptions about null or non-null when doing branch ...".
> If one pointer is maybe_null and the other is PTR_TO_BTF, the former is
> incorrectly marked non-null. The following BPF prog can trigger a
> null-ptr-deref, also see this report for more details[1]:
>
> 0: (18) r1 = map_fd ; R1_w=map_ptr(ks=4, vs=4)
> 2: (79) r6 = *(u64 *)(r1 +8) ; R6_w=bpf_map->inner_map_data
> ; R6 is PTR_TO_BTF_ID
> ; equals to null at runtime
> 3: (bf) r2 = r10
> 4: (07) r2 += -4
> 5: (62) *(u32 *)(r2 +0) = 0
> 6: (85) call bpf_map_lookup_elem#1 ; R0_w=map_value_or_null
> 7: (1d) if r6 == r0 goto pc+1
> 8: (95) exit
> ; from 7 to 9: R0=map_value R6=ptr_bpf_map
> 9: (61) r0 = *(u32 *)(r0 +0) ; null-ptr-deref
> 10: (95) exit
>
> So, make the verifier propagate nullness information for reg to reg
> comparisons only if neither reg is PTR_TO_BTF_ID.
>
> [1] https://lore.kernel.org/bpf/CACkBjsaFJwjC5oiw-1KXvcazywodwXo4zGYsRHwbr2gSG9WcSw@mail.gmail.com/T/#u
>
> Fixes: befae75856ab4 ("bpf: propagate nullness information for reg to reg comparisons")
The "Fixes" tag has one more hex digit. I have corrected it and applied to the
bpf tree. Thanks.
Please run checkpatch.pl in the future:
WARNING: Please use correct Fixes: style 'Fixes: <12 chars of sha1> ("<title
line>")' - ie: 'Fixes: befae75856ab ("bpf: propagate nullness information for
reg to reg comparisons")'
#35:
Fixes: befae75856ab4 ("bpf: propagate nullness information for reg to reg
comparisons")
next prev parent reply other threads:[~2022-12-23 1:31 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-12-22 2:44 [PATCH bpf-next v3 1/2] bpf: fix nullness propagation for reg to reg comparisons Hao Sun
2022-12-22 2:44 ` [PATCH bpf-next v3 2/2] selftests/bpf: check null propagation only neither reg is PTR_TO_BTF_ID Hao Sun
2022-12-23 1:30 ` [PATCH bpf-next v3 1/2] bpf: fix nullness propagation for reg to reg comparisons patchwork-bot+netdevbpf
2022-12-23 1:31 ` Martin KaFai Lau [this message]
2022-12-23 1:39 ` Hao Sun
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=e46452f4-a274-1b9e-2b33-668cc0f258b5@linux.dev \
--to=martin.lau@linux.dev \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=davem@davemloft.net \
--cc=haoluo@google.com \
--cc=john.fastabend@gmail.com \
--cc=jolsa@kernel.org \
--cc=kpsingh@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=sdf@google.com \
--cc=song@kernel.org \
--cc=sunhao.th@gmail.com \
--cc=yhs@fb.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.