From: Yonghong Song <yhs@fb.com>
To: Martin KaFai Lau <kafai@fb.com>, <bpf@vger.kernel.org>
Cc: Alexei Starovoitov <ast@kernel.org>,
Andrii Nakryiko <andrii@kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>, <kernel-team@fb.com>,
Hengqi Chen <hengqi.chen@gmail.com>,
Yonghong Song <yhs@gmail.com>
Subject: Re: [PATCH bpf-next 1/2] bpf: Do not reject when the stack read size is different from the tracked scalar size
Date: Tue, 2 Nov 2021 08:59:10 -0700 [thread overview]
Message-ID: <1fe8fbed-497b-1874-abc5-3f104a4d8b44@fb.com> (raw)
In-Reply-To: <20211102064535.316018-1-kafai@fb.com>
On 11/1/21 11:45 PM, Martin KaFai Lau wrote:
> Below is a simplified case from a report in bcc [0]:
> r4 = 20
> *(u32 *)(r10 -4) = r4
> *(u32 *)(r10 -8) = r4 /* r4 state is tracked */
> r4 = *(u64 *)(r10 -8) /* Read more than the tracked 32bit scalar.
> * verifier rejects as 'corrupted spill memory'.
> */
>
> After commit 354e8f1970f8 ("bpf: Support <8-byte scalar spill and refill"),
> the 8-byte aligned 32bit spill is also tracked by the verifier
> and the reg state is stored.
>
> However, if 8 bytes are read from the stack instead of the tracked
> 4 byte scalar, the verifier currently rejects as "corrupted spill memory".
>
> This patch fixes this case by allowing it to read but marks the reg as
> unknown.
>
> Also note that, if the prog is trying to corrupt/leak an
> earlier spilled pointer by spilling another <8 bytes register on top,
> this has already been rejected in the check_stack_write_fixed_off().
>
> [0]: https://github.com/iovisor/bcc/pull/3683
>
> Fixes: 354e8f1970f8 ("bpf: Support <8-byte scalar spill and refill")
> Reported-by: Hengqi Chen <hengqi.chen@gmail.com>
> Reported-by: Yonghong Song <yhs@gmail.com>
> Signed-off-by: Martin KaFai Lau <kafai@fb.com>
Acked-by: Yonghong Song <yhs@fb.com>
next prev parent reply other threads:[~2021-11-02 15:59 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-11-02 6:45 [PATCH bpf-next 0/2] bpf: Allow doing stack read with size larger than the earlier spilled reg Martin KaFai Lau
2021-11-02 6:45 ` [PATCH bpf-next 1/2] bpf: Do not reject when the stack read size is different from the tracked scalar size Martin KaFai Lau
2021-11-02 13:45 ` Hengqi Chen
2021-11-02 15:59 ` Yonghong Song [this message]
2021-11-02 6:45 ` [PATCH bpf-next 2/2] bpf: selftest: verifier test on refill from a smaller spill Martin KaFai Lau
2021-11-02 15:59 ` Yonghong Song
2021-11-03 15:00 ` [PATCH bpf-next 0/2] bpf: Allow doing stack read with size larger than the earlier spilled reg patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1fe8fbed-497b-1874-abc5-3f104a4d8b44@fb.com \
--to=yhs@fb.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=hengqi.chen@gmail.com \
--cc=kafai@fb.com \
--cc=kernel-team@fb.com \
--cc=yhs@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox