From: Yonghong Song <yhs@fb.com>
To: Andrii Nakryiko <andriin@fb.com>, <bpf@vger.kernel.org>,
Martin KaFai Lau <kafai@fb.com>, <netdev@vger.kernel.org>
Cc: Alexei Starovoitov <ast@fb.com>,
Daniel Borkmann <daniel@iogearbox.net>, <kernel-team@fb.com>
Subject: [PATCH bpf-next v3 14/21] bpf: handle spilled PTR_TO_BTF_ID properly when checking stack_boundary
Date: Wed, 6 May 2020 22:39:31 -0700 [thread overview]
Message-ID: <20200507053931.1544470-1-yhs@fb.com> (raw)
In-Reply-To: <20200507053915.1542140-1-yhs@fb.com>
This specifically to handle the case like below:
// ptr below is a socket ptr identified by PTR_TO_BTF_ID
u64 param[2] = { ptr, val };
bpf_seq_printf(seq, fmt, sizeof(fmt), param, sizeof(param));
In this case, the 16 bytes stack for "param" contains:
8 bytes for ptr with spilled PTR_TO_BTF_ID
8 bytes for val as STACK_MISC
The current verifier will complain the ptr should not be visible
to the helper.
...
16: (7b) *(u64 *)(r10 -64) = r2
18: (7b) *(u64 *)(r10 -56) = r1
19: (bf) r4 = r10
;
20: (07) r4 += -64
; BPF_SEQ_PRINTF(seq, fmt1, (long)s, s->sk_protocol);
21: (bf) r1 = r6
22: (18) r2 = 0xffffa8d00018605a
24: (b4) w3 = 10
25: (b4) w5 = 16
26: (85) call bpf_seq_printf#125
R0=inv(id=0) R1_w=ptr_seq_file(id=0,off=0,imm=0)
R2_w=map_value(id=0,off=90,ks=4,vs=144,imm=0) R3_w=inv10
R4_w=fp-64 R5_w=inv16 R6=ptr_seq_file(id=0,off=0,imm=0)
R7=ptr_netlink_sock(id=0,off=0,imm=0) R10=fp0 fp-56_w=mmmmmmmm
fp-64_w=ptr_
last_idx 26 first_idx 13
regs=8 stack=0 before 25: (b4) w5 = 16
regs=8 stack=0 before 24: (b4) w3 = 10
invalid indirect read from stack off -64+0 size 16
Acked-by: Andrii Nakryiko <andriin@fb.com>
Signed-off-by: Yonghong Song <yhs@fb.com>
---
kernel/bpf/verifier.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 36b2a38a06fe..2a1826c76bb6 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -3494,6 +3494,11 @@ static int check_stack_boundary(struct bpf_verifier_env *env, int regno,
*stype = STACK_MISC;
goto mark;
}
+
+ if (state->stack[spi].slot_type[0] == STACK_SPILL &&
+ state->stack[spi].spilled_ptr.type == PTR_TO_BTF_ID)
+ goto mark;
+
if (state->stack[spi].slot_type[0] == STACK_SPILL &&
state->stack[spi].spilled_ptr.type == SCALAR_VALUE) {
__mark_reg_unknown(env, &state->stack[spi].spilled_ptr);
--
2.24.1
next prev parent reply other threads:[~2020-05-07 5:40 UTC|newest]
Thread overview: 45+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-05-07 5:39 [PATCH bpf-next v3 00/21] bpf: implement bpf iterator for kernel data Yonghong Song
2020-05-07 5:39 ` [PATCH bpf-next v3 01/21] bpf: implement an interface to register bpf_iter targets Yonghong Song
2020-05-08 18:18 ` Andrii Nakryiko
2020-05-07 5:39 ` [PATCH bpf-next v3 02/21] bpf: allow loading of a bpf_iter program Yonghong Song
2020-05-08 18:20 ` Andrii Nakryiko
2020-05-07 5:39 ` [PATCH bpf-next v3 03/21] bpf: support bpf tracing/iter programs for BPF_LINK_CREATE Yonghong Song
2020-05-08 18:24 ` Andrii Nakryiko
2020-05-09 1:36 ` Yonghong Song
2020-05-12 3:15 ` Andrii Nakryiko
2020-05-13 16:57 ` Yonghong Song
2020-05-07 5:39 ` [PATCH bpf-next v3 04/21] bpf: support bpf tracing/iter programs for BPF_LINK_UPDATE Yonghong Song
2020-05-07 5:39 ` [PATCH bpf-next v3 05/21] bpf: implement bpf_seq_read() for bpf iterator Yonghong Song
2020-05-08 18:52 ` Andrii Nakryiko
2020-05-09 1:41 ` Yonghong Song
2020-05-07 5:39 ` [PATCH bpf-next v3 06/21] bpf: create anonymous " Yonghong Song
2020-05-08 18:57 ` Andrii Nakryiko
2020-05-07 5:39 ` [PATCH bpf-next v3 07/21] bpf: create file " Yonghong Song
2020-05-07 5:39 ` [PATCH bpf-next v3 08/21] bpf: implement common macros/helpers for target iterators Yonghong Song
2020-05-08 19:07 ` Andrii Nakryiko
2020-05-09 3:18 ` Yonghong Song
2020-05-12 3:16 ` Andrii Nakryiko
2020-05-07 5:39 ` [PATCH bpf-next v3 09/21] bpf: add bpf_map iterator Yonghong Song
2020-05-07 5:39 ` [PATCH bpf-next v3 10/21] net: bpf: add netlink and ipv6_route bpf_iter targets Yonghong Song
2020-05-08 19:17 ` Andrii Nakryiko
2020-05-07 5:39 ` [PATCH bpf-next v3 11/21] bpf: add task and task/file iterator targets Yonghong Song
2020-05-08 19:36 ` Andrii Nakryiko
2020-05-07 5:39 ` [PATCH bpf-next v3 12/21] bpf: add PTR_TO_BTF_ID_OR_NULL support Yonghong Song
2020-05-07 5:39 ` [PATCH bpf-next v3 13/21] bpf: add bpf_seq_printf and bpf_seq_write helpers Yonghong Song
2020-05-08 19:44 ` Andrii Nakryiko
2020-05-09 4:18 ` Yonghong Song
2020-05-09 5:30 ` Alexei Starovoitov
2020-05-09 6:04 ` Yonghong Song
2020-05-07 5:39 ` Yonghong Song [this message]
2020-05-07 5:39 ` [PATCH bpf-next v3 15/21] bpf: support variable length array in tracing programs Yonghong Song
2020-05-07 5:39 ` [PATCH bpf-next v3 16/21] tools/libbpf: add bpf_iter support Yonghong Song
2020-05-08 19:46 ` Andrii Nakryiko
2020-05-07 5:39 ` [PATCH bpf-next v3 17/21] tools/libpf: add offsetof/container_of macro in bpf_helpers.h Yonghong Song
2020-05-08 19:48 ` Andrii Nakryiko
2020-05-07 5:39 ` [PATCH bpf-next v3 18/21] tools/bpftool: add bpf_iter support for bptool Yonghong Song
2020-05-08 19:51 ` Andrii Nakryiko
2020-05-09 5:26 ` Yonghong Song
2020-05-07 5:39 ` [PATCH bpf-next v3 19/21] tools/bpf: selftests: add iterator programs for ipv6_route and netlink Yonghong Song
2020-05-07 5:39 ` [PATCH bpf-next v3 20/21] tools/bpf: selftests: add iter progs for bpf_map/task/task_file Yonghong Song
2020-05-07 5:39 ` [PATCH bpf-next v3 21/21] tools/bpf: selftests: add bpf_iter selftests Yonghong Song
2020-05-08 19:57 ` Andrii Nakryiko
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200507053931.1544470-1-yhs@fb.com \
--to=yhs@fb.com \
--cc=andriin@fb.com \
--cc=ast@fb.com \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=kafai@fb.com \
--cc=kernel-team@fb.com \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox