[bug report] bpf/verifier: track liveness for pruning

[bug report] bpf/verifier: track liveness for pruning

[Dan Carpenter]

Hello Edward Cree,

The patch dc503a8ad984: "bpf/verifier: track liveness for pruning"
from Aug 15, 2017, leads to the following static checker warning:

	kernel/bpf/verifier.c:3463 do_propagate_liveness()
	error: buffer overflow 'parent->regs' 11 <= 63

kernel/bpf/verifier.c
  3435  static bool do_propagate_liveness(const struct bpf_verifier_state *state,
  3436                                    struct bpf_verifier_state *parent)
  3437  {
  3438          bool touched = false; /* any changes made? */
  3439          int i;
  3440  
  3441          if (!parent)
  3442                  return touched;
  3443          /* Propagate read liveness of registers... */
  3444          BUILD_BUG_ON(BPF_REG_FP + 1 != MAX_BPF_REG);
  3445          /* We don't need to worry about FP liveness because it's read-only */
  3446          for (i = 0; i < BPF_REG_FP; i++) {

This loop goes from 0-ARRAY_SIZE(state->regs)

  3447                  if (parent->regs[i].live & REG_LIVE_READ)
  3448                          continue;
  3449                  if (state->regs[i].live = REG_LIVE_READ) {
  3450                          parent->regs[i].live |= REG_LIVE_READ;

So it's a more natural place to set parent->regs[i].live.

  3451                          touched = true;
  3452                  }
  3453          }
  3454          /* ... and stack slots */
  3455          for (i = 0; i < MAX_BPF_STACK / BPF_REG_SIZE; i++) {

This loop is longer.

  3456                  if (parent->stack_slot_type[i * BPF_REG_SIZE] != STACK_SPILL)
  3457                          continue;
  3458                  if (state->stack_slot_type[i * BPF_REG_SIZE] != STACK_SPILL)
  3459                          continue;
  3460                  if (parent->spilled_regs[i].live & REG_LIVE_READ)
  3461                          continue;
  3462                  if (state->spilled_regs[i].live = REG_LIVE_READ) {
  3463                          parent->regs[i].live |= REG_LIVE_READ;
                                ^^^^^^^^^^^^^^^^^^^^
And causes a static checker warning.  Smatch doesn't track arrays well,
and I also find it tricky to know if this is a real bug or we always hit
a continue or whatever so I'm not sure if this a real bug or not.

  3464                          touched = true;
  3465                  }
  3466          }
  3467          return touched;
  3468  }

regards,
dan carpenter

Re: [bug report] bpf/verifier: track liveness for pruning

[Daniel Borkmann]

On 08/17/2017 09:44 AM, Dan Carpenter wrote:
> Hello Edward Cree,
>
> The patch dc503a8ad984: "bpf/verifier: track liveness for pruning"
> from Aug 15, 2017, leads to the following static checker warning:
>
> 	kernel/bpf/verifier.c:3463 do_propagate_liveness()
> 	error: buffer overflow 'parent->regs' 11 <= 63

This should be the below. Will submit a proper one after some tests.

Thanks for spotting!

 From 385a1a9f16bf70e0139b38a68252380d6380e003 Mon Sep 17 00:00:00 2001
Message-Id: <385a1a9f16bf70e0139b38a68252380d6380e003.1502971079.git.daniel@iogearbox.net>
From: Daniel Borkmann <daniel@iogearbox.net>
Date: Thu, 17 Aug 2017 13:57:38 +0200
Subject: [PATCH net-next] bpf: fix liveness propagation to parent in stack slots

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
---
  kernel/bpf/verifier.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 958ba84..40f669d 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -3460,7 +3460,7 @@ static bool do_propagate_liveness(const struct bpf_verifier_state *state,
  		if (parent->spilled_regs[i].live & REG_LIVE_READ)
  			continue;
  		if (state->spilled_regs[i].live = REG_LIVE_READ) {
-			parent->regs[i].live |= REG_LIVE_READ;
+			parent->spilled_regs[i].live |= REG_LIVE_READ;
  			touched = true;
  		}
  	}
-- 
1.9.3

Re: [bug report] bpf/verifier: track liveness for pruning

[Edward Cree]

On 17/08/17 13:00, Daniel Borkmann wrote:
> On 08/17/2017 09:44 AM, Dan Carpenter wrote:
>> Hello Edward Cree,
>>
>> The patch dc503a8ad984: "bpf/verifier: track liveness for pruning"
>> from Aug 15, 2017, leads to the following static checker warning:
>>
>>     kernel/bpf/verifier.c:3463 do_propagate_liveness()
>>     error: buffer overflow 'parent->regs' 11 <= 63
>
> This should be the below. Will submit a proper one after some tests.
>
> Thanks for spotting!
>
> From 385a1a9f16bf70e0139b38a68252380d6380e003 Mon Sep 17 00:00:00 2001
> Message-Id: <385a1a9f16bf70e0139b38a68252380d6380e003.1502971079.git.daniel@iogearbox.net>
> From: Daniel Borkmann <daniel@iogearbox.net>
> Date: Thu, 17 Aug 2017 13:57:38 +0200
> Subject: [PATCH net-next] bpf: fix liveness propagation to parent in stack slots
>
> Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Edward Cree <ecree@solarflare.com>
> ---
>  kernel/bpf/verifier.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 958ba84..40f669d 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -3460,7 +3460,7 @@ static bool do_propagate_liveness(const struct bpf_verifier_state *state,
>          if (parent->spilled_regs[i].live & REG_LIVE_READ)
>              continue;
>          if (state->spilled_regs[i].live = REG_LIVE_READ) {
> -            parent->regs[i].live |= REG_LIVE_READ;
> +            parent->spilled_regs[i].live |= REG_LIVE_READ;
>              touched = true;
>          }
>      }
The information contained in this message is confidential and is intended for the addressee(s) only. If you have received this message in error, please notify the sender immediately and delete the message. Unless you are an addressee (or authorized to receive for an addressee), you may not use, copy or disclose to anyone this message or any information contained in this message. The unauthorized use, disclosure, copying or alteration of this message is strictly prohibited.