[PATCH v4 1/2] bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS

[PATCH v4 1/2] bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS

[Hao Sun]

For PTR_TO_FLOW_KEYS, check_flow_keys_access() only uses fixed off
for validation. However, variable offset ptr alu is not prohibited
for this ptr kind. So the variable offset is not checked.

The following prog is accepted:
func#0 @0
0: R1=ctx() R10=fp0
0: (bf) r6 = r1                       ; R1=ctx() R6_w=ctx()
1: (79) r7 = *(u64 *)(r6 +144)        ; R6_w=ctx() R7_w=flow_keys()
2: (b7) r8 = 1024                     ; R8_w=1024
3: (37) r8 /= 1                       ; R8_w=scalar()
4: (57) r8 &= 1024                    ; R8_w=scalar(smin=smin32=0,
smax=umax=smax32=umax32=1024,var_off=(0x0; 0x400))
5: (0f) r7 += r8
mark_precise: frame0: last_idx 5 first_idx 0 subseq_idx -1
mark_precise: frame0: regs=r8 stack= before 4: (57) r8 &= 1024
mark_precise: frame0: regs=r8 stack= before 3: (37) r8 /= 1
mark_precise: frame0: regs=r8 stack= before 2: (b7) r8 = 1024
6: R7_w=flow_keys(smin=smin32=0,smax=umax=smax32=umax32=1024,var_off
=(0x0; 0x400)) R8_w=scalar(smin=smin32=0,smax=umax=smax32=umax32=1024,
var_off=(0x0; 0x400))
6: (79) r0 = *(u64 *)(r7 +0)          ; R0_w=scalar()
7: (95) exit

This prog loads flow_keys to r7, and adds the variable offset r8
to r7, and finally causes out-of-bounds access:

BUG: unable to handle page fault for address: ffffc90014c80038
...
Call Trace:
 <TASK>
 bpf_dispatcher_nop_func include/linux/bpf.h:1231 [inline]
 __bpf_prog_run include/linux/filter.h:651 [inline]
 bpf_prog_run include/linux/filter.h:658 [inline]
 bpf_prog_run_pin_on_cpu include/linux/filter.h:675 [inline]
 bpf_flow_dissect+0x15f/0x350 net/core/flow_dissector.c:991
 bpf_prog_test_run_flow_dissector+0x39d/0x620 net/bpf/test_run.c:1359
 bpf_prog_test_run kernel/bpf/syscall.c:4107 [inline]
 __sys_bpf+0xf8f/0x4560 kernel/bpf/syscall.c:5475
 __do_sys_bpf kernel/bpf/syscall.c:5561 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:5559 [inline]
 __x64_sys_bpf+0x73/0xb0 kernel/bpf/syscall.c:5559
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x63/0x6b

Fix this by rejecting ptr alu with variable offset on flow_keys.
Applying the patch makes the program rejected with "R7 pointer
arithmetic on flow_keys prohibited"

Fixes: d58e468b1112 ("flow_dissector: implements flow dissector BPF hook")
Signed-off-by: Hao Sun <sunhao.th@gmail.com>
Acked-by: Yonghong Song <yonghong.song@linux.dev>
---
Changelogs:
	v3 -> v4: drop the success test in the second patch.
	v2 -> v3: format the second patch with proper number of tabs.
	v1 -> v2: add two test cases for the first patch.

 kernel/bpf/verifier.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 9507800026cf..bd1da0d3ebce 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -12862,6 +12862,10 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env,
 	}
 
 	switch (base_type(ptr_reg->type)) {
+	case PTR_TO_FLOW_KEYS:
+		if (known)
+			break;
+		fallthrough;
 	case CONST_PTR_TO_MAP:
 		/* smin_val represents the known value */
 		if (known && smin_val == 0 && opcode == BPF_ADD)
-- 
2.34.1

[PATCH v4 2/2] selftests/bpf: Add test for alu on PTR_TO_FLOW_KEYS

[Hao Sun]

Add a test case for PTR_TO_FLOW_KEYS alu. Testing if alu with
variable offset on flow_keys is rejected.

Signed-off-by: Hao Sun <sunhao.th@gmail.com>
---
 .../bpf/progs/verifier_value_illegal_alu.c    | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/tools/testing/selftests/bpf/progs/verifier_value_illegal_alu.c b/tools/testing/selftests/bpf/progs/verifier_value_illegal_alu.c
index 71814a753216..a9ab37d3b9e2 100644
--- a/tools/testing/selftests/bpf/progs/verifier_value_illegal_alu.c
+++ b/tools/testing/selftests/bpf/progs/verifier_value_illegal_alu.c
@@ -146,4 +146,23 @@ l0_%=:	exit;						\
 	: __clobber_all);
 }
 
+SEC("flow_dissector")
+__description("flow_keys illegal alu op with variable offset")
+__failure __msg("R7 pointer arithmetic on flow_keys prohibited")
+__naked void flow_keys_illegal_variable_offset_alu(void)
+{
+	asm volatile("					\
+	r6 = r1;					\
+	r7 = *(u64*)(r6 + %[flow_keys_off]);		\
+	r8 = 8;						\
+	r8 /= 1;					\
+	r8 &= 8;					\
+	r7 += r8;					\
+	r0 = *(u64*)(r7 + 0);				\
+	exit;						\
+"	:
+	: __imm_const(flow_keys_off, offsetof(struct __sk_buff, flow_keys))
+	: __clobber_all);
+}
+
 char _license[] SEC("license") = "GPL";
-- 
2.34.1

Re: [PATCH v4 2/2] selftests/bpf: Add test for alu on PTR_TO_FLOW_KEYS

[Yonghong Song]

On 1/15/24 12:20 AM, Hao Sun wrote:
> Add a test case for PTR_TO_FLOW_KEYS alu. Testing if alu with
> variable offset on flow_keys is rejected.
>
> Signed-off-by: Hao Sun <sunhao.th@gmail.com>

Acked-by: Yonghong Song <yonghong.song@linux.dev>

Re: [PATCH v4 2/2] selftests/bpf: Add test for alu on PTR_TO_FLOW_KEYS

[Daniel Borkmann]

On 1/15/24 9:20 AM, Hao Sun wrote:
> Add a test case for PTR_TO_FLOW_KEYS alu. Testing if alu with
> variable offset on flow_keys is rejected.
> 
> Signed-off-by: Hao Sun <sunhao.th@gmail.com>

Thanks applied, I've also added a note that we already have coverage
on the success case. Do you plan to follow up with checking the
remaining pointer types as Eduard suggested earlier?

Thanks,
Daniel

Re: [PATCH v4 2/2] selftests/bpf: Add test for alu on PTR_TO_FLOW_KEYS

[Hao Sun]

On Tue, Jan 16, 2024 at 5:20 PM Daniel Borkmann <daniel@iogearbox.net> wrote:
>
> On 1/15/24 9:20 AM, Hao Sun wrote:
> > Add a test case for PTR_TO_FLOW_KEYS alu. Testing if alu with
> > variable offset on flow_keys is rejected.
> >
> > Signed-off-by: Hao Sun <sunhao.th@gmail.com>
>
> Thanks applied, I've also added a note that we already have coverage
> on the success case. Do you plan to follow up with checking the
> remaining pointer types as Eduard suggested earlier?
>

Yes, will do it in the following days.