From: Martin KaFai Lau <martin.lau@linux.dev>
To: Hao Sun <sunhao.th@gmail.com>
Cc: ast@kernel.org, daniel@iogearbox.net, john.fastabend@gmail.com,
andrii@kernel.org, song@kernel.org, yhs@fb.com,
kpsingh@kernel.org, sdf@google.com, haoluo@google.com,
jolsa@kernel.org, davem@davemloft.net,
linux-kernel@vger.kernel.org, bpf@vger.kernel.org
Subject: Re: [PATCH bpf-next v3 1/2] bpf: fix nullness propagation for reg to reg comparisons
Date: Thu, 22 Dec 2022 17:31:02 -0800 [thread overview]
Message-ID: <e46452f4-a274-1b9e-2b33-668cc0f258b5@linux.dev> (raw)
In-Reply-To: <20221222024414.29539-1-sunhao.th@gmail.com>
On 12/21/22 6:44 PM, Hao Sun wrote:
> After befae75856ab, the verifier would propagate null information after
> JEQ/JNE, e.g., if two pointers, one is maybe_null and the other is not,
> the former would be marked as non-null in eq path. However, as comment
> "PTR_TO_BTF_ID points to a kernel struct that does not need to be null
> checked by the BPF program ... The verifier must keep this in mind and
> can make no assumptions about null or non-null when doing branch ...".
> If one pointer is maybe_null and the other is PTR_TO_BTF, the former is
> incorrectly marked non-null. The following BPF prog can trigger a
> null-ptr-deref, also see this report for more details[1]:
>
> 0: (18) r1 = map_fd ; R1_w=map_ptr(ks=4, vs=4)
> 2: (79) r6 = *(u64 *)(r1 +8) ; R6_w=bpf_map->inner_map_data
> ; R6 is PTR_TO_BTF_ID
> ; equals to null at runtime
> 3: (bf) r2 = r10
> 4: (07) r2 += -4
> 5: (62) *(u32 *)(r2 +0) = 0
> 6: (85) call bpf_map_lookup_elem#1 ; R0_w=map_value_or_null
> 7: (1d) if r6 == r0 goto pc+1
> 8: (95) exit
> ; from 7 to 9: R0=map_value R6=ptr_bpf_map
> 9: (61) r0 = *(u32 *)(r0 +0) ; null-ptr-deref
> 10: (95) exit
>
> So, make the verifier propagate nullness information for reg to reg
> comparisons only if neither reg is PTR_TO_BTF_ID.
>
> [1] https://lore.kernel.org/bpf/CACkBjsaFJwjC5oiw-1KXvcazywodwXo4zGYsRHwbr2gSG9WcSw@mail.gmail.com/T/#u
>
> Fixes: befae75856ab4 ("bpf: propagate nullness information for reg to reg comparisons")
The "Fixes" tag has one more hex digit. I have corrected it and applied to the
bpf tree. Thanks.
Please run checkpatch.pl in the future:
WARNING: Please use correct Fixes: style 'Fixes: <12 chars of sha1> ("<title
line>")' - ie: 'Fixes: befae75856ab ("bpf: propagate nullness information for
reg to reg comparisons")'
#35:
Fixes: befae75856ab4 ("bpf: propagate nullness information for reg to reg
comparisons")
next prev parent reply other threads:[~2022-12-23 1:31 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-12-22 2:44 [PATCH bpf-next v3 1/2] bpf: fix nullness propagation for reg to reg comparisons Hao Sun
2022-12-22 2:44 ` [PATCH bpf-next v3 2/2] selftests/bpf: check null propagation only neither reg is PTR_TO_BTF_ID Hao Sun
2022-12-23 1:30 ` [PATCH bpf-next v3 1/2] bpf: fix nullness propagation for reg to reg comparisons patchwork-bot+netdevbpf
2022-12-23 1:31 ` Martin KaFai Lau [this message]
2022-12-23 1:39 ` Hao Sun
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=e46452f4-a274-1b9e-2b33-668cc0f258b5@linux.dev \
--to=martin.lau@linux.dev \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=davem@davemloft.net \
--cc=haoluo@google.com \
--cc=john.fastabend@gmail.com \
--cc=jolsa@kernel.org \
--cc=kpsingh@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=sdf@google.com \
--cc=song@kernel.org \
--cc=sunhao.th@gmail.com \
--cc=yhs@fb.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox