mbox series

[bpf,v1,0/2] bpf: Fix precision tracking for BPF_ALU | BPF_TO_BE | BPF_END

Message ID 20231102053913.12004-1-shung-hsi.yu@suse.com (mailing list archive)
Headers show
Series bpf: Fix precision tracking for BPF_ALU | BPF_TO_BE | BPF_END | expand

Message

Shung-Hsi Yu Nov. 2, 2023, 5:39 a.m. UTC 
Changes since v1:
- add test for negation and bswap (Alexei, Eduard)
- add test for BPF_TO_LE as well to cover all types of BPF_END opcode
- remove vals map and trigger backtracking with jump instead, based of
  Eduard's code
- v1 at https://lore.kernel.org/bpf/20231030132145.20867-1-shung-hsi.yu@suse.com

This patchset fixes and adds selftest for the issue reported by Mohamed
Mahmoud and Toke Høiland-Jørgensen where the kernel can run into a
verifier bug during backtracking of BPF_ALU | BPF_TO_BE | BPF_END
instruction[0]. As seen in the verifier log below, r0 was incorrectly
marked as precise even tough its value was not being used.

Patch 1 fixes the issue based on Andrii's analysis, and patch 2 adds a
selftest for such case using inline assembly. Please see individual
patch for detail.

    ...
	mark_precise: frame2: regs=r2 stack= before 1891: (77) r2 >>= 56
	mark_precise: frame2: regs=r2 stack= before 1890: (dc) r2 = be64 r2
	mark_precise: frame2: regs=r0,r2 stack= before 1889: (73) *(u8 *)(r1 +47) = r3
	...
	mark_precise: frame2: regs=r0 stack= before 212: (85) call pc+1617
	BUG regs 1
	processed 5112 insns (limit 1000000) max_states_per_insn 4 total_states 92 peak_states 90 mark_read 20

0: https://lore.kernel.org/r/87jzrrwptf.fsf@toke.dk


Shung-Hsi Yu (2):
  bpf: Fix precision tracking for BPF_ALU | BPF_TO_BE | BPF_END
  selftests/bpf: precision tracking test for BPF_NEG and BPF_END

 kernel/bpf/verifier.c                         |  7 +-
 .../selftests/bpf/prog_tests/verifier.c       |  2 +
 .../selftests/bpf/progs/verifier_precision.c  | 93 +++++++++++++++++++
 3 files changed, 101 insertions(+), 1 deletion(-)
 create mode 100644 tools/testing/selftests/bpf/progs/verifier_precision.c


base-commit: c17cda15cc86e65e9725641daddcd7a63cc9ad01

Comments

patchwork-bot+netdevbpf@kernel.org Nov. 2, 2023, 6:10 a.m. UTC | #1 
Hello:

This series was applied to bpf/bpf.git (master)
by Alexei Starovoitov <ast@kernel.org>:

On Thu,  2 Nov 2023 13:39:02 +0800 you wrote:
> Changes since v1:
> - add test for negation and bswap (Alexei, Eduard)
> - add test for BPF_TO_LE as well to cover all types of BPF_END opcode
> - remove vals map and trigger backtracking with jump instead, based of
>   Eduard's code
> - v1 at https://lore.kernel.org/bpf/20231030132145.20867-1-shung-hsi.yu@suse.com
> 
> [...]

Here is the summary with links:
  - [bpf,v1,1/2] bpf: Fix precision tracking for BPF_ALU | BPF_TO_BE | BPF_END
    https://git.kernel.org/bpf/bpf/c/291d044fd51f
  - [bpf,v1,2/2] selftests/bpf: precision tracking test for BPF_NEG and BPF_END
    https://git.kernel.org/bpf/bpf/c/3c41971550f5

You are awesome, thank you!