From patchwork Thu Oct 26 15:13:10 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Hao Sun X-Patchwork-Id: 13437661 X-Patchwork-Delegate: bpf@iogearbox.net Received: from lindbergh.monkeyblade.net (lindbergh.monkeyblade.net [23.128.96.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A46742DF9A for ; Thu, 26 Oct 2023 15:13:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="dOGplKLe" Received: from mail-wr1-x42b.google.com (mail-wr1-x42b.google.com [IPv6:2a00:1450:4864:20::42b]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F15F31B3; Thu, 26 Oct 2023 08:13:55 -0700 (PDT) Received: by mail-wr1-x42b.google.com with SMTP id ffacd0b85a97d-32da4ffd7e5so632405f8f.0; Thu, 26 Oct 2023 08:13:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1698333234; x=1698938034; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=4GZYfM9alYx1XV17SBVaQQmHlkvchqeTDUZzRxp2Jy0=; b=dOGplKLeaxgFaaM4GEvbyRJN5ySrNBqp2CYp14LNSKp9/DZ3dMEkpXlo8qD5s1Vj3u 2ZquMtROAjtb+H36v+g37ekN4cMhjM89OvaXVnginirI9zS72a6f67lQ6cm6r60UCr04 t1QX4kKgowj13JVrRRoqncgkd2T/uVvgKs36dZuUyi9dPgMKVXtb69oEZx7bNL7qwpV7 pcpssTzf1pTiUEZIoqNmi+xWHbg1aE7gp9epX8fmDg+BsvBdmsK0OVhSrtXzPv4Lhk8P c9oOkDjn8Lto0X0Wfc4fXp5EpdxIAY8DEEUnBnW5wodW3dG3mBrrcrGB6PQscN0Y21lg +ABg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1698333234; x=1698938034; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=4GZYfM9alYx1XV17SBVaQQmHlkvchqeTDUZzRxp2Jy0=; b=ctfv37clNsy4h7QsOJfErZ4fvEBdOxH4OynQ8u28KmH8WUgPJq9XKek5ibbfYMJOqp O08SJupttd7WunHETgbE2LdHAg+13cuyW1VqXxWwprCVVsGssJREHxx7ikPLrH3I/XGD lAhA6WOnE3n26lkVS3GOVwW7X7OpWJlePdbVZ0kf4e/0yhVo8LZZbf/1DKmO6zv0pOjm 1kJby5sTQgCg16G5oIYLg3c73dAlTYoF8JNppKInjGr9m2LA0dKTkPDRtxREbMhddDy/ EiIk0GT4wAPk79mq6GneL43hAAiMV6jfeM2ovvsGgB82ju02CeQqRjByK1auxvzQrv+s hTLQ== X-Gm-Message-State: AOJu0YxhGs812PRswLvyHvTI6l3wJobPnlEqdURl3hsNAF5kih2Bwg1Z cVgBQzpuXx9ammcMTOUosQ== X-Google-Smtp-Source: AGHT+IFo7NpHFXI5idFzGlmK+ztX8otPFBJI+8ajZV7yNDSBpaEqyzQ2RCwvfK+sw+TRBREMVc85Uw== X-Received: by 2002:adf:fac1:0:b0:32d:a3cb:4059 with SMTP id a1-20020adffac1000000b0032da3cb4059mr2733307wrs.24.1698333234312; Thu, 26 Oct 2023 08:13:54 -0700 (PDT) Received: from amdsuplus2.inf.ethz.ch (amdsuplus2.inf.ethz.ch. [129.132.31.88]) by smtp.gmail.com with ESMTPSA id p12-20020a05600c468c00b0040472ad9a3dsm2843778wmo.14.2023.10.26.08.13.53 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 26 Oct 2023 08:13:53 -0700 (PDT) From: Hao Sun Date: Thu, 26 Oct 2023 17:13:10 +0200 Subject: [PATCH bpf-next 1/2] bpf: Fix check_stack_write_fixed_off() to correctly spill imm Precedence: bulk X-Mailing-List: bpf@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Message-Id: <20231026-fix-check-stack-write-v1-1-6b325ef3ce7e@gmail.com> References: <20231026-fix-check-stack-write-v1-0-6b325ef3ce7e@gmail.com> In-Reply-To: <20231026-fix-check-stack-write-v1-0-6b325ef3ce7e@gmail.com> To: Alexei Starovoitov , Daniel Borkmann , John Fastabend , Andrii Nakryiko , Martin KaFai Lau , Song Liu , Yonghong Song , KP Singh , Stanislav Fomichev , Hao Luo , Jiri Olsa , Mykola Lysenko , Shuah Khan , Eduard Zingerman Cc: bpf@vger.kernel.org, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, Hao Sun X-Mailer: b4 0.12.3 X-Developer-Signature: v=1; a=ed25519-sha256; t=1698333232; l=1923; i=sunhao.th@gmail.com; s=20231009; h=from:subject:message-id; bh=AjbqDip507uf1NxfrRiMESWoZyiU61/MidrgGnrm2Jo=; b=oJUHqmVuu6c81zWOl/sr8oDm3BiMn6W2du8FnGH+2KE4zKTxCLtWoLcmmugBf0S4cTNati4uy VEkTXeODXocBnRvBko0pdZhOT3KglpHpjNBQz4MydugW6hF5QXfyFG/ X-Developer-Key: i=sunhao.th@gmail.com; a=ed25519; pk=AHFxrImGtyqXOuw4f5xTNh4PGReb7hzD86ayyTZCXd4= X-Patchwork-Delegate: bpf@iogearbox.net In check_stack_write_fixed_off(), imm value is cast to u32 before being spilled to the stack. Therefore, the sign information is lost, and the range information is incorrect when load from the stack again. For the following prog: 0: r2 = r10 1: *(u64*)(r2 -40) = -44 2: r0 = *(u64*)(r2 - 40) 3: if r0 s<= 0xa goto +2 4: r0 = 1 5: exit 6: r0 = 0 7: exit The verifier gives: func#0 @0 0: R1=ctx(off=0,imm=0) R10=fp0 0: (bf) r2 = r10 ; R2_w=fp0 R10=fp0 1: (7a) *(u64 *)(r2 -40) = -44 ; R2_w=fp0 fp-40_w=4294967252 2: (79) r0 = *(u64 *)(r2 -40) ; R0_w=4294967252 R2_w=fp0 fp-40_w=4294967252 3: (c5) if r0 s< 0xa goto pc+2 mark_precise: frame0: last_idx 3 first_idx 0 subseq_idx -1 mark_precise: frame0: regs=r0 stack= before 2: (79) r0 = *(u64 *)(r2 -40) 3: R0_w=4294967252 4: (b7) r0 = 1 ; R0_w=1 5: (95) exit verification time 7971 usec stack depth 40 processed 6 insns (limit 1000000) max_states_per_insn 0 total_states 0 peak_states 0 mark_read 0 So remove the incorrect cast, since imm field is declared as s32, and __mark_reg_known() takes u64, so imm would be correctly sign extended by compiler. Signed-off-by: Hao Sun Acked-by: Shung-Hsi Yu --- kernel/bpf/verifier.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 857d76694517..44af69ce1301 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -4674,7 +4674,7 @@ static int check_stack_write_fixed_off(struct bpf_verifier_env *env, insn->imm != 0 && env->bpf_capable) { struct bpf_reg_state fake_reg = {}; - __mark_reg_known(&fake_reg, (u32)insn->imm); + __mark_reg_known(&fake_reg, insn->imm); fake_reg.type = SCALAR_VALUE; save_register_state(state, spi, &fake_reg, size); } else if (reg && is_spillable_regtype(reg->type)) { From patchwork Thu Oct 26 15:13:11 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Hao Sun X-Patchwork-Id: 13437662 X-Patchwork-Delegate: bpf@iogearbox.net Received: from lindbergh.monkeyblade.net (lindbergh.monkeyblade.net [23.128.96.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E9BBB2F513 for ; Thu, 26 Oct 2023 15:13:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="Cy8hC7+T" Received: from mail-lj1-x22f.google.com (mail-lj1-x22f.google.com [IPv6:2a00:1450:4864:20::22f]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7D8371B9; Thu, 26 Oct 2023 08:13:57 -0700 (PDT) Received: by mail-lj1-x22f.google.com with SMTP id 38308e7fff4ca-2c5087d19a6so14539901fa.0; Thu, 26 Oct 2023 08:13:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1698333236; x=1698938036; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to; bh=yHuPB109KsQAxIHXMrlfX3Zfn2UV329R/EJ5GBjTAOI=; b=Cy8hC7+TALUUT3KXxaYSplrrcAgNiwrFMu/TiwtDYuH2M2Flw2ekcvg0/64V5CMYB9 3SRLi5yePPJ1GuySwiEtTPVnESdcMFVg78gXUjCkY+0ZwjsmRWvW2YtbVNa7qxG7dOBV BE9qDGHkReBgzpoa3W2LhySZgA9SfzOKXhuPrqEfBU8+fJh3GAWvmvV8Bzwo0d7DKjpZ QP/DystILj2licmM0GZXsLEoTQlMjdB831DmvQQd+aKbvLkMmpTNU/sIL5zs2geyDEuV hC9z08wt4v1uopi2oPFUL6RDSqNKl0sDJD4j99JzBjyQD8BmHVosPlRnl2sJd7OsC1OK zVvA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1698333236; x=1698938036; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :mime-version:subject:date:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=yHuPB109KsQAxIHXMrlfX3Zfn2UV329R/EJ5GBjTAOI=; b=f8ZD9Sip1ibjoefOv67E11b/wy5yK8BAXUww4PFXSvdKKGH53UdZtaIcQhCPoFyAXM wtBJobqT1HKjkLtZ23i4OkcTMKs3ZL+ClB23L9hvs7RCUBG1CuyK4o14m7l8yyjMg0Or sFtCZFrmIJ9ZT79WzJ1i3iXCE0U8VXkY06pNf/qH9M6b8Pl8j5/hlibBLTnHPE15ayDm CXYEBOOos9aTLyJTikehQvGB7JxqRQlZRpnOQXos/BeNapH6qCPy1IkGa+Lq6N1DsPKU 0sVblIY8DpRSA9oEFeVzYmZFOxRjw3wFo7HhH3/W8n62oZkgImORpOvMthRLTPTcjgsG u8jA== X-Gm-Message-State: AOJu0YzsQEmrvjs6FAUVP1QITNQksIRx+K3jiGpq1nkAp961+m5JV3K5 hmOO+70MDESk9+MtNc8z3g== X-Google-Smtp-Source: AGHT+IH4Mh22AEQcJ5JDt2JT5H+m//0MlhILIuAKfIAb/KoajFDvbcVaxKB8RtSKm4w1ouyByEk7XQ== X-Received: by 2002:a2e:a272:0:b0:2c5:1fae:e61f with SMTP id k18-20020a2ea272000000b002c51faee61fmr12511734ljm.6.1698333235292; Thu, 26 Oct 2023 08:13:55 -0700 (PDT) Received: from amdsuplus2.inf.ethz.ch (amdsuplus2.inf.ethz.ch. [129.132.31.88]) by smtp.gmail.com with ESMTPSA id p12-20020a05600c468c00b0040472ad9a3dsm2843778wmo.14.2023.10.26.08.13.54 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 26 Oct 2023 08:13:54 -0700 (PDT) From: Hao Sun Date: Thu, 26 Oct 2023 17:13:11 +0200 Subject: [PATCH bpf-next 2/2] selftests/bpf: Add test for immediate spilled to stack Precedence: bulk X-Mailing-List: bpf@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Message-Id: <20231026-fix-check-stack-write-v1-2-6b325ef3ce7e@gmail.com> References: <20231026-fix-check-stack-write-v1-0-6b325ef3ce7e@gmail.com> In-Reply-To: <20231026-fix-check-stack-write-v1-0-6b325ef3ce7e@gmail.com> To: Alexei Starovoitov , Daniel Borkmann , John Fastabend , Andrii Nakryiko , Martin KaFai Lau , Song Liu , Yonghong Song , KP Singh , Stanislav Fomichev , Hao Luo , Jiri Olsa , Mykola Lysenko , Shuah Khan , Eduard Zingerman Cc: bpf@vger.kernel.org, linux-kernel@vger.kernel.org, linux-kselftest@vger.kernel.org, Hao Sun X-Mailer: b4 0.12.3 X-Developer-Signature: v=1; a=ed25519-sha256; t=1698333232; l=1562; i=sunhao.th@gmail.com; s=20231009; h=from:subject:message-id; bh=RsQQJC1kz5RaWMBIQa3UXHDscXwUBIZwC2LrZY94Ug8=; b=Cvvesh2nQ17Rb2nhCZUvaYo8gXO2laztddD1Yrx8dDI21vELJmTTZ/eHfDCttK8NBuKFv4+KE /Djj1ND8DX+BgA1wlIutZAHkaCQph8CDzrivel2ApK+E+UNAetg1exX X-Developer-Key: i=sunhao.th@gmail.com; a=ed25519; pk=AHFxrImGtyqXOuw4f5xTNh4PGReb7hzD86ayyTZCXd4= X-Patchwork-Delegate: bpf@iogearbox.net Add a test to check if the verifier correctly reason about the sign of an immediate spilled to stack by BPF_ST instruction. Signed-off-by: Hao Sun --- tools/testing/selftests/bpf/verifier/bpf_st_mem.c | 32 +++++++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/tools/testing/selftests/bpf/verifier/bpf_st_mem.c b/tools/testing/selftests/bpf/verifier/bpf_st_mem.c index 3af2501082b2..0ba23807c46c 100644 --- a/tools/testing/selftests/bpf/verifier/bpf_st_mem.c +++ b/tools/testing/selftests/bpf/verifier/bpf_st_mem.c @@ -65,3 +65,35 @@ .expected_attach_type = BPF_SK_LOOKUP, .runs = -1, }, +{ + "BPF_ST_MEM stack imm sign", + /* Check if verifier correctly reasons about sign of an + * immediate spilled to stack by BPF_ST instruction. + * + * fp[-8] = -44; + * r0 = fp[-8]; + * if r0 s< 0 goto ret0; + * r0 = -1; + * exit; + * ret0: + * r0 = 0; + * exit; + */ + .insns = { + BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, -44), + BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8), + BPF_JMP_IMM(BPF_JSLT, BPF_REG_0, 0, 2), + BPF_MOV64_IMM(BPF_REG_0, -1), + BPF_EXIT_INSN(), + BPF_MOV64_IMM(BPF_REG_0, 0), + BPF_EXIT_INSN(), + }, + /* Use prog type that requires return value in range [0, 1] */ + .prog_type = BPF_PROG_TYPE_SK_LOOKUP, + .expected_attach_type = BPF_SK_LOOKUP, + .result = VERBOSE_ACCEPT, + .runs = -1, + .errstr = "0: (7a) *(u64 *)(r10 -8) = -44 ; R10=fp0 fp-8_w=-44\ + 2: (c5) if r0 s< 0x0 goto pc+2\ + 2: R0_w=-44", +},