From patchwork Sat Feb 1 19:58:01 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daniel Xu X-Patchwork-Id: 13956375 X-Patchwork-Delegate: bpf@iogearbox.net Received: from fout-b7-smtp.messagingengine.com (fout-b7-smtp.messagingengine.com [202.12.124.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5857F1CD210; Sat, 1 Feb 2025 19:58:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=202.12.124.150 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1738439904; cv=none; b=fOGmpnaawZGjQt0dT0/kyjFZWly501JbYH8xC+pwxvw88Fnm3LDUDq8LI0rE56MCnMaHOFthRmo5cXDzyU2dYALCOoJGAJpMXfeQ17+c4bUEe2w/ApounqlVUPv2lGmbncitxyUZBkQIwvdwbp61CB/PtIL9U/7CNZGeUynd3FU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1738439904; c=relaxed/simple; bh=Ru084ahIaNSkF4Yc8zupbLN1zIjFPNjkflNArQe5JtQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=W1cmGPXBC0H0gl3CDyPv7Sk9LncolM6d72+RDeHIJRE3kiggOEVRvsxHOLiBgDt/u0ttlECVfRnyepqVwIIc4sj9VcT3pFVMwVycfgVVd6sImk1s8Hzc5U9uUAKR0F4gbaiPNFmwadFS6EE//UlUAIfLPZFxViaTcSXz2kAnf9s= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=dxuuu.xyz; spf=pass smtp.mailfrom=dxuuu.xyz; dkim=pass (2048-bit key) header.d=dxuuu.xyz header.i=@dxuuu.xyz header.b=dTzQ546X; dkim=pass (2048-bit key) header.d=messagingengine.com header.i=@messagingengine.com header.b=bbPLc05B; arc=none smtp.client-ip=202.12.124.150 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=dxuuu.xyz Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=dxuuu.xyz Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=dxuuu.xyz header.i=@dxuuu.xyz header.b="dTzQ546X"; dkim=pass (2048-bit key) header.d=messagingengine.com header.i=@messagingengine.com header.b="bbPLc05B" Received: from phl-compute-01.internal (phl-compute-01.phl.internal [10.202.2.41]) by mailfout.stl.internal (Postfix) with ESMTP id E9D7511400F6; Sat, 1 Feb 2025 14:58:20 -0500 (EST) Received: from phl-mailfrontend-01 ([10.202.2.162]) by phl-compute-01.internal (MEProxy); Sat, 01 Feb 2025 14:58:21 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=dxuuu.xyz; h=cc :cc:content-transfer-encoding:content-type:date:date:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:subject:subject:to:to; s=fm2; t=1738439900; x= 1738526300; bh=7ztCozY8zANJNRpgiRLy/ahPatcB+YeK74Y2OUwmP5Y=; b=d TzQ546XFGA3Z+kS2lxL1GgTA6MTrtnV+vXeTDmpPFYDp9LTXz1qfS7DyIJppvTkM fE/3/7AWGBO/MxIcYvFTmRMLFmfYLiFDh+e/uVfKWyMf/Hem+PbhEtgQ1hV2hSOe re2SG9XBifJ9s2jdRFwT0dWmal8/M8Z1rmdX6JSCGtfmUjSlZ9CqCHwnvY5+JK5U KGMQ06n1Pg+LxfsqxGgCWkFaCKSZ+RG0omQz64Avm+9HsfGnS3wQRkKdxgcODUqE gOiIDLnWHnJSajd6BxZfMcoHbAh3TUYhB86DLTalPQQZQN5Ouz+7KSi95RsuHXAX QNQ2MaW6jm+D/+GGervdA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:date:date:feedback-id:feedback-id:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:subject:subject:to:to:x-me-proxy:x-me-sender :x-me-sender:x-sasl-enc; s=fm3; t=1738439900; x=1738526300; bh=7 ztCozY8zANJNRpgiRLy/ahPatcB+YeK74Y2OUwmP5Y=; b=bbPLc05B/WI/7T75p xZ9fOKgM0y9XO/8+8HDkUb7M7N9OGMSpExKeKHJMEVYeVq9MsSb4owIGUGYGqMjR d0wxkLbheN8FCFZ8sN988FwpOapt3SEMwbYbGjN/tZAjPPszbfYzwk8hAj5Z6LSQ hhzUtKjTdsp8sgPTsT7tD5tebAy0a+rukMFBWkJjuZ9z0/TPXmkv8hO4wOo9RA32 l4QKvlOYAHI/3DSJjDisVtB+koFsssIxE/dSc6Ed+LlWwiPRPZp/Hgxos5L9d8Vo htvVjmkmvjZIwNXjPMXOD0Zr6tNDU/R22ZJtIr0x7CfBIb2jMuXc0sMjS4pZ3YN3 zd0dw== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeefvddrtddtgdduvdeifecutefuodetggdotefrod ftvfcurfhrohhfihhlvgemucfhrghsthforghilhdpggftfghnshhusghstghrihgsvgdp uffrtefokffrpgfnqfghnecuuegrihhlohhuthemuceftddtnecufghrlhcuvffnffculd ejtddmnecujfgurhephffvvefufffkofgjfhgggfestdekredtredttdenucfhrhhomhep ffgrnhhivghlucgiuhcuoegugihusegugihuuhhurdighiiiqeenucggtffrrghtthgvrh hnpefgfefggeejhfduieekvdeuteffleeifeeuvdfhheejleejjeekgfffgefhtddtteen ucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmhepmhgrihhlfhhrohhmpegugihuse gugihuuhhurdighiiipdhnsggprhgtphhtthhopeduiedpmhhouggvpehsmhhtphhouhht pdhrtghpthhtohepuggrnhhivghlsehiohhgvggrrhgsohigrdhnvghtpdhrtghpthhtoh eprghnughrihhisehkvghrnhgvlhdrohhrghdprhgtphhtthhopegrshhtsehkvghrnhgv lhdrohhrghdprhgtphhtthhopehjohhhnhdrfhgrshhtrggsvghnugesghhmrghilhdrtg homhdprhgtphhtthhopehmrghrthhinhdrlhgruheslhhinhhugidruggvvhdprhgtphht thhopegvugguhiiikeejsehgmhgrihhlrdgtohhmpdhrtghpthhtohepshhonhhgsehkvg hrnhgvlhdrohhrghdprhgtphhtthhopeihohhnghhhohhnghdrshhonhhgsehlihhnuhig rdguvghvpdhrtghpthhtohepkhhpshhinhhghheskhgvrhhnvghlrdhorhhg X-ME-Proxy: Feedback-ID: i6a694271:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Sat, 1 Feb 2025 14:58:18 -0500 (EST) From: Daniel Xu To: daniel@iogearbox.net, andrii@kernel.org, ast@kernel.org Cc: john.fastabend@gmail.com, martin.lau@linux.dev, eddyz87@gmail.com, song@kernel.org, yonghong.song@linux.dev, kpsingh@kernel.org, sdf@fomichev.me, haoluo@google.com, jolsa@kernel.org, bpf@vger.kernel.org, linux-kernel@vger.kernel.org, mhartmay@linux.ibm.com, iii@linux.ibm.com Subject: [PATCH bpf-next 1/3] bpf: verifier: Do not extract constant map keys for irrelevant maps Date: Sat, 1 Feb 2025 12:58:01 -0700 Message-ID: X-Mailer: git-send-email 2.47.1 In-Reply-To: References: Precedence: bulk X-Mailing-List: bpf@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: bpf@iogearbox.net Previously, we were trying to extract constant map keys for all bpf_map_lookup_elem(), regardless of map type. This is an issue if the map has a u64 key and the value is very high, as it can be interpreted as a negative signed value. This in turn is treated as an error value by check_func_arg() which causes a valid program to be incorrectly rejected. Fix by only extracting constant map keys for relevant maps. See next commit for an example via selftest. Reported-by: Marc Hartmayer Reported-by: Ilya Leoshkevich Tested-by: Marc Hartmayer Signed-off-by: Daniel Xu Acked-by: Eduard Zingerman --- kernel/bpf/verifier.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 9971c03adfd5..e9176a5ce215 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -9206,6 +9206,8 @@ static s64 get_constant_map_key(struct bpf_verifier_env *env, return reg->var_off.value; } +static bool can_elide_value_nullness(enum bpf_map_type type); + static int check_func_arg(struct bpf_verifier_env *env, u32 arg, struct bpf_call_arg_meta *meta, const struct bpf_func_proto *fn, @@ -9354,9 +9356,11 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg, err = check_helper_mem_access(env, regno, key_size, BPF_READ, false, NULL); if (err) return err; - meta->const_map_key = get_constant_map_key(env, reg, key_size); - if (meta->const_map_key < 0 && meta->const_map_key != -EOPNOTSUPP) - return meta->const_map_key; + if (can_elide_value_nullness(meta->map_ptr->map_type)) { + meta->const_map_key = get_constant_map_key(env, reg, key_size); + if (meta->const_map_key < 0 && meta->const_map_key != -EOPNOTSUPP) + return meta->const_map_key; + } break; case ARG_PTR_TO_MAP_VALUE: if (type_may_be_null(arg_type) && register_is_null(reg)) From patchwork Sat Feb 1 19:58:02 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daniel Xu X-Patchwork-Id: 13956376 X-Patchwork-Delegate: bpf@iogearbox.net Received: from fout-b7-smtp.messagingengine.com (fout-b7-smtp.messagingengine.com [202.12.124.150]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 410341D151F; Sat, 1 Feb 2025 19:58:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=202.12.124.150 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1738439906; cv=none; b=qfJJ/ptKASSVLvSfyo6/S6OfF/Jw6snei9KfVHyll1+RC83995re3Z0SjocFlBxB/w/TWfCJSp7b2L7KUEf11lP81aGttLDrcCaoJtgCmsiPXM4jIeDu1FH0FYE6+h7LkDUzpOzQg1S1pSftwNnd0jb6bwaf44TW/+NMw32+tLg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1738439906; c=relaxed/simple; bh=M8s7IqSxHfrB7fFre1WVBbdOEA58s6gNXQoH8hf3SDk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=obJq4ztBRFhv5ox/oMHfJXKOs8pq60Ac3P6wcD7TA6KIQGKuX/S3JXg7V0AiURbs8pI0mEfdtEH+XTtONOY3GnQvwCNOcWKHhoG1CZwtM7M6mhCv/OVKl/LdpjlHzhakV3ktADKblOZqewloIRNEORjZIGvjfBSPKtN+0po3Pkc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=dxuuu.xyz; spf=pass smtp.mailfrom=dxuuu.xyz; dkim=pass (2048-bit key) header.d=dxuuu.xyz header.i=@dxuuu.xyz header.b=d6bJAWqy; dkim=pass (2048-bit key) header.d=messagingengine.com header.i=@messagingengine.com header.b=EsvQOi5I; arc=none smtp.client-ip=202.12.124.150 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=dxuuu.xyz Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=dxuuu.xyz Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=dxuuu.xyz header.i=@dxuuu.xyz header.b="d6bJAWqy"; dkim=pass (2048-bit key) header.d=messagingengine.com header.i=@messagingengine.com header.b="EsvQOi5I" Received: from phl-compute-08.internal (phl-compute-08.phl.internal [10.202.2.48]) by mailfout.stl.internal (Postfix) with ESMTP id 1D7A11140090; Sat, 1 Feb 2025 14:58:24 -0500 (EST) Received: from phl-mailfrontend-01 ([10.202.2.162]) by phl-compute-08.internal (MEProxy); Sat, 01 Feb 2025 14:58:24 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=dxuuu.xyz; h=cc :cc:content-transfer-encoding:content-type:date:date:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:subject:subject:to:to; s=fm2; t=1738439903; x= 1738526303; bh=ws5aTwt92i+jLTIShvXJrsRXjDQOQ6p0zriyk6l9RX8=; b=d 6bJAWqyu/4/5Nf/rUIqUCBL4QT/XCnETshQyIpZ3BPBGfPaEmn9/R/RGnM2f7n/R 3FFB3ppUUD/0acQloiR7V8uZSLHqYQHrMBOj4IG047y9ZNSCcLIEyV6Zq88LARU4 XeGH/2Aeao/bvQuaM63WUJHe64xPet6rXRDTs6q2LiHLEpRjQN6VYDn2fCCnHnsT 90ueCw0LRsZJrYsTf3zYY6Z7Mixn09w29BU68/G5niricowbFQeokv7uwwv/06/p 4jwaVjj9YhjcCsfnfeLkqC3G4xrlaa87ak6vK5ZAW/EEMMFQXo1tUq6ndWLWuAQE Ch80rZbjwRIDYVfgvf76g== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:date:date:feedback-id:feedback-id:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:subject:subject:to:to:x-me-proxy:x-me-sender :x-me-sender:x-sasl-enc; s=fm3; t=1738439903; x=1738526303; bh=w s5aTwt92i+jLTIShvXJrsRXjDQOQ6p0zriyk6l9RX8=; b=EsvQOi5IuhzddvvX2 WaFadPRnfG6bhGLinIZFLuPW6s1VmfGn3HegaE68lMSTXnERxszSXySNR0A86noH YiWCQ264f9wOKZ3Is5SSybVZD2YLSvphnbDhq4dcFwEcTFbBedmmPkta4tUjKiYA 18DmnwZO+QknpehvqmX+R4mmi+3/4TNksdcty781ZkeFipRQitiscuPQuHbDTNHp 7ufiAQsnBc3kN/O401RuksWBmJ/fdO2YbCtrAn8aOoo6VUfYqG1d3inWzKL+xygq xI5mm7bebvw3x+rXb5UcYIKQtjMQ6ip672AbbAhdo5TxD9TBkoLDBUHPQsWjNChG VckaQ== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeefvddrtddtgdduvdeigecutefuodetggdotefrod ftvfcurfhrohhfihhlvgemucfhrghsthforghilhdpggftfghnshhusghstghrihgsvgdp uffrtefokffrpgfnqfghnecuuegrihhlohhuthemuceftddtnecufghrlhcuvffnffculd ejtddmnecujfgurhephffvvefufffkofgjfhgggfestdekredtredttdenucfhrhhomhep ffgrnhhivghlucgiuhcuoegugihusegugihuuhhurdighiiiqeenucggtffrrghtthgvrh hnpefgfefggeejhfduieekvdeuteffleeifeeuvdfhheejleejjeekgfffgefhtddtteen ucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmhepmhgrihhlfhhrohhmpegugihuse gugihuuhhurdighiiipdhnsggprhgtphhtthhopeduledpmhhouggvpehsmhhtphhouhht pdhrtghpthhtohepuggrnhhivghlsehiohhgvggrrhgsohigrdhnvghtpdhrtghpthhtoh epvgguugihiiekjeesghhmrghilhdrtghomhdprhgtphhtthhopehshhhurghhsehkvghr nhgvlhdrohhrghdprhgtphhtthhopegrnhgurhhiiheskhgvrhhnvghlrdhorhhgpdhrtg hpthhtoheprghstheskhgvrhhnvghlrdhorhhgpdhrtghpthhtohepmhihkhholhgrlhes fhgsrdgtohhmpdhrtghpthhtohepmhgrrhhtihhnrdhlrghusehlihhnuhigrdguvghvpd hrtghpthhtohepshhonhhgsehkvghrnhgvlhdrohhrghdprhgtphhtthhopeihohhnghhh ohhnghdrshhonhhgsehlihhnuhigrdguvghv X-ME-Proxy: Feedback-ID: i6a694271:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Sat, 1 Feb 2025 14:58:21 -0500 (EST) From: Daniel Xu To: daniel@iogearbox.net, eddyz87@gmail.com, shuah@kernel.org, andrii@kernel.org, ast@kernel.org Cc: mykolal@fb.com, martin.lau@linux.dev, song@kernel.org, yonghong.song@linux.dev, john.fastabend@gmail.com, kpsingh@kernel.org, sdf@fomichev.me, haoluo@google.com, jolsa@kernel.org, bpf@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org, mhartmay@linux.ibm.com, iii@linux.ibm.com Subject: [PATCH bpf-next 2/3] bpf: selftests: Test constant key extraction on irrelevant maps Date: Sat, 1 Feb 2025 12:58:02 -0700 Message-ID: X-Mailer: git-send-email 2.47.1 In-Reply-To: References: Precedence: bulk X-Mailing-List: bpf@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: bpf@iogearbox.net Test that very high constant map keys are not interpreted as an error value by the verifier. This would previously fail. Signed-off-by: Daniel Xu Acked-by: Eduard Zingerman --- .../selftests/bpf/progs/verifier_array_access.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/tools/testing/selftests/bpf/progs/verifier_array_access.c b/tools/testing/selftests/bpf/progs/verifier_array_access.c index 29eb9568633f..0a187ff725cc 100644 --- a/tools/testing/selftests/bpf/progs/verifier_array_access.c +++ b/tools/testing/selftests/bpf/progs/verifier_array_access.c @@ -713,4 +713,19 @@ unsigned int non_stack_key_lookup(void) return val->index; } +SEC("socket") +__description("doesn't reject UINT64_MAX as s64 for irrelevant maps") +__success __retval(42) +unsigned int doesnt_reject_irrelevant_maps(void) +{ + __u64 key = 0xFFFFFFFFFFFFFFFF; + struct test_val *val; + + val = bpf_map_lookup_elem(&map_hash_48b, &key); + if (val) + return val->index; + + return 42; +} + char _license[] SEC("license") = "GPL"; From patchwork Sat Feb 1 19:58:03 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daniel Xu X-Patchwork-Id: 13956377 X-Patchwork-Delegate: bpf@iogearbox.net Received: from fhigh-b7-smtp.messagingengine.com (fhigh-b7-smtp.messagingengine.com [202.12.124.158]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 718B71CCEE9; Sat, 1 Feb 2025 19:58:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=202.12.124.158 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1738439910; cv=none; b=LV3pmrWzkBBKOi8131r/cVu21bh6vTmJRU9iXaEkHV1RHvCz8KZEjXRZFE/WNTIIJCU6x99PV6QClTAnV5t12btMexI8sUxgkNZBo4P+cbqOt/6JSNCnF8itBnLLgyQlZhZz7cVSNFlxPrW2jkAzc4YNfF3nq5RuKMebblSl09E= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1738439910; c=relaxed/simple; bh=iOpBPMg0Y80kUJFtVAQ41yIvl4tFe+qff8uOgiyoK2s=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=VoFDO4Hvk5yd+GOzaXn60vtzcl2jb+ShP65gC84uzNo6LV7okl5tad3QT+MESHqZZejbry1obp+aKNgBvQseLpQpXUxFcyUtiYHaigQ0OIc5zqMpfpexmP1KnAe58fBgP/5l0WCjjMfBTm/Fh83K6d6K7ORKvLHGizwHUzIaKGA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=dxuuu.xyz; spf=pass smtp.mailfrom=dxuuu.xyz; dkim=pass (2048-bit key) header.d=dxuuu.xyz header.i=@dxuuu.xyz header.b=u+wD2Hfp; dkim=pass (2048-bit key) header.d=messagingengine.com header.i=@messagingengine.com header.b=FbQ+XNgB; arc=none smtp.client-ip=202.12.124.158 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=dxuuu.xyz Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=dxuuu.xyz Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=dxuuu.xyz header.i=@dxuuu.xyz header.b="u+wD2Hfp"; dkim=pass (2048-bit key) header.d=messagingengine.com header.i=@messagingengine.com header.b="FbQ+XNgB" Received: from phl-compute-05.internal (phl-compute-05.phl.internal [10.202.2.45]) by mailfhigh.stl.internal (Postfix) with ESMTP id 0FB4925400E7; Sat, 1 Feb 2025 14:58:27 -0500 (EST) Received: from phl-mailfrontend-01 ([10.202.2.162]) by phl-compute-05.internal (MEProxy); Sat, 01 Feb 2025 14:58:27 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=dxuuu.xyz; h=cc :cc:content-transfer-encoding:content-type:date:date:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:subject:subject:to:to; s=fm2; t=1738439906; x= 1738526306; bh=yiGGo8fB3LwFwVag32axPX1KZztzdGS8G2RAFe7mLJ0=; b=u +wD2Hfp6eDfzb0rt19QIaqrIn2B9qOu8E5Z1QycpMNpE9KJ1sGT8sgR+Aaq8zmE5 AgqrKtRDdi+Z5qvPwtpVBHn9a1p/hzRHkrGHEd/enq/KUPLpCtts7KwVHCHECxRg IOYO88qPW3IzzcCC5PNZlx2guIX0KyuuTaGBosYb6Cp/zJMEEGGp+QO/doXEKnBm LnmiFDsQCX7M+VkdZTz10sFp1XxPckJjvGiICMwfLQORnmLNSW5yJ/BQ4q7bahwh rTRNJYUTkA3E+8dzKN3OH0VRpgV/ZT6eFBqNAflCtG1utCEQUxDFFgW+kgV4P7qD c0V368fOKecFUJYMHEbWg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:date:date:feedback-id:feedback-id:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:subject:subject:to:to:x-me-proxy:x-me-sender :x-me-sender:x-sasl-enc; s=fm3; t=1738439906; x=1738526306; bh=y iGGo8fB3LwFwVag32axPX1KZztzdGS8G2RAFe7mLJ0=; b=FbQ+XNgBxQYTiDDha fUOCQSm99d1ghx6l28cRHNjDzCXRDeE6HysE0t5KMChXxqFwEpHHU6fzM8s2UhXB t3t/rDqrNVrLzEPrydlZxx3fr6Kbd9qnB01Ub2+tgkmGNXxJYyXxG083wdnAeI8z ZuhZHxbq10+wILCQF+bXUYf86iOlOd3EG9ZqZR/6Ljdd4vt+11AeD5BtglnezeRd IQI7ANLU/HomTeJDs8VUgHviw7iizGotGvJ4KTBLWoZJ38eoaQeaERjzKPVUumOU Vr9mA2ZSOCH0enccApHS7p251S1YyDn0uClUqzzWlLE4FAuzKAPk446QhIo4IO7g GOoAw== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeefvddrtddtgdduvdeifecutefuodetggdotefrod ftvfcurfhrohhfihhlvgemucfhrghsthforghilhdpggftfghnshhusghstghrihgsvgdp uffrtefokffrpgfnqfghnecuuegrihhlohhuthemuceftddtnecufghrlhcuvffnffculd ejtddmnecujfgurhephffvvefufffkofgjfhgggfestdekredtredttdenucfhrhhomhep ffgrnhhivghlucgiuhcuoegugihusegugihuuhhurdighiiiqeenucggtffrrghtthgvrh hnpefgfefggeejhfduieekvdeuteffleeifeeuvdfhheejleejjeekgfffgefhtddtteen ucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmhepmhgrihhlfhhrohhmpegugihuse gugihuuhhurdighiiipdhnsggprhgtphhtthhopeduiedpmhhouggvpehsmhhtphhouhht pdhrtghpthhtohepuggrnhhivghlsehiohhgvggrrhgsohigrdhnvghtpdhrtghpthhtoh eprghnughrihhisehkvghrnhgvlhdrohhrghdprhgtphhtthhopegrshhtsehkvghrnhgv lhdrohhrghdprhgtphhtthhopehjohhhnhdrfhgrshhtrggsvghnugesghhmrghilhdrtg homhdprhgtphhtthhopehmrghrthhinhdrlhgruheslhhinhhugidruggvvhdprhgtphht thhopegvugguhiiikeejsehgmhgrihhlrdgtohhmpdhrtghpthhtohepshhonhhgsehkvg hrnhgvlhdrohhrghdprhgtphhtthhopeihohhnghhhohhnghdrshhonhhgsehlihhnuhig rdguvghvpdhrtghpthhtohepkhhpshhinhhghheskhgvrhhnvghlrdhorhhg X-ME-Proxy: Feedback-ID: i6a694271:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Sat, 1 Feb 2025 14:58:24 -0500 (EST) From: Daniel Xu To: daniel@iogearbox.net, andrii@kernel.org, ast@kernel.org Cc: john.fastabend@gmail.com, martin.lau@linux.dev, eddyz87@gmail.com, song@kernel.org, yonghong.song@linux.dev, kpsingh@kernel.org, sdf@fomichev.me, haoluo@google.com, jolsa@kernel.org, bpf@vger.kernel.org, linux-kernel@vger.kernel.org, mhartmay@linux.ibm.com, iii@linux.ibm.com Subject: [PATCH bpf-next 3/3] bpf: verifier: Disambiguate get_constant_map_key() errors Date: Sat, 1 Feb 2025 12:58:03 -0700 Message-ID: <91d84512b4082e5eb095b31e5536944a3d53f0eb.1738439839.git.dxu@dxuuu.xyz> X-Mailer: git-send-email 2.47.1 In-Reply-To: References: Precedence: bulk X-Mailing-List: bpf@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: bpf@iogearbox.net Refactor get_constant_map_key() to disambiguate the constant key value from potential error values. In the case that the key is negative, it could be confused for an error. It's not currently an issue, as the verifier seems to track s32 spills as u32. So even if the program wrongly uses a negative value for an arraymap key, the verifier just thinks it's an impossibly high value which gets correctly discarded. Refactor anyways to make things cleaner and prevent potential future issues. Signed-off-by: Daniel Xu Acked-by: Eduard Zingerman --- kernel/bpf/verifier.c | 25 +++++++++++++++++-------- 1 file changed, 17 insertions(+), 8 deletions(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index e9176a5ce215..98354d781678 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -9149,10 +9149,11 @@ static int check_reg_const_str(struct bpf_verifier_env *env, return 0; } -/* Returns constant key value if possible, else negative error */ -static s64 get_constant_map_key(struct bpf_verifier_env *env, +/* Returns constant key value in `value` if possible, else negative error */ +static int get_constant_map_key(struct bpf_verifier_env *env, struct bpf_reg_state *key, - u32 key_size) + u32 key_size, + s64 *value) { struct bpf_func_state *state = func(env, key); struct bpf_reg_state *reg; @@ -9179,8 +9180,10 @@ static s64 get_constant_map_key(struct bpf_verifier_env *env, /* First handle precisely tracked STACK_ZERO */ for (i = off; i >= 0 && stype[i] == STACK_ZERO; i--) zero_size++; - if (zero_size >= key_size) + if (zero_size >= key_size) { + *value = 0; return 0; + } /* Check that stack contains a scalar spill of expected size */ if (!is_spilled_scalar_reg(&state->stack[spi])) @@ -9203,7 +9206,8 @@ static s64 get_constant_map_key(struct bpf_verifier_env *env, if (err < 0) return err; - return reg->var_off.value; + *value = reg->var_off.value; + return 0; } static bool can_elide_value_nullness(enum bpf_map_type type); @@ -9357,9 +9361,14 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg, if (err) return err; if (can_elide_value_nullness(meta->map_ptr->map_type)) { - meta->const_map_key = get_constant_map_key(env, reg, key_size); - if (meta->const_map_key < 0 && meta->const_map_key != -EOPNOTSUPP) - return meta->const_map_key; + err = get_constant_map_key(env, reg, key_size, &meta->const_map_key); + if (err < 0) { + meta->const_map_key = -1; + if (err == -EOPNOTSUPP) + err = 0; + else + return err; + } } break; case ARG_PTR_TO_MAP_VALUE: