From patchwork Tue Feb 4 17:25:16 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daniel Xu X-Patchwork-Id: 13959469 X-Patchwork-Delegate: bpf@iogearbox.net Received: from fout-b2-smtp.messagingengine.com (fout-b2-smtp.messagingengine.com [202.12.124.145]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 201C4216388; Tue, 4 Feb 2025 17:25:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=202.12.124.145 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1738689937; cv=none; b=HcaSoBwNo/0K6L9UO54TPHFIrINkaIFJjrw3Fi41rZ7NxPnp2+NUAceamJd2Rh2H96LFg0vu+UQNcwNHPiQ6AimO+i2fYAFAO7XUuilVhYLpbeQKKp8opbzqiWRhsQRpU/nHJkhBnQRw9YIr8vVM3RCLkQPHk9hiUFE0MqGkeio= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1738689937; c=relaxed/simple; bh=fkorpfq7ogkH+USPPjZwehE3z1eFl8rgMYo3zRE4iPw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=fB5Yv93wyXOTXpMQe3Eo0aGMuROnxeQYle7lKgpJ6d2HX5DrOpkHG8OMhe5EDZoGE5GIjJgmqZoMJh8ca9cWWhsXGiUTr+uohTUzVe2DO7Hm8hyu5TWY/VMv9+T47DbJ2TYKas/Kt+MVcgSObilK6TxQ7AutuksrhoqqCDS8wtU= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=dxuuu.xyz; spf=pass smtp.mailfrom=dxuuu.xyz; dkim=pass (2048-bit key) header.d=dxuuu.xyz header.i=@dxuuu.xyz header.b=h9TOdYaT; dkim=pass (2048-bit key) header.d=messagingengine.com header.i=@messagingengine.com header.b=MSpIgVNa; arc=none smtp.client-ip=202.12.124.145 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=dxuuu.xyz Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=dxuuu.xyz Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=dxuuu.xyz header.i=@dxuuu.xyz header.b="h9TOdYaT"; dkim=pass (2048-bit key) header.d=messagingengine.com header.i=@messagingengine.com header.b="MSpIgVNa" Received: from phl-compute-03.internal (phl-compute-03.phl.internal [10.202.2.43]) by mailfout.stl.internal (Postfix) with ESMTP id B4CAA1140155; Tue, 4 Feb 2025 12:25:34 -0500 (EST) Received: from phl-mailfrontend-01 ([10.202.2.162]) by phl-compute-03.internal (MEProxy); Tue, 04 Feb 2025 12:25:35 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=dxuuu.xyz; h=cc :cc:content-transfer-encoding:content-type:date:date:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:subject:subject:to:to; s=fm2; t=1738689934; x= 1738776334; bh=SnkG2cleegJaAFaNJQr1m4VJsyoefsv0oxQcSMvwE90=; b=h 9TOdYaTeYxw+UGiKZL4WGNFg338kZWhvtVmU+dxOw9LaH7/Nv+8pvuh9T+Fllrau yiLJ8dyvz9G8XSZGM2f/j5Am1NzHovKjZn06ZsY9ypzniFohKjCfhpdl0Wwx/qr3 lZPjBvem4S0DWS3sbI84noduwwaWrzLe0M5NWDRa94PD7L0Hihd2ipbtCvuYQ9m9 NpKWI1M4yCcCW88FnZhtr4Wl8LT8vdeS9HPUZTGWLjnzHh8tv5jnYWm17/CKgka9 D7vgAmZWbRNiR9P+A9RJoDY4yxLlCwMSrVzpbWZSVAM88hx2vlOJVieK86dyLEab U8CtQ7WdSiLmHJt/0bLJg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:date:date:feedback-id:feedback-id:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:subject:subject:to:to:x-me-proxy:x-me-sender :x-me-sender:x-sasl-enc; s=fm3; t=1738689934; x=1738776334; bh=S nkG2cleegJaAFaNJQr1m4VJsyoefsv0oxQcSMvwE90=; b=MSpIgVNagVnqLL0G/ s5xTi5/0civ8tU+th07DNKZXjv3vwmaYt2GPaX0lLvjP0p7GoCbeIQevXyQUfrnT ZLKey+O7pQuat4GcFFHLo9SJmGqJqt73JBRvSKqi0l/EjECxKY6etrI7Noc5vUKc Bpvq3c49EMBuzUyj2txJhyxKxjM2l08WQD7e1Pc14uIbnJ8/0AGd5wGvHQtjn4BL 9z3ehwWTsV/Dh+LAM4Fm56O/fBgK5ZrpGSs6qqchwGv4iGN9viYv1kaNIwEzq/yJ Osj6+75q4Osq3p0Htu8NGhCzCTbVmD0g7WC9omSe3gbiifp8c8gmAXfZENUfKjcT aFEcA== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeefvddrtddtgddvudduudcutefuodetggdotefrod ftvfcurfhrohhfihhlvgemucfhrghsthforghilhdpggftfghnshhusghstghrihgsvgdp uffrtefokffrpgfnqfghnecuuegrihhlohhuthemuceftddtnecufghrlhcuvffnffculd ejtddmnecujfgurhephffvvefufffkofgjfhgggfestdekredtredttdenucfhrhhomhep ffgrnhhivghlucgiuhcuoegugihusegugihuuhhurdighiiiqeenucggtffrrghtthgvrh hnpefgfefggeejhfduieekvdeuteffleeifeeuvdfhheejleejjeekgfffgefhtddtteen ucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmhepmhgrihhlfhhrohhmpegugihuse gugihuuhhurdighiiipdhnsggprhgtphhtthhopeduiedpmhhouggvpehsmhhtphhouhht pdhrtghpthhtoheprghstheskhgvrhhnvghlrdhorhhgpdhrtghpthhtohepuggrnhhivg hlsehiohhgvggrrhgsohigrdhnvghtpdhrtghpthhtoheprghnughrihhisehkvghrnhgv lhdrohhrghdprhgtphhtthhopehjohhhnhdrfhgrshhtrggsvghnugesghhmrghilhdrtg homhdprhgtphhtthhopehmrghrthhinhdrlhgruheslhhinhhugidruggvvhdprhgtphht thhopegvugguhiiikeejsehgmhgrihhlrdgtohhmpdhrtghpthhtohepshhonhhgsehkvg hrnhgvlhdrohhrghdprhgtphhtthhopeihohhnghhhohhnghdrshhonhhgsehlihhnuhig rdguvghvpdhrtghpthhtohepkhhpshhinhhghheskhgvrhhnvghlrdhorhhg X-ME-Proxy: Feedback-ID: i6a694271:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Tue, 4 Feb 2025 12:25:31 -0500 (EST) From: Daniel Xu To: ast@kernel.org, daniel@iogearbox.net, andrii@kernel.org Cc: john.fastabend@gmail.com, martin.lau@linux.dev, eddyz87@gmail.com, song@kernel.org, yonghong.song@linux.dev, kpsingh@kernel.org, sdf@fomichev.me, haoluo@google.com, jolsa@kernel.org, bpf@vger.kernel.org, linux-kernel@vger.kernel.org, mhartmay@linux.ibm.com, iii@linux.ibm.com Subject: [PATCH bpf-next v2 1/3] bpf: verifier: Do not extract constant map keys for irrelevant maps Date: Tue, 4 Feb 2025 10:25:16 -0700 Message-ID: X-Mailer: git-send-email 2.47.1 In-Reply-To: References: Precedence: bulk X-Mailing-List: bpf@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: bpf@iogearbox.net Previously, we were trying to extract constant map keys for all bpf_map_lookup_elem(), regardless of map type. This is an issue if the map has a u64 key and the value is very high, as it can be interpreted as a negative signed value. This in turn is treated as an error value by check_func_arg() which causes a valid program to be incorrectly rejected. Fix by only extracting constant map keys for relevant maps. This fix works because nullness elision is only allowed for {PERCPU_}ARRAY maps, and keys for these are within u32 range. See next commit for an example via selftest. Acked-by: Eduard Zingerman Reported-by: Marc Hartmayer Reported-by: Ilya Leoshkevich Tested-by: Marc Hartmayer Signed-off-by: Daniel Xu --- kernel/bpf/verifier.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 9971c03adfd5..e9176a5ce215 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -9206,6 +9206,8 @@ static s64 get_constant_map_key(struct bpf_verifier_env *env, return reg->var_off.value; } +static bool can_elide_value_nullness(enum bpf_map_type type); + static int check_func_arg(struct bpf_verifier_env *env, u32 arg, struct bpf_call_arg_meta *meta, const struct bpf_func_proto *fn, @@ -9354,9 +9356,11 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg, err = check_helper_mem_access(env, regno, key_size, BPF_READ, false, NULL); if (err) return err; - meta->const_map_key = get_constant_map_key(env, reg, key_size); - if (meta->const_map_key < 0 && meta->const_map_key != -EOPNOTSUPP) - return meta->const_map_key; + if (can_elide_value_nullness(meta->map_ptr->map_type)) { + meta->const_map_key = get_constant_map_key(env, reg, key_size); + if (meta->const_map_key < 0 && meta->const_map_key != -EOPNOTSUPP) + return meta->const_map_key; + } break; case ARG_PTR_TO_MAP_VALUE: if (type_may_be_null(arg_type) && register_is_null(reg)) From patchwork Tue Feb 4 17:25:17 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daniel Xu X-Patchwork-Id: 13959470 X-Patchwork-Delegate: bpf@iogearbox.net Received: from fout-b2-smtp.messagingengine.com (fout-b2-smtp.messagingengine.com [202.12.124.145]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1785F2165E0; Tue, 4 Feb 2025 17:25:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=202.12.124.145 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1738689940; cv=none; b=LUJqjwJwaZ3Ij1W8soLZ0eqYhC60VVlrdwwbMXyCbK7mF3lQ7PTohOTiWrIgfa3buD0f8a61isAz+iaw6Wzy21NiRKTCHI323qO1jNO05LEh1VzGtrnYz6nK92SK+mFyAdVYM7C+Shoeraqexi0LwDMDkf0UZ8OZ5bBKo0QftVc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1738689940; c=relaxed/simple; bh=CzxAEaYt6mG5yPMY3c3Gj/X69fVWF6dOOyrT3bPOnIs=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Lz9fxC2dgnj/p4UXboaL6zLn1V1l7Y5FOtZE1MetcDRRztegEI+9g4qMKmZlg0FWsSglV9YX1mlOauOkwWGGq0BmE50fgfVM3CVJScYdM8HL5OjL/0Q3Q0GIbC0WTP4d0PiVjwiwit6oORezowRplZP/0Agw6oorMIG4I0LW6CA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=dxuuu.xyz; spf=pass smtp.mailfrom=dxuuu.xyz; dkim=pass (2048-bit key) header.d=dxuuu.xyz header.i=@dxuuu.xyz header.b=lWyWPAI3; dkim=pass (2048-bit key) header.d=messagingengine.com header.i=@messagingengine.com header.b=qZmFvuD8; arc=none smtp.client-ip=202.12.124.145 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=dxuuu.xyz Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=dxuuu.xyz Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=dxuuu.xyz header.i=@dxuuu.xyz header.b="lWyWPAI3"; dkim=pass (2048-bit key) header.d=messagingengine.com header.i=@messagingengine.com header.b="qZmFvuD8" Received: from phl-compute-09.internal (phl-compute-09.phl.internal [10.202.2.49]) by mailfout.stl.internal (Postfix) with ESMTP id BA556114012B; Tue, 4 Feb 2025 12:25:37 -0500 (EST) Received: from phl-mailfrontend-01 ([10.202.2.162]) by phl-compute-09.internal (MEProxy); Tue, 04 Feb 2025 12:25:38 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=dxuuu.xyz; h=cc :cc:content-transfer-encoding:content-type:date:date:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:subject:subject:to:to; s=fm2; t=1738689937; x= 1738776337; bh=TyZS0TcTPTckG42Nn/xQx55PAyOgJZDdGtzlzOuPYpU=; b=l WyWPAI3gydqF0IWoNBUQSmKvjvGlFEkxfakrLzkRrhftlpCkT5i9oIqNL7fMF71/ ZkVzFqc55XneVzsvsPLsMZV/6P8TF+64fXdTIfWg8B5XYONAJ9Bm4cSUREDXB3RI eUH6+7u+S4zu8STU9AG3J/9iL6sXzmNouH7MGonP9BdfAt2LLK0BHYef+okh/+uA Q8Gjl1x292xZJpRXcRJRrH+eQqKRX/FMhDiVfIL0nmIttRSrz53KhZMgvpjTWGN3 n1w8V6Qk76CCMkNMmAIJ+2TEijyUgbg7TNlSNlBDU4kKWZpnyYXoAOOr2FTVEBub WprGZXqiHU7W6MKuAyIRA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:date:date:feedback-id:feedback-id:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:subject:subject:to:to:x-me-proxy:x-me-sender :x-me-sender:x-sasl-enc; s=fm3; t=1738689937; x=1738776337; bh=T yZS0TcTPTckG42Nn/xQx55PAyOgJZDdGtzlzOuPYpU=; b=qZmFvuD8NZB4Mv7Bh 9+v4AeBsGMBSVoLFefHZdFyCh7sFwxQ85mseeZah+PjIRgiPorjq3RsIMVuXGPQI UTZOJSpPe2Y60zAiAXbPUIjjZpzynPbyy7qww+a1/ruUH0l1UvNLbpjIp6tkxdz2 SC00GgvLBCRQzATT/AM5LjEC7QvvG+JgG3bJoMJhHjoBcWWxfZbpP/CuWEHiHYbk UgPgPfqnX4Ot7S0APMU/syGb+/Fw2sFyrX5aLsGjVC6vJJgH+HYt9U/ccNoKazrX 584FIItJC01zQHxM3fxzRTC/C3K+e5ttTP1RVv3nRFH8c4NCtgXWIPc1BIaL4yQL 9Mygg== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeefvddrtddtgddvudduvdcutefuodetggdotefrod ftvfcurfhrohhfihhlvgemucfhrghsthforghilhdpggftfghnshhusghstghrihgsvgdp uffrtefokffrpgfnqfghnecuuegrihhlohhuthemuceftddtnecufghrlhcuvffnffculd ejtddmnecujfgurhephffvvefufffkofgjfhgggfestdekredtredttdenucfhrhhomhep ffgrnhhivghlucgiuhcuoegugihusegugihuuhhurdighiiiqeenucggtffrrghtthgvrh hnpefgfefggeejhfduieekvdeuteffleeifeeuvdfhheejleejjeekgfffgefhtddtteen ucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmhepmhgrihhlfhhrohhmpegugihuse gugihuuhhurdighiiipdhnsggprhgtphhtthhopeduledpmhhouggvpehsmhhtphhouhht pdhrtghpthhtohepvgguugihiiekjeesghhmrghilhdrtghomhdprhgtphhtthhopegrsh htsehkvghrnhgvlhdrohhrghdprhgtphhtthhopegurghnihgvlhesihhoghgvrghrsgho gidrnhgvthdprhgtphhtthhopegrnhgurhhiiheskhgvrhhnvghlrdhorhhgpdhrtghpth htohepshhhuhgrhheskhgvrhhnvghlrdhorhhgpdhrtghpthhtohepmhgrrhhtihhnrdhl rghusehlihhnuhigrdguvghvpdhrtghpthhtohepshhonhhgsehkvghrnhgvlhdrohhrgh dprhgtphhtthhopeihohhnghhhohhnghdrshhonhhgsehlihhnuhigrdguvghvpdhrtghp thhtohepjhhohhhnrdhfrghsthgrsggvnhgusehgmhgrihhlrdgtohhm X-ME-Proxy: Feedback-ID: i6a694271:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Tue, 4 Feb 2025 12:25:35 -0500 (EST) From: Daniel Xu To: eddyz87@gmail.com, ast@kernel.org, daniel@iogearbox.net, andrii@kernel.org, shuah@kernel.org Cc: martin.lau@linux.dev, song@kernel.org, yonghong.song@linux.dev, john.fastabend@gmail.com, kpsingh@kernel.org, sdf@fomichev.me, haoluo@google.com, jolsa@kernel.org, mykolal@fb.com, bpf@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org, mhartmay@linux.ibm.com, iii@linux.ibm.com Subject: [PATCH bpf-next v2 2/3] bpf: selftests: Test constant key extraction on irrelevant maps Date: Tue, 4 Feb 2025 10:25:17 -0700 Message-ID: X-Mailer: git-send-email 2.47.1 In-Reply-To: References: Precedence: bulk X-Mailing-List: bpf@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: bpf@iogearbox.net Test that very high constant map keys are not interpreted as an error value by the verifier. This would previously fail. Acked-by: Eduard Zingerman Signed-off-by: Daniel Xu --- .../selftests/bpf/progs/verifier_array_access.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/tools/testing/selftests/bpf/progs/verifier_array_access.c b/tools/testing/selftests/bpf/progs/verifier_array_access.c index 29eb9568633f..0a187ff725cc 100644 --- a/tools/testing/selftests/bpf/progs/verifier_array_access.c +++ b/tools/testing/selftests/bpf/progs/verifier_array_access.c @@ -713,4 +713,19 @@ unsigned int non_stack_key_lookup(void) return val->index; } +SEC("socket") +__description("doesn't reject UINT64_MAX as s64 for irrelevant maps") +__success __retval(42) +unsigned int doesnt_reject_irrelevant_maps(void) +{ + __u64 key = 0xFFFFFFFFFFFFFFFF; + struct test_val *val; + + val = bpf_map_lookup_elem(&map_hash_48b, &key); + if (val) + return val->index; + + return 42; +} + char _license[] SEC("license") = "GPL"; From patchwork Tue Feb 4 17:25:18 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daniel Xu X-Patchwork-Id: 13959471 X-Patchwork-Delegate: bpf@iogearbox.net Received: from fout-b2-smtp.messagingengine.com (fout-b2-smtp.messagingengine.com [202.12.124.145]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F1A47215F78; Tue, 4 Feb 2025 17:25:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=202.12.124.145 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1738689943; cv=none; b=P+ZvivVO8MK9FYwpn83AVRzRiMstmMzcMB9ch+eWBQxJUbM0xYCZbewKlFBzSBgNG/eE/Sz3djrxSrwYk3jn7uoh2INT08ukTuYDpX6Xsinypam3UK11g5hUobzvIFzoSnsU7P3S4xhEHQpezDIm1W8TMqUbT8eGK/8l+C9R+E0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1738689943; c=relaxed/simple; bh=X2iZc74g9FmBqjjBOp1gwKw93ZIjLPNar98x36QmGbA=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=e/uewrD/wnNZNssivJQFgUzrqZeYcpAg4g+NlIZiHgLGe8K3HHZVaF8kShgzfvlhLs7lCdfA59I2HQzlPVRXRdyxGm08Fb1t+xWdHrPrpmnHQKwSEpE29U7ZP4lFUcqR1kA16jgJ2op2MUL5ZMM900jhwB5lMcgX5AG1ufjsSMQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=dxuuu.xyz; spf=pass smtp.mailfrom=dxuuu.xyz; dkim=pass (2048-bit key) header.d=dxuuu.xyz header.i=@dxuuu.xyz header.b=UVL76gCq; dkim=pass (2048-bit key) header.d=messagingengine.com header.i=@messagingengine.com header.b=STgqa6v8; arc=none smtp.client-ip=202.12.124.145 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=dxuuu.xyz Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=dxuuu.xyz Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=dxuuu.xyz header.i=@dxuuu.xyz header.b="UVL76gCq"; dkim=pass (2048-bit key) header.d=messagingengine.com header.i=@messagingengine.com header.b="STgqa6v8" Received: from phl-compute-05.internal (phl-compute-05.phl.internal [10.202.2.45]) by mailfout.stl.internal (Postfix) with ESMTP id A1CD81140114; Tue, 4 Feb 2025 12:25:40 -0500 (EST) Received: from phl-mailfrontend-01 ([10.202.2.162]) by phl-compute-05.internal (MEProxy); Tue, 04 Feb 2025 12:25:41 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=dxuuu.xyz; h=cc :cc:content-transfer-encoding:content-type:date:date:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:subject:subject:to:to; s=fm2; t=1738689940; x= 1738776340; bh=n1ahgXxw2VuMgbeYCU9uLtfD9o0+1n2rzoTvatTJ2gE=; b=U VL76gCqzL8Vic2HIpvRZHy8efN2Hmuck/PCUw6kECmaR7FF/kVN9yH2mXW4F3maZ JMXiAt+u2Sxq1shzTAAHzbzPQqElOSxBgYLh3bRIpf8q+XrDgzE6meRcJlvCrAwk oMA1va9leKJWkTqQvf1oJhJLwKEumejx07XH8jqwt/tbqlO8mavxiUrwqRos0OzE t4Cwjwqd19ibdy0/O5f/Hh6hX4a5msQ6X1mzXPrX4J+nB0s3kGjgl3YhfAftrZP6 mtSbYGTK7fdd1f8eqdwYB4jkKAQ7vjPSLkFJWRpL1X1jw94ks07h2ORJQYqKR63O EPMecpRgau41h3Otf4sXw== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:date:date:feedback-id:feedback-id:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:subject:subject:to:to:x-me-proxy:x-me-sender :x-me-sender:x-sasl-enc; s=fm3; t=1738689940; x=1738776340; bh=n 1ahgXxw2VuMgbeYCU9uLtfD9o0+1n2rzoTvatTJ2gE=; b=STgqa6v8okm11kn5H CzKKsuTx9llnMJRrMCTwt3P0BDt4K+gN4DS/qL9w3bc91xRokKwBq+TRroas/G3o IpmJkvoYlU96IKbUDaSgyaUVYaXrJ9JM0pOxP9jGj25GupQXvXJtrZqLcGeXOFf7 i1uucpzB+9WSPdbVJT2Lg3eIkh5OQ1toAOv14hbAvRuP303ehG32DBLWpl6aN5Vb z9pWi81mkTbMOytT123unbgSurfuq0M9RaUCaue6A+WrWi6s3qa+bvQxvOAEJcv/ asDzF9KctEoj4tENnysuDYYnkN39Y/aFdbaHZUUjmV8Y2MgB11MGolJl5Nw9Ui8j 7wGiA== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgeefvddrtddtgddvudduudcutefuodetggdotefrod ftvfcurfhrohhfihhlvgemucfhrghsthforghilhdpggftfghnshhusghstghrihgsvgdp uffrtefokffrpgfnqfghnecuuegrihhlohhuthemuceftddtnecufghrlhcuvffnffculd ejtddmnecujfgurhephffvvefufffkofgjfhgggfestdekredtredttdenucfhrhhomhep ffgrnhhivghlucgiuhcuoegugihusegugihuuhhurdighiiiqeenucggtffrrghtthgvrh hnpefgfefggeejhfduieekvdeuteffleeifeeuvdfhheejleejjeekgfffgefhtddtteen ucevlhhushhtvghrufhiiigvpedtnecurfgrrhgrmhepmhgrihhlfhhrohhmpegugihuse gugihuuhhurdighiiipdhnsggprhgtphhtthhopeduiedpmhhouggvpehsmhhtphhouhht pdhrtghpthhtoheprghstheskhgvrhhnvghlrdhorhhgpdhrtghpthhtohepuggrnhhivg hlsehiohhgvggrrhgsohigrdhnvghtpdhrtghpthhtoheprghnughrihhisehkvghrnhgv lhdrohhrghdprhgtphhtthhopehjohhhnhdrfhgrshhtrggsvghnugesghhmrghilhdrtg homhdprhgtphhtthhopehmrghrthhinhdrlhgruheslhhinhhugidruggvvhdprhgtphht thhopegvugguhiiikeejsehgmhgrihhlrdgtohhmpdhrtghpthhtohepshhonhhgsehkvg hrnhgvlhdrohhrghdprhgtphhtthhopeihohhnghhhohhnghdrshhonhhgsehlihhnuhig rdguvghvpdhrtghpthhtohepkhhpshhinhhghheskhgvrhhnvghlrdhorhhg X-ME-Proxy: Feedback-ID: i6a694271:Fastmail Received: by mail.messagingengine.com (Postfix) with ESMTPA; Tue, 4 Feb 2025 12:25:38 -0500 (EST) From: Daniel Xu To: ast@kernel.org, daniel@iogearbox.net, andrii@kernel.org Cc: john.fastabend@gmail.com, martin.lau@linux.dev, eddyz87@gmail.com, song@kernel.org, yonghong.song@linux.dev, kpsingh@kernel.org, sdf@fomichev.me, haoluo@google.com, jolsa@kernel.org, bpf@vger.kernel.org, linux-kernel@vger.kernel.org, mhartmay@linux.ibm.com, iii@linux.ibm.com Subject: [PATCH bpf-next v2 3/3] bpf: verifier: Disambiguate get_constant_map_key() errors Date: Tue, 4 Feb 2025 10:25:18 -0700 Message-ID: X-Mailer: git-send-email 2.47.1 In-Reply-To: References: Precedence: bulk X-Mailing-List: bpf@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Patchwork-Delegate: bpf@iogearbox.net Refactor get_constant_map_key() to disambiguate the constant key value from potential error values. In the case that the key is negative, it could be confused for an error. It's not currently an issue, as the verifier seems to track s32 spills as u32. So even if the program wrongly uses a negative value for an arraymap key, the verifier just thinks it's an impossibly high value which gets correctly discarded. Refactor anyways to make things cleaner and prevent potential future issues. Acked-by: Eduard Zingerman Signed-off-by: Daniel Xu --- kernel/bpf/verifier.c | 25 +++++++++++++++++-------- 1 file changed, 17 insertions(+), 8 deletions(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index e9176a5ce215..98354d781678 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -9149,10 +9149,11 @@ static int check_reg_const_str(struct bpf_verifier_env *env, return 0; } -/* Returns constant key value if possible, else negative error */ -static s64 get_constant_map_key(struct bpf_verifier_env *env, +/* Returns constant key value in `value` if possible, else negative error */ +static int get_constant_map_key(struct bpf_verifier_env *env, struct bpf_reg_state *key, - u32 key_size) + u32 key_size, + s64 *value) { struct bpf_func_state *state = func(env, key); struct bpf_reg_state *reg; @@ -9179,8 +9180,10 @@ static s64 get_constant_map_key(struct bpf_verifier_env *env, /* First handle precisely tracked STACK_ZERO */ for (i = off; i >= 0 && stype[i] == STACK_ZERO; i--) zero_size++; - if (zero_size >= key_size) + if (zero_size >= key_size) { + *value = 0; return 0; + } /* Check that stack contains a scalar spill of expected size */ if (!is_spilled_scalar_reg(&state->stack[spi])) @@ -9203,7 +9206,8 @@ static s64 get_constant_map_key(struct bpf_verifier_env *env, if (err < 0) return err; - return reg->var_off.value; + *value = reg->var_off.value; + return 0; } static bool can_elide_value_nullness(enum bpf_map_type type); @@ -9357,9 +9361,14 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg, if (err) return err; if (can_elide_value_nullness(meta->map_ptr->map_type)) { - meta->const_map_key = get_constant_map_key(env, reg, key_size); - if (meta->const_map_key < 0 && meta->const_map_key != -EOPNOTSUPP) - return meta->const_map_key; + err = get_constant_map_key(env, reg, key_size, &meta->const_map_key); + if (err < 0) { + meta->const_map_key = -1; + if (err == -EOPNOTSUPP) + err = 0; + else + return err; + } } break; case ARG_PTR_TO_MAP_VALUE: