bpf: skip invalid kfunc call in backtrack_insn
PATCH 1/1 bpf: skip invalid kfunc call in backtrack_insn
The verifier skips invalid kfunc call in check_kfunc_call(), which would be captured in fixup_kfunc_call() if such insn is not eliminated by dead code elimination. However, this can lead to the following warning in backtrack_insn(), alse see [1]:
------------[ cut here ]------------ verifier backtracking bug WARNING: CPU: 6 PID: 8646 at kernel/bpf/verifier.c:2756 backtrack_insn kernel/bpf/verifier.c:2756 __mark_chain_precision kernel/bpf/verifier.c:3065 mark_chain_precision kernel/bpf/verifier.c:3165 adjust_reg_min_max_vals kernel/bpf/verifier.c:10715 check_alu_op kernel/bpf/verifier.c:10928 do_check kernel/bpf/verifier.c:13821 [inline] do_check_common kernel/bpf/verifier.c:16289
...
So make backtracking conservative with this by returning ENOTSUPP.
[1] https://lore.kernel.org/bpf/CACkBjsaXNceR8ZjkLG=dT3P=4A8SBsg0Z5h5PWLryF5=ghKq=g@mail.gmail.com/
--- kernel/bpf/verifier.c | 6 ++++++ 1 file changed, 6 insertions(+)
kernel/bpf/verifier.c +6 -0
@@ -2750,6 +2750,12 @@ static int backtrack_insn(struct bpf_verifier_env *env, int idx,*/ if (insn->src_reg ==0 &&is_callback_calling_function (insn->imm))return -ENOTSUPP ; +/* kfunc with imm==0 is invalid and fixup_kfunc_call will +* catch this error later. Make backtracking conservative +* with ENOTSUPP. +*/ +if (insn->src_reg ==BPF_PSEUDO_KFUNC_CALL && insn->imm ==0 ) +return -ENOTSUPP ;/* regular helper call sets R0 */ *reg_mask &= ~1 ;if (*reg_mask &0x3f ) {
base-commit: acd3b7768048fe338248cdf43ccfbf8c084a6bc1
Signature · 1 line
2.39.0
Quoted 15 lines · Hao Sun
The verifier skips invalid kfunc call in
check_kfunc_call(), which would be captured infixup_kfunc_call()if such insn is not eliminated by dead code elimination. However, this can lead to the following warning inbacktrack_insn(), alse see [1]:------------[ cut here ]------------ verifier backtracking bug WARNING: CPU: 6 PID: 8646 at kernel/bpf/verifier.c:2756 backtrack_insn kernel/bpf/verifier.c:2756 __mark_chain_precision kernel/bpf/verifier.c:3065 mark_chain_precision kernel/bpf/verifier.c:3165 adjust_reg_min_max_vals kernel/bpf/verifier.c:10715 check_alu_op kernel/bpf/verifier.c:10928 do_check kernel/bpf/verifier.c:13821 [inline] do_check_common kernel/bpf/verifier.c:16289
Quoted 7 lines
...
So make backtracking conservative with this by returning ENOTSUPP.
[1] https://lore.kernel.org/bpf/CACkBjsaXNceR8ZjkLG=dT3P=4A8SBsg0Z5h5PWLryF5=ghKq=g@mail.gmail.com/
Signed-off-by Hao Sun <[email protected]>
This patch was applied to bpf/bpf.git (master) by Daniel Borkmann <[email protected]>:
Hello:
This patch was applied to bpf/bpf.git (master)
by Daniel Borkmann <[email protected]>:
Quoted 15 lines · On Wed, 4 Jan 2023 09:47:09 +0800 you wrote:
The verifier skips invalid kfunc call in
check_kfunc_call(), which would be captured infixup_kfunc_call()if such insn is not eliminated by dead code elimination. However, this can lead to the following warning inbacktrack_insn(), alse see [1]:------------[ cut here ]------------ verifier backtracking bug WARNING: CPU: 6 PID: 8646 at kernel/bpf/verifier.c:2756 backtrack_insn kernel/bpf/verifier.c:2756 __mark_chain_precision kernel/bpf/verifier.c:3065 mark_chain_precision kernel/bpf/verifier.c:3165 adjust_reg_min_max_vals kernel/bpf/verifier.c:10715 check_alu_op kernel/bpf/verifier.c:10928 do_check kernel/bpf/verifier.c:13821 [inline] do_check_common kernel/bpf/verifier.c:16289
Quoted 3 lines
...
[...]
Here is the summary with links:
- bpf: skip invalid kfunc call in backtrack_insn
https://git.kernel.org/bpf/bpf/c/d3178e8a434b
You are awesome, thank you!
Signature · 2 lines
Deet-doot-dot, I am a bot. https://korg.docs.kernel.org/patchwork/pwbot.html