From patchwork Fri Jun 2 15:01:11 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Vernet X-Patchwork-Id: 102587 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a59:994d:0:b0:3d9:f83d:47d9 with SMTP id k13csp1100174vqr; Fri, 2 Jun 2023 08:13:24 -0700 (PDT) X-Google-Smtp-Source: ACHHUZ7r+IuF89YK5jq/0jThIRl2SjU/JYYneOH6RxsQD6QOENgfWQ8Vy0KvmHYsaZmFBdzlDKSh X-Received: by 2002:a17:903:491:b0:1b0:295b:f192 with SMTP id jj17-20020a170903049100b001b0295bf192mr349921plb.3.1685718804082; Fri, 02 Jun 2023 08:13:24 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1685718804; cv=none; d=google.com; s=arc-20160816; b=ks7OM1PH2EXxA99nCKQngVWZMRsRSIBZlE0q2at5lyF8iTHMqEsnKtrp/2MzmPWR18 V5M+q6iKfKTpJUCToEw8I4QJX09H9QYaXBLuQEGP57MyBea99yfU3awIXPjAnHieG7Ic DPEYHh2FLB7w7LOHsHOXVkHI2dvpn2SYChSaEeMB5RLs2BmPmHyiGvrM6MUX+Z0h88xA 2SwuPd11jFd2DM1oeWuBsY0hxh+gmlDlbg4vecVFgfKR35hS3SqlqEorUguGgXtY2pqS bJusQjsZ2z5m8TjPh3XuilWoDlly7kMs1qZiQ8nlA/xp7AGFIoNjRSVo2xTmM4hjmP+g ONuw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from; bh=8TGABugmQnE6LIWqoZGkKSicCR6YXrglbRXwLxPQ5E8=; b=pWYzToGJFBzApIU9lKMaVcw5HIXon9F5bXZx3WL1kRdhJxaC6Zrd6nepAHyd87HoeD v9PD6YbqprVmzoFgs/T90qjmL/YtGjvFNO0PapwkAOfAqnp+bDb04LS3xcI40HL0QiMl gTde4F2tooZvSiYcZoQJfnte1uDMYiGZEYUOUP4dOdCZrfkNhz/JNR8i24+b9BRJYf9d 8IOsNmcJUv2dyzGj5jNFuGgxUgHlBkOjrVif3ABR24WrVYi0y7AkAiVUtyje11Mc15oU ttZ8MKP+A5VLkyUIFd0d8P7CMx1bxjyG32s5Qy43Tlt48aE9iB0Cj8zCCl/ljMd9SDI1 rFHw== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id 18-20020a170902c25200b001adcdac8969si989858plg.463.2023.06.02.08.13.09; Fri, 02 Jun 2023 08:13:24 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232743AbjFBPCI (ORCPT + 99 others); Fri, 2 Jun 2023 11:02:08 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54236 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236317AbjFBPBe (ORCPT ); Fri, 2 Jun 2023 11:01:34 -0400 Received: from mail-qk1-f175.google.com (mail-qk1-f175.google.com [209.85.222.175]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EE0E41BF; Fri, 2 Jun 2023 08:01:32 -0700 (PDT) Received: by mail-qk1-f175.google.com with SMTP id af79cd13be357-75b1219506fso205423685a.1; Fri, 02 Jun 2023 08:01:32 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1685718092; x=1688310092; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=8TGABugmQnE6LIWqoZGkKSicCR6YXrglbRXwLxPQ5E8=; b=HKEPr3NPtuFMBir9TshfNWmjvjMejPToOvCGIdHqVNG7y+aMv3MxPKE6npVwoSQhkq O011cDGwpRRwBVLwz/qBOpHA+tcNxuQR74rEmguCJjqZAtw4X0uOSweJ1XoOzDFhqIjx 629QzXc+ZlUwJP9lFW7d5WT3XMNztZ3sSmYCn/0BvyTYwFOLiFPSVDa8zyuFeoE4qBjl de0VqcPqYhGzq4X7/x2DmA51vDubtQ/OhdC9id3YbDRvDKBN0R1kHD/M4pVt4EqAZzZx 0jq1ir6R3sBninkjoo0IZ6JKYChTD2AVXcarGCv17LeW9HWk0gSS+RN344kSz1CcFndV 5W4Q== X-Gm-Message-State: AC+VfDy9v1OpglNH0r6zFO5eV0XiNVZttwcoD0Ok/6ehbGAyMIyiMJBH mT6FTkc10odMhP15WPfmwTsBibiFRdjnhfK6 X-Received: by 2002:ad4:5aa6:0:b0:629:78ae:80f0 with SMTP id u6-20020ad45aa6000000b0062978ae80f0mr1646956qvg.8.1685718091566; Fri, 02 Jun 2023 08:01:31 -0700 (PDT) Received: from localhost ([2620:10d:c091:400::5:1317]) by smtp.gmail.com with ESMTPSA id mn14-20020a0562145ece00b006235e8fe94esm926945qvb.58.2023.06.02.08.01.21 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 02 Jun 2023 08:01:31 -0700 (PDT) From: David Vernet To: bpf@vger.kernel.org Cc: ast@kernel.org, daniel@iogearbox.net, andrii@kernel.org, martin.lau@linux.dev, song@kernel.org, yhs@fb.com, john.fastabend@gmail.com, kpsingh@kernel.org, sdf@google.com, haoluo@google.com, jolsa@kernel.org, linux-kernel@vger.kernel.org, kernel-team@meta.com Subject: [PATCH bpf-next 1/2] bpf: Teach verifier that trusted PTR_TO_BTF_ID pointers are non-NULL Date: Fri, 2 Jun 2023 10:01:11 -0500 Message-Id: <20230602150112.1494194-1-void@manifault.com> X-Mailer: git-send-email 2.40.1 MIME-Version: 1.0 X-Spam-Status: No, score=-1.4 required=5.0 tests=BAYES_00, FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM,HEADER_FROM_DIFFERENT_DOMAINS, RCVD_IN_DNSWL_NONE,RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_PASS, T_SCC_BODY_TEXT_LINE autolearn=no autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1767604281119780283?= X-GMAIL-MSGID: =?utf-8?q?1767604281119780283?= In reg_type_not_null(), we currently assume that a pointer may be NULL if it has the PTR_MAYBE_NULL modifier, or if it doesn't belong to one of several base type of pointers that are never NULL-able. For example, PTR_TO_CTX, PTR_TO_MAP_VALUE, etc. It turns out that in some cases, PTR_TO_BTF_ID can never be NULL as well, though we currently don't specify it. For example, if you had the following program: SEC("tc") long example_refcnt_fail(void *ctx) { struct bpf_cpumask *mask1, *mask2; mask1 = bpf_cpumask_create(); mask2 = bpf_cpumask_create(); if (!mask1 || !mask2) goto error_release; bpf_cpumask_test_cpu(0, (const struct cpumask *)mask1); bpf_cpumask_test_cpu(0, (const struct cpumask *)mask2); error_release: if (mask1) bpf_cpumask_release(mask1); if (mask2) bpf_cpumask_release(mask2); return ret; } The verifier will incorrectly fail to load the program, thinking (unintuitively) that we have a possibly-unreleased reference if the mask is NULL, because we (correctly) don't issue a bpf_cpumask_release() on the NULL path. The reason the verifier gets confused is due to the fact that we don't explicitly tell the verifier that trusted PTR_TO_BTF_ID pointers can never be NULL. Basically, if we successfully get past the if check (meaning both pointers go from ptr_or_null_bpf_cpumask to ptr_bpf_cpumask), the verifier will correctly assume that the references need to be dropped on any possible branch that leads to program exit. However, it will _incorrectly_ think that the ptr == NULL branch is possible, and will erroneously detect it as a branch on which we failed to drop the reference. The solution is of course to teach the verifier that trusted PTR_TO_BTF_ID pointers can never be NULL, so that it doesn't incorrectly think it's possible for the reference to be present on the ptr == NULL branch. A follow-on patch will add a selftest that verifies this behavior. Signed-off-by: David Vernet --- kernel/bpf/verifier.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 086b2a14905b..63187ba223d5 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -197,6 +197,7 @@ static int ref_set_non_owning(struct bpf_verifier_env *env, struct bpf_reg_state *reg); static void specialize_kfunc(struct bpf_verifier_env *env, u32 func_id, u16 offset, unsigned long *addr); +static bool is_trusted_reg(const struct bpf_reg_state *reg); static bool bpf_map_ptr_poisoned(const struct bpf_insn_aux_data *aux) { @@ -439,8 +440,11 @@ static bool type_may_be_null(u32 type) return type & PTR_MAYBE_NULL; } -static bool reg_type_not_null(enum bpf_reg_type type) +static bool reg_not_null(const struct bpf_reg_state *reg) { + enum bpf_reg_type type; + + type = reg->type; if (type_may_be_null(type)) return false; @@ -450,6 +454,7 @@ static bool reg_type_not_null(enum bpf_reg_type type) type == PTR_TO_MAP_VALUE || type == PTR_TO_MAP_KEY || type == PTR_TO_SOCK_COMMON || + (type == PTR_TO_BTF_ID && is_trusted_reg(reg)) || type == PTR_TO_MEM; } @@ -13157,7 +13162,7 @@ static int is_branch_taken(struct bpf_reg_state *reg, u64 val, u8 opcode, bool is_jmp32) { if (__is_pointer_value(false, reg)) { - if (!reg_type_not_null(reg->type)) + if (!reg_not_null(reg)) return -1; /* If pointer is valid tests against zero will fail so we can