From patchwork Wed Jan 4 01:47:09 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Hao Sun X-Patchwork-Id: 38723 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:4e01:0:0:0:0:0 with SMTP id p1csp4917378wrt; Tue, 3 Jan 2023 18:01:39 -0800 (PST) X-Google-Smtp-Source: AMrXdXskd8kgX8e3E2jcLTnAmrfKFroRnc8Bt+y5lpINqCWd1MJkU9ymIM68jMRJmchFTbTQjuua X-Received: by 2002:a05:6402:d4e:b0:46f:9fa5:ec14 with SMTP id ec14-20020a0564020d4e00b0046f9fa5ec14mr35136778edb.35.1672797699337; Tue, 03 Jan 2023 18:01:39 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1672797699; cv=none; d=google.com; s=arc-20160816; b=Wecsf7E4Ey/4xSA+SdT6dwcpx4u9ZCePzimF5BiWoDVMQGxcQIoe1eWjVsp5SkTGpL /jvPneyJ44W0LUftbf4IzLvwEew2teKCGAsTU3jO7TI8YiwCrSMvIz+ZrtHDo8fZFCsk 5rKA39VPGWXu6ie2TcDcVHiaGF9sEBFgU0tcue7AJX5yTtdHUusdeYAH5v28aWxQpxSJ Q/aFsULHZMr52XtkFKK8ZxKp3Fm45CP+5pwTGNRTY4yaB7LZYGbXIJupuhfCtk1lV1Oh QWzjCyeP/8FTiJz6R1M+nvkoE4uulHgBs1J1GKZbdAEB7lFLM75rmFdKvU5KawHE/6Ze rqEA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=N93YY89WDpMZjTihyV1kEiKGVsyhZqvxZRbXkfy1dBE=; b=sPXgQWybi2F8pM0CZ3O7brqWuLslBpmFWp3vkkKC4HPh3t/uofMwrNwi8D9+XwRDo0 7eG28o6j4sM9CUFZ7VZeXvNahAepPnxnADuUazW3EuCRzIA6darcC4BF7bzMP7wQvefb HtHt6xJ65mwagbLFgWQz4/NXZiuPMI6i4Abjgzb1+8PhHwkJsXi9gcnu36yyoD5jrkl3 PRs1bZBokPf1UrUT5Pyc1nBl61VU4HkrkVrXmSyfPzDSHG6+Hm/g6+pUqvr2a8yNMvt3 pzVxLcZP/0MCQi1ajCqCnIPsOw1t7/1p7fpBPm1fJorUTMSGe5GqFBfzYGy0H401HzPS h0Tw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@gmail.com header.s=20210112 header.b="c/oGnk5Y"; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id z10-20020a056402274a00b0046b392e8c56si22669585edd.10.2023.01.03.18.01.15; Tue, 03 Jan 2023 18:01:39 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@gmail.com header.s=20210112 header.b="c/oGnk5Y"; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238767AbjADBre (ORCPT + 99 others); Tue, 3 Jan 2023 20:47:34 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42932 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234226AbjADBrb (ORCPT ); Tue, 3 Jan 2023 20:47:31 -0500 Received: from mail-pl1-x62c.google.com (mail-pl1-x62c.google.com [IPv6:2607:f8b0:4864:20::62c]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B31281789B; Tue, 3 Jan 2023 17:47:30 -0800 (PST) Received: by mail-pl1-x62c.google.com with SMTP id n4so34529326plp.1; Tue, 03 Jan 2023 17:47:30 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=N93YY89WDpMZjTihyV1kEiKGVsyhZqvxZRbXkfy1dBE=; b=c/oGnk5YDdOxMv6HyaPaUUBNrHeXU9UmROddqkW2D1Vhtm77tujXWuJBLHbHotvJEt ZzhBSldYFuZO9nBMP1/QEyqXle7MKVLoXFHaXLKxFxUlBODA/OFAfSFaisDC5ZeM0ebB rN62CtXb498KrsK+R+uaO5aBix2y4SaRpg1UarZzwc72594V6OSsMpZEspG5/yuCUox8 vFBquEThPCxU0p5qYMXlTZxVSIdo7qGWyPLp+yeTVV99xvUrdY6lx7+sTybF51jcahfK w1W4CbILjdNheev4ZowVXyXqughHR9Ew4FdFH1s3rIPo75rZj7JwlRAuRH7DNDUO4ks2 9eRg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=N93YY89WDpMZjTihyV1kEiKGVsyhZqvxZRbXkfy1dBE=; b=jXhjXN2n2ehnmevxVDfCimyEAYAygI0HaDA6PLAjm8Ru2srkIuDSafb/2XbYyn8B3U ZJ94HZkgR+nvCp1g/ky25UzPlTj4n+NsKpeQMUtiWHrShqikhYRq472Bd9QUZMCTLC1F eEiKMIWASkJ7BS8zC8Gm+t/3nvH3C75g8drqATxcRHdnMDRnxgjVm9C61z7ryqpJGSfS HXae2x07zXSreHOZaK4zqNtHroO49pLfgMy6guXf/TAZT0TveczegMTA4wFdmhJMBAxs cije5JFyNKHEtsOdWUXWt2Uc/e7RObdhIUgpQzScnxM5G7krhJ8hCDVyG6LRvUkzfrhP FSgQ== X-Gm-Message-State: AFqh2kr8cPOgukuW+zm/Nkd3gKzlFvAS7LiT2Ns2ia4tkd7pzcehU3JA 4OGjHBLkrJZrJYP+G+qINX1/yBzHOUlJ X-Received: by 2002:a17:902:edd1:b0:192:50fe:504a with SMTP id q17-20020a170902edd100b0019250fe504amr44577350plk.16.1672796849860; Tue, 03 Jan 2023 17:47:29 -0800 (PST) Received: from localhost.localdomain ([144.214.0.13]) by smtp.gmail.com with ESMTPSA id l3-20020a170902e2c300b00192bf7eaf28sm6758798plc.286.2023.01.03.17.47.26 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Tue, 03 Jan 2023 17:47:29 -0800 (PST) From: Hao Sun To: bpf@vger.kernel.org Cc: ast@kernel.org, daniel@iogearbox.net, john.fastabend@gmail.com, andrii@kernel.org, martin.lau@linux.dev, song@kernel.org, yhs@fb.com, kpsingh@kernel.org, sdf@google.com, haoluo@google.com, jolsa@kernel.org, davem@davemloft.net, linux-kernel@vger.kernel.org, Hao Sun Subject: [PATCH] bpf: skip invalid kfunc call in backtrack_insn Date: Wed, 4 Jan 2023 09:47:09 +0800 Message-Id: <20230104014709.9375-1-sunhao.th@gmail.com> X-Mailer: git-send-email 2.37.1 (Apple Git-137.1) MIME-Version: 1.0 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM, RCVD_IN_DNSWL_NONE,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1754055520597911767?= X-GMAIL-MSGID: =?utf-8?q?1754055520597911767?= The verifier skips invalid kfunc call in check_kfunc_call(), which would be captured in fixup_kfunc_call() if such insn is not eliminated by dead code elimination. However, this can lead to the following warning in backtrack_insn(), alse see [1]: ------------[ cut here ]------------ verifier backtracking bug WARNING: CPU: 6 PID: 8646 at kernel/bpf/verifier.c:2756 backtrack_insn kernel/bpf/verifier.c:2756 __mark_chain_precision kernel/bpf/verifier.c:3065 mark_chain_precision kernel/bpf/verifier.c:3165 adjust_reg_min_max_vals kernel/bpf/verifier.c:10715 check_alu_op kernel/bpf/verifier.c:10928 do_check kernel/bpf/verifier.c:13821 [inline] do_check_common kernel/bpf/verifier.c:16289 ... So make backtracking conservative with this by returning ENOTSUPP. [1] https://lore.kernel.org/bpf/CACkBjsaXNceR8ZjkLG=dT3P=4A8SBsg0Z5h5PWLryF5=ghKq=g@mail.gmail.com/ Signed-off-by: Hao Sun Acked-by: Yonghong Song --- kernel/bpf/verifier.c | 6 ++++++ 1 file changed, 6 insertions(+) base-commit: acd3b7768048fe338248cdf43ccfbf8c084a6bc1 diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 4a25375ebb0d..04887b1e4178 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -2750,6 +2750,12 @@ static int backtrack_insn(struct bpf_verifier_env *env, int idx, */ if (insn->src_reg == 0 && is_callback_calling_function(insn->imm)) return -ENOTSUPP; + /* kfunc with imm==0 is invalid and fixup_kfunc_call will + * catch this error later. Make backtracking conservative + * with ENOTSUPP. + */ + if (insn->src_reg == BPF_PSEUDO_KFUNC_CALL && insn->imm == 0) + return -ENOTSUPP; /* regular helper call sets R0 */ *reg_mask &= ~1; if (*reg_mask & 0x3f) {