lkml.org 
[lkml]   [2021]   [Nov]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.15 562/917] bpf: Fix propagation of bounds from 64-bit min/max into 32-bit and var_off.
    Date
    From: Alexei Starovoitov <ast@kernel.org>

    [ Upstream commit b9979db8340154526d9ab38a1883d6f6ba9b6d47 ]

    Before this fix:
    166: (b5) if r2 <= 0x1 goto pc+22
    from 166 to 189: R2=invP(id=1,umax_value=1,var_off=(0x0; 0xffffffff))

    After this fix:
    166: (b5) if r2 <= 0x1 goto pc+22
    from 166 to 189: R2=invP(id=1,umax_value=1,var_off=(0x0; 0x1))

    While processing BPF_JLE the reg_set_min_max() would set true_reg->umax_value = 1
    and call __reg_combine_64_into_32(true_reg).

    Without the fix it would not pass the condition:
    if (__reg64_bound_u32(reg->umin_value) && __reg64_bound_u32(reg->umax_value))

    since umin_value == 0 at this point.
    Before commit 10bf4e83167c the umin was incorrectly ingored.
    The commit 10bf4e83167c fixed the correctness issue, but pessimized
    propagation of 64-bit min max into 32-bit min max and corresponding var_off.

    Fixes: 10bf4e83167c ("bpf: Fix propagation of 32 bit unsigned bounds from 64 bit bounds")
    Signed-off-by: Alexei Starovoitov <ast@kernel.org>
    Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
    Acked-by: Yonghong Song <yhs@fb.com>
    Link: https://lore.kernel.org/bpf/20211101222153.78759-1-alexei.starovoitov@gmail.com
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    kernel/bpf/verifier.c | 2 +-
    tools/testing/selftests/bpf/verifier/array_access.c | 2 +-
    2 files changed, 2 insertions(+), 2 deletions(-)

    diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
    index e76b559179054..055012faca94e 100644
    --- a/kernel/bpf/verifier.c
    +++ b/kernel/bpf/verifier.c
    @@ -1411,7 +1411,7 @@ static bool __reg64_bound_s32(s64 a)

    static bool __reg64_bound_u32(u64 a)
    {
    - return a > U32_MIN && a < U32_MAX;
    + return a >= U32_MIN && a <= U32_MAX;
    }

    static void __reg_combine_64_into_32(struct bpf_reg_state *reg)
    diff --git a/tools/testing/selftests/bpf/verifier/array_access.c b/tools/testing/selftests/bpf/verifier/array_access.c
    index 1b1c798e92489..1b138cd2b187d 100644
    --- a/tools/testing/selftests/bpf/verifier/array_access.c
    +++ b/tools/testing/selftests/bpf/verifier/array_access.c
    @@ -186,7 +186,7 @@
    },
    .fixup_map_hash_48b = { 3 },
    .errstr_unpriv = "R0 leaks addr",
    - .errstr = "R0 unbounded memory access",
    + .errstr = "invalid access to map value, value_size=48 off=44 size=8",
    .result_unpriv = REJECT,
    .result = REJECT,
    .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
    --
    2.33.0


    \
     
     \ /
      Last update: 2021-11-16 00:51    [W:3.607 / U:0.544 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site