lkml.org 
[lkml]   [2021]   [Aug]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 19/23] bpf: Do not mark insn as seen under speculative path verification
    Date
    From: Daniel Borkmann <daniel@iogearbox.net>

    commit fe9a5ca7e370e613a9a75a13008a3845ea759d6e upstream

    ... in such circumstances, we do not want to mark the instruction as seen given
    the goal is still to jmp-1 rewrite/sanitize dead code, if it is not reachable
    from the non-speculative path verification. We do however want to verify it for
    safety regardless.

    With the patch as-is all the insns that have been marked as seen before the
    patch will also be marked as seen after the patch (just with a potentially
    different non-zero count). An upcoming patch will also verify paths that are
    unreachable in the non-speculative domain, hence this extension is needed.

    Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
    Reviewed-by: John Fastabend <john.fastabend@gmail.com>
    Reviewed-by: Benedict Schlueter <benedict.schlueter@rub.de>
    Reviewed-by: Piotr Krysiuk <piotras@gmail.com>
    Acked-by: Alexei Starovoitov <ast@kernel.org>
    [OP: - env->pass_cnt is not used in 5.4, so adjust sanitize_mark_insn_seen()
    to assign "true" instead
    - drop sanitize_insn_aux_data() comment changes, as the function is not
    present in 5.4]
    Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    kernel/bpf/verifier.c | 17 +++++++++++++++--
    1 file changed, 15 insertions(+), 2 deletions(-)

    --- a/kernel/bpf/verifier.c
    +++ b/kernel/bpf/verifier.c
    @@ -4435,6 +4435,19 @@ do_sim:
    return !ret ? REASON_STACK : 0;
    }

    +static void sanitize_mark_insn_seen(struct bpf_verifier_env *env)
    +{
    + struct bpf_verifier_state *vstate = env->cur_state;
    +
    + /* If we simulate paths under speculation, we don't update the
    + * insn as 'seen' such that when we verify unreachable paths in
    + * the non-speculative domain, sanitize_dead_code() can still
    + * rewrite/sanitize them.
    + */
    + if (!vstate->speculative)
    + env->insn_aux_data[env->insn_idx].seen = true;
    +}
    +
    static int sanitize_err(struct bpf_verifier_env *env,
    const struct bpf_insn *insn, int reason,
    const struct bpf_reg_state *off_reg,
    @@ -7790,7 +7803,7 @@ static int do_check(struct bpf_verifier_
    }

    regs = cur_regs(env);
    - env->insn_aux_data[env->insn_idx].seen = true;
    + sanitize_mark_insn_seen(env);
    prev_insn_idx = env->insn_idx;

    if (class == BPF_ALU || class == BPF_ALU64) {
    @@ -8025,7 +8038,7 @@ process_bpf_exit:
    return err;

    env->insn_idx++;
    - env->insn_aux_data[env->insn_idx].seen = true;
    + sanitize_mark_insn_seen(env);
    } else {
    verbose(env, "invalid BPF_LD mode\n");
    return -EINVAL;

    \
     
     \ /
      Last update: 2021-08-06 10:22    [W:3.489 / U:0.004 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site