Commit 47b3708c authored by Alexei Starovoitov's avatar Alexei Starovoitov
Browse files

Merge branch 'bpf: Fix out-of-bound issue when jit-ing bpf_pseudo_func' 



Martin KaFai says:

====================

This set fixes an out-of-bound access issue when jit-ing the
bpf_pseudo_func insn (i.e. ld_imm64 with src_reg == BPF_PSEUDO_FUNC)
====================

Reported-by: default avatarYonatan Komornik <yoniko@gmail.com>
Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parents 70bf363d d99341b3

include/linux/bpf.h

+6 −0
Original line number Diff line number Diff line
@@ -484,6 +484,12 @@ bpf_ctx_record_field_size(struct bpf_insn_access_aux *aux, u32 size) 
	aux->ctx_field_size = size;

}



static inline bool bpf_pseudo_func(const struct bpf_insn *insn)

{

	return insn->code == (BPF_LD | BPF_IMM | BPF_DW) &&

	       insn->src_reg == BPF_PSEUDO_FUNC;

}



struct bpf_prog_ops {

	int (*test_run)(struct bpf_prog *prog, const union bpf_attr *kattr,

			union bpf_attr __user *uattr);

kernel/bpf/core.c

+7 −0
Original line number Diff line number Diff line
@@ -390,6 +390,13 @@ static int bpf_adj_branches(struct bpf_prog *prog, u32 pos, s32 end_old, 
			i = end_new;

			insn = prog->insnsi + end_old;

		}

		if (bpf_pseudo_func(insn)) {

			ret = bpf_adj_delta_to_imm(insn, pos, end_old,

						   end_new, i, probe_pass);

			if (ret)

				return ret;

			continue;

		}

		code = insn->code;

		if ((BPF_CLASS(code) != BPF_JMP &&

		     BPF_CLASS(code) != BPF_JMP32) ||

kernel/bpf/verifier.c

+14 −23
Original line number Diff line number Diff line
@@ -240,12 +240,6 @@ static bool bpf_pseudo_kfunc_call(const struct bpf_insn *insn) 
	       insn->src_reg == BPF_PSEUDO_KFUNC_CALL;

}



static bool bpf_pseudo_func(const struct bpf_insn *insn)

{

	return insn->code == (BPF_LD | BPF_IMM | BPF_DW) &&

	       insn->src_reg == BPF_PSEUDO_FUNC;

}



struct bpf_call_arg_meta {

	struct bpf_map *map_ptr;

	bool raw_mode;
@@ -1960,16 +1954,10 @@ static int add_subprog_and_kfunc(struct bpf_verifier_env *env) 
			return -EPERM;

		}



		if (bpf_pseudo_func(insn)) {

		if (bpf_pseudo_func(insn) || bpf_pseudo_call(insn))

			ret = add_subprog(env, i + insn->imm + 1);

			if (ret >= 0)

				/* remember subprog */

				insn[1].imm = ret;

		} else if (bpf_pseudo_call(insn)) {

			ret = add_subprog(env, i + insn->imm + 1);

		} else {

		else

			ret = add_kfunc_call(env, insn->imm, insn->off);

		}



		if (ret < 0)

			return ret;
@@ -9387,7 +9375,8 @@ static int check_ld_imm(struct bpf_verifier_env *env, struct bpf_insn *insn) 


	if (insn->src_reg == BPF_PSEUDO_FUNC) {

		struct bpf_prog_aux *aux = env->prog->aux;

		u32 subprogno = insn[1].imm;

		u32 subprogno = find_subprog(env,

					     env->insn_idx + insn->imm + 1);



		if (!aux->func_info) {

			verbose(env, "missing btf func_info\n");
@@ -12557,14 +12546,9 @@ static int jit_subprogs(struct bpf_verifier_env *env) 
		return 0;



	for (i = 0, insn = prog->insnsi; i < prog->len; i++, insn++) {

		if (bpf_pseudo_func(insn)) {

			env->insn_aux_data[i].call_imm = insn->imm;

			/* subprog is encoded in insn[1].imm */

		if (!bpf_pseudo_func(insn) && !bpf_pseudo_call(insn))

			continue;

		}



		if (!bpf_pseudo_call(insn))

			continue;

		/* Upon error here we cannot fall back to interpreter but

		 * need a hard reject of the program. Thus -EFAULT is

		 * propagated in any case.
@@ -12585,6 +12569,12 @@ static int jit_subprogs(struct bpf_verifier_env *env) 
		env->insn_aux_data[i].call_imm = insn->imm;

		/* point imm to __bpf_call_base+1 from JITs point of view */

		insn->imm = 1;

		if (bpf_pseudo_func(insn))

			/* jit (e.g. x86_64) may emit fewer instructions

			 * if it learns a u32 imm is the same as a u64 imm.

			 * Force a non zero here.

			 */

			insn[1].imm = 1;

	}



	err = bpf_prog_alloc_jited_linfo(prog);
@@ -12669,7 +12659,7 @@ static int jit_subprogs(struct bpf_verifier_env *env) 
		insn = func[i]->insnsi;

		for (j = 0; j < func[i]->len; j++, insn++) {

			if (bpf_pseudo_func(insn)) {

				subprog = insn[1].imm;

				subprog = insn->off;

				insn[0].imm = (u32)(long)func[subprog]->bpf_func;

				insn[1].imm = ((u64)(long)func[subprog]->bpf_func) >> 32;

				continue;
@@ -12720,7 +12710,8 @@ static int jit_subprogs(struct bpf_verifier_env *env) 
	for (i = 0, insn = prog->insnsi; i < prog->len; i++, insn++) {

		if (bpf_pseudo_func(insn)) {

			insn[0].imm = env->insn_aux_data[i].call_imm;

			insn[1].imm = find_subprog(env, i + insn[0].imm + 1);

			insn[1].imm = insn->off;

			insn->off = 0;

			continue;

		}

		if (!bpf_pseudo_call(insn))

tools/testing/selftests/bpf/progs/for_each_array_map_elem.c

+12 −0
Original line number Diff line number Diff line
@@ -23,6 +23,16 @@ struct callback_ctx { 
	int output;

};



const volatile int bypass_unused = 1;



static __u64

unused_subprog(struct bpf_map *map, __u32 *key, __u64 *val,

	       struct callback_ctx *data)

{

	data->output = 0;

	return 1;

}



static __u64

check_array_elem(struct bpf_map *map, __u32 *key, __u64 *val,

		 struct callback_ctx *data)
@@ -54,6 +64,8 @@ int test_pkt_access(struct __sk_buff *skb) 


	data.output = 0;

	bpf_for_each_map_elem(&arraymap, check_array_elem, &data, 0);

	if (!bypass_unused)

		bpf_for_each_map_elem(&arraymap, unused_subprog, &data, 0);

	arraymap_output = data.output;



	bpf_for_each_map_elem(&percpu_map, check_percpu_elem, (void *)0, 0);