Subject: Re: linux-next: manual merge of the net-next tree with the net tree

From: Yonghong Song <[email-masked]>
Date: Fri, 19 Mar 2021 08:17:17 -0700

On 3/19/21 12:21 AM, Daniel Borkmann wrote:
> On 3/19/21 3:11 AM, Piotr Krysiuk wrote:
>> Hi Daniel,
>>
>> On Fri, Mar 19, 2021 at 12:16 AM Stephen Rothwell <[email-masked]>
>> wrote:
>>
>>> diff --cc kernel/bpf/verifier.c
>>> index 44e4ec1640f1,f9096b049cd6..000000000000
>>> --- a/kernel/bpf/verifier.c
>>> +++ b/kernel/bpf/verifier.c
>>> @@@ -5876,10 -6056,22 +6060,23 @@@ static int 
>>> retrieve_ptr_limit(const str
>>>                  if (mask_to_left)
>>>                          *ptr_limit = MAX_BPF_STACK + off;
>>>                  else
>>>   -                      *ptr_limit = -off;
>>>   -              return 0;
>>>   +                      *ptr_limit = -off - 1;
>>>   +              return *ptr_limit >= max ? -ERANGE : 0;
>>> +       case PTR_TO_MAP_KEY:
>>> +               /* Currently, this code is not exercised as the only use
>>> +                * is bpf_for_each_map_elem() helper which requires
>>> +                * bpf_capble. The code has been tested manually for
>>> +                * future use.
>>> +                */
>>> +               if (mask_to_left) {
>>> +                       *ptr_limit = ptr_reg->umax_value + ptr_reg->off;
>>> +               } else {
>>> +                       off = ptr_reg->smin_value + ptr_reg->off;
>>> +                       *ptr_limit = ptr_reg->map_ptr->key_size - off;
>>> +               }
>>> +               return 0;
>>>
>>
>> PTR_TO_MAP_VALUE logic above looks like copy-paste of old 
>> PTR_TO_MAP_VALUE
>> code from before "bpf: Fix off-by-one for area size in creating mask to
>> left" and is apparently affected by the same off-by-one, except this time
>> on "key_size" area and not "value_size".
>>
>> This needs to be fixed in the same way as we did with PTR_TO_MAP_VALUE.
>> What is the best way to proceed?
> 
> Hm, not sure why PTR_TO_MAP_KEY was added by 69c087ba6225 in the first 
> place, I
> presume noone expects this to be used from unprivileged as the comment 
> says.
> Resolution should be to remove the PTR_TO_MAP_KEY case entirely from 
> that switch
> until we have an actual user.

Alexei suggested so that we don't forget it in the future if
bpf_capable() requirement is removed.
    https://lore.kernel.org/bpf/[email-masked]/

I am okay with either way, fix it or remove it.

> Thanks,
> Daniel