public inbox for netdev@vger.kernel.org 
 help / color / mirror / Atom feed
From: Daniel Borkmann via iovisor-dev <iovisor-dev-9jONkmmOlFHEE9lA1F8Ukti2O/JbrIOy@public•gmane.org>
To: Edward Cree <ecree-s/n/eUQHGBpZroRs9YW3xA@public•gmane.org>,
	davem-fT/PcQaiUtIeIZ0/mPfg9Q@public•gmane.org,
	Alexei Starovoitov
	<alexei.starovoitov-Re5JQEeQqe8AvxtiuMwx3w@public•gmane.org>,
	Alexei Starovoitov <ast-b10kYP2dOMg@public•gmane.org>
Cc: netdev-u79uwXL29TY76Z2rM5mHXA@public•gmane.org,
	iovisor-dev
	<iovisor-dev-9jONkmmOlFHEE9lA1F8Ukti2O/JbrIOy@public•gmane.org>,
	linux-kernel-u79uwXL29TY76Z2rM5mHXA@public•gmane.org
Subject: Re: [PATCH v3 net-next 02/12] bpf/verifier: rework value tracking
Date: Wed, 28 Jun 2017 19:09:57 +0200	[thread overview]
Message-ID: <5953E2E5.7040106@iogearbox.net> (raw)
In-Reply-To: <2244b48b-f415-3239-6912-cb09f0abc546-s/n/eUQHGBpZroRs9YW3xA@public.gmane.org>

On 06/27/2017 02:56 PM, Edward Cree wrote:
> Tracks value alignment by means of tracking known & unknown bits.
> Tightens some min/max value checks and fixes a couple of bugs therein.
> If pointer leaks are allowed, and adjust_ptr_min_max_vals returns -EACCES,
>   treat the pointer as an unknown scalar and try again, because we might be
>   able to conclude something about the result (e.g. pointer & 0x40 is either
>   0 or 0x40).
>
> Signed-off-by: Edward Cree <ecree-s/n/eUQHGBpZroRs9YW3xA@public•gmane.org>
[...]
> +static int adjust_reg_min_max_vals(struct bpf_verifier_env *env,
> +				   struct bpf_insn *insn)
> +{
> +	struct bpf_reg_state *regs = env->cur_state.regs, *dst_reg, *src_reg;
> +	struct bpf_reg_state *ptr_reg = NULL, off_reg = {0};
> +	u8 opcode = BPF_OP(insn->code);
> +	int rc;
> +
> +	dst_reg = &regs[insn->dst_reg];
> +	check_reg_overflow(dst_reg);
> +	src_reg = NULL;
> +	if (dst_reg->type != SCALAR_VALUE)
> +		ptr_reg = dst_reg;
> +	if (BPF_SRC(insn->code) == BPF_X) {
> +		src_reg = &regs[insn->src_reg];
> +		check_reg_overflow(src_reg);
> +
> +		if (src_reg->type != SCALAR_VALUE) {
> +			if (dst_reg->type != SCALAR_VALUE) {
> +				/* Combining two pointers by any ALU op yields
> +				 * an arbitrary scalar.
> +				 */
> +				if (!env->allow_ptr_leaks) {
> +					verbose("R%d pointer %s pointer prohibited\n",
> +						insn->dst_reg,
> +						bpf_alu_string[opcode >> 4]);
> +					return -EACCES;
> +				}
> +				mark_reg_unknown(regs, insn->dst_reg);
> +				return 0;
> +			} else {
> +				/* scalar += pointer
> +				 * This is legal, but we have to reverse our
> +				 * src/dest handling in computing the range
> +				 */
> +				rc = adjust_ptr_min_max_vals(env, insn,
> +							     src_reg, dst_reg);
> +				if (rc == -EACCES && env->allow_ptr_leaks) {
> +					/* scalar += unknown scalar */
> +					__mark_reg_unknown(&off_reg);
> +					return adjust_scalar_min_max_vals(
> +							env, insn,
> +							dst_reg, &off_reg);

Could you elaborate on this one? If I understand it correctly, then
the scalar += pointer case would mean the following: given I have one
of the allowed pointer types in adjust_ptr_min_max_vals() then the
prior scalar type inherits the ptr type/id. I would then 'destroy' the
pointer value so we get a -EACCES on it. We mark the tmp off_reg as
scalar type, but shouldn't also actual dst_reg be marked as such
like in below pointer += scalar case, such that we undo the prior
ptr_type inheritance?

> +				}
> +				return rc;
> +			}
> +		} else if (ptr_reg) {
> +			/* pointer += scalar */
> +			rc = adjust_ptr_min_max_vals(env, insn,
> +						     dst_reg, src_reg);
> +			if (rc == -EACCES && env->allow_ptr_leaks) {
> +				/* unknown scalar += scalar */
> +				__mark_reg_unknown(dst_reg);
> +				return adjust_scalar_min_max_vals(
> +						env, insn, dst_reg, src_reg);
> +			}
> +			return rc;
> +		}
> +	} else {
[...]

  parent reply	other threads:[~2017-06-28 17:09 UTC|newest]

Thread overview: 45+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-06-27 12:53 [PATCH v3 net-next 00/12] bpf: rewrite value tracking in verifier Edward Cree via iovisor-dev
     [not found] ` <adc11342-737f-4e06-bce3-f0a92b5594a5-s/n/eUQHGBpZroRs9YW3xA@public.gmane.org>
2017-06-27 12:56   ` [PATCH v3 net-next 01/12] selftests/bpf: add test for mixed signed and unsigned bounds checks Edward Cree via iovisor-dev
     [not found]     ` <12c14f90-153c-c2c2-b2e2-834185b7ec3f-s/n/eUQHGBpZroRs9YW3xA@public.gmane.org>
2017-06-28 13:51       ` Daniel Borkmann via iovisor-dev
2017-06-27 12:56   ` [PATCH v3 net-next 02/12] bpf/verifier: rework value tracking Edward Cree via iovisor-dev
2017-06-28 15:15     ` Daniel Borkmann
     [not found]       ` <5953C7FE.1050205-FeC+5ew28dpmcu3hnIyYJQ@public.gmane.org>
2017-06-28 16:07         ` Edward Cree via iovisor-dev
     [not found]           ` <71aae126-352d-d916-d64a-9d4045d0abe9-s/n/eUQHGBpZroRs9YW3xA@public.gmane.org>
2017-06-28 19:44             ` Daniel Borkmann via iovisor-dev
     [not found]     ` <2244b48b-f415-3239-6912-cb09f0abc546-s/n/eUQHGBpZroRs9YW3xA@public.gmane.org>
2017-06-28 17:09       ` Daniel Borkmann via iovisor-dev [this message]
     [not found]         ` <5953E2E5.7040106-FeC+5ew28dpmcu3hnIyYJQ@public.gmane.org>
2017-06-28 18:28           ` Edward Cree via iovisor-dev
2017-07-06 20:26       ` Nadav Amit via iovisor-dev
2017-07-06 21:21       ` Nadav Amit via iovisor-dev
     [not found]         ` <E65DE75F-FC5F-41BC-9F7B-C03D324D8C6F-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
2017-07-07 13:48           ` Edward Cree via iovisor-dev
     [not found]             ` <abd3c014-f33a-6e86-aead-be38697a2cec-s/n/eUQHGBpZroRs9YW3xA@public.gmane.org>
2017-07-07 17:45               ` Nadav Amit via iovisor-dev
     [not found]                 ` <3A96914E-3009-4E19-B138-7A636A76D9C8-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
2017-07-08  0:54                   ` Nadav Amit via iovisor-dev
2017-07-12 19:13                   ` Edward Cree via iovisor-dev
     [not found]                     ` <68a2487e-f706-1b61-5c4c-20ffe6d51127-s/n/eUQHGBpZroRs9YW3xA@public.gmane.org>
2017-07-12 22:07                       ` Nadav Amit via iovisor-dev
     [not found]                         ` <12DCE590-7F67-4639-A825-61A24AC44ED3-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
2017-07-17 17:02                           ` Edward Cree via iovisor-dev
2017-06-29  7:48     ` kbuild test robot
2017-06-27 12:57   ` [PATCH v3 net-next 03/12] nfp: change bpf verifier hooks to match new verifier data structures Edward Cree via iovisor-dev
     [not found]     ` <b8418d35-7d3f-1ee3-2bfa-cdf87e5b7c95-s/n/eUQHGBpZroRs9YW3xA@public.gmane.org>
2017-06-28 20:47       ` Daniel Borkmann via iovisor-dev
2017-06-29  3:47       ` Jakub Kicinski via iovisor-dev
2017-06-27 12:57   ` [PATCH v3 net-next 04/12] bpf/verifier: track signed and unsigned min/max values Edward Cree via iovisor-dev
2017-06-27 12:58   ` [PATCH v3 net-next 05/12] bpf/verifier: more concise register state logs for constant var_off Edward Cree via iovisor-dev
2017-06-27 12:58   ` [PATCH v3 net-next 06/12] selftests/bpf: change test_verifier expectations Edward Cree via iovisor-dev
2017-06-27 12:59   ` [PATCH v3 net-next 07/12] selftests/bpf: rewrite test_align Edward Cree via iovisor-dev
2017-06-27 12:59   ` [PATCH v3 net-next 08/12] selftests/bpf: add a test to test_align Edward Cree via iovisor-dev
2017-06-27 12:59   ` [PATCH v3 net-next 09/12] selftests/bpf: add test for bogus operations on pointers Edward Cree via iovisor-dev
2017-06-27 12:59   ` [PATCH v3 net-next 10/12] selftests/bpf: don't try to access past MAX_PACKET_OFF in test_verifier Edward Cree via iovisor-dev
2017-06-27 13:00   ` [PATCH v3 net-next 11/12] selftests/bpf: add tests for subtraction & negative numbers Edward Cree via iovisor-dev
2017-06-27 13:00   ` [PATCH v3 net-next 12/12] selftests/bpf: variable offset negative tests Edward Cree via iovisor-dev
2017-06-28 13:50 ` [PATCH v3 net-next 00/12] bpf: rewrite value tracking in verifier Daniel Borkmann
     [not found]   ` <5953B436.6030506-FeC+5ew28dpmcu3hnIyYJQ@public.gmane.org>
2017-06-28 14:11     ` Edward Cree via iovisor-dev
     [not found]       ` <788035e1-1974-b48e-3008-d294194a8b05-s/n/eUQHGBpZroRs9YW3xA@public.gmane.org>
2017-06-28 20:38         ` Daniel Borkmann via iovisor-dev
     [not found]           ` <595413AA.40502-FeC+5ew28dpmcu3hnIyYJQ@public.gmane.org>
2017-06-28 21:37             ` Alexei Starovoitov via iovisor-dev
2017-06-30 16:44               ` Edward Cree via iovisor-dev
     [not found]                 ` <91267d15-652a-16d9-4ee9-42958bd842aa-s/n/eUQHGBpZroRs9YW3xA@public.gmane.org>
2017-06-30 17:34                   ` [TEST PATCH] bpf/verifier: roll back ptr&const handling, and fix signed bounds Edward Cree via iovisor-dev
2017-06-30 18:15                   ` [PATCH v3 net-next 00/12] bpf: rewrite value tracking in verifier Alexei Starovoitov via iovisor-dev
     [not found]                     ` <ff1ef3ef-71ef-4c23-ede4-b8caeac561ee-b10kYP2dOMg@public.gmane.org>
2017-07-04 19:22                       ` Edward Cree via iovisor-dev
     [not found]                         ` <5fa61129-fa82-1607-3363-dfad86aecf1e-s/n/eUQHGBpZroRs9YW3xA@public.gmane.org>
2017-07-04 22:28                           ` Daniel Borkmann via iovisor-dev
2017-07-06 18:27                             ` Edward Cree
     [not found]                               ` <54b95191-697d-6b15-ec39-438c85e08adc-s/n/eUQHGBpZroRs9YW3xA@public.gmane.org>
2017-07-07  9:14                                 ` Daniel Borkmann via iovisor-dev
     [not found]                                   ` <595F50F3.2030008-FeC+5ew28dpmcu3hnIyYJQ@public.gmane.org>
2017-07-07 12:50                                     ` Edward Cree via iovisor-dev
2017-07-07 13:05                                       ` Daniel Borkmann
2017-07-06 14:07                           ` Edward Cree via iovisor-dev
2017-07-14 20:03 ` [iovisor-dev] " Y Song

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=5953E2E5.7040106@iogearbox.net \
    --to=iovisor-dev-9jonkmmolfhee9la1f8ukti2o/jbrioy@public$(echo .)gmane.org \
    --cc=alexei.starovoitov-Re5JQEeQqe8AvxtiuMwx3w@public$(echo .)gmane.org \
    --cc=ast-b10kYP2dOMg@public$(echo .)gmane.org \
    --cc=daniel-FeC+5ew28dpmcu3hnIyYJQ@public$(echo .)gmane.org \
    --cc=davem-fT/PcQaiUtIeIZ0/mPfg9Q@public$(echo .)gmane.org \
    --cc=ecree-s/n/eUQHGBpZroRs9YW3xA@public$(echo .)gmane.org \
    --cc=linux-kernel-u79uwXL29TY76Z2rM5mHXA@public$(echo .)gmane.org \
    --cc=netdev-u79uwXL29TY76Z2rM5mHXA@public$(echo .)gmane.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox