Currently, the verifier rejects a program jumping to reserved code with
the log "invalid BPF_LD_IMM" in check_ld_imm(), which in not accurate,
because the program does not contain any invalid insns. The root cause
is that the verifier does not detect such jump, thus the reserved code
is passed to check_ld_imm().
The first patch makes the verifier detect jump to reserved code during
check_cfg(). Because jump to reserved code is just like jump out bound,
both break the CFG integrity immediately. The second makes the verifier
report internal error if it sees an invlid ld_imm64 in check_ld_imm(),
because we already have bpf_opcode_in_insntable() to check the validity
of insn code. The third patch adapts existing tests to make them pass,
and add a new case to test backward jump to reserved code.
Signed-off-by: Hao Sun <[email protected]>
---
Changes in v3:
- Separate changes to different commits, change verifier log
- Link to v2: https://lore.kernel.org/r/[email protected]
Changes in v2:
- Adjust existing test cases
- Link to v1: https://lore.kernel.org/bpf/[email protected]/
---
Hao Sun (3):
bpf: Detect jumping to reserved code during check_cfg()
bpf: Report internal error on incorrect ld_imm64 in check_ld_imm()
bpf: Adapt and add tests for detecting jump to reserved code
kernel/bpf/verifier.c | 11 +++++++++--
tools/testing/selftests/bpf/verifier/ld_imm64.c | 16 ++++++++++++----
2 files changed, 21 insertions(+), 6 deletions(-)
---
base-commit: 3157b7ce14bbf468b0ca8613322a05c37b5ae25d
change-id: 20231009-jmp-into-reserved-fields-fc1a98a8e7dc
Best regards,
--
Hao Sun <[email protected]>
Adapt errstr of existing tests to make them pass, and add a new case
to test backward jump to reserved code.
Signed-off-by: Hao Sun <[email protected]>
---
tools/testing/selftests/bpf/verifier/ld_imm64.c | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
diff --git a/tools/testing/selftests/bpf/verifier/ld_imm64.c b/tools/testing/selftests/bpf/verifier/ld_imm64.c
index f9297900cea6..aa3ada0062d9 100644
--- a/tools/testing/selftests/bpf/verifier/ld_imm64.c
+++ b/tools/testing/selftests/bpf/verifier/ld_imm64.c
@@ -9,8 +9,7 @@
BPF_MOV64_IMM(BPF_REG_0, 2),
BPF_EXIT_INSN(),
},
- .errstr = "invalid BPF_LD_IMM insn",
- .errstr_unpriv = "R1 pointer comparison",
+ .errstr = "jump to reserved code",
.result = REJECT,
},
{
@@ -23,8 +22,7 @@
BPF_LD_IMM64(BPF_REG_0, 1),
BPF_EXIT_INSN(),
},
- .errstr = "invalid BPF_LD_IMM insn",
- .errstr_unpriv = "R1 pointer comparison",
+ .errstr = "jump to reserved code",
.result = REJECT,
},
{
@@ -144,3 +142,13 @@
.errstr = "unrecognized bpf_ld_imm64 insn",
.result = REJECT,
},
+{
+ "test15 ld_imm64",
+ .insns = {
+ BPF_LD_IMM64(BPF_REG_0, 0),
+ BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, -2),
+ BPF_EXIT_INSN(),
+ },
+ .errstr = "jump to reserved code",
+ .result = REJECT,
+},
--
2.34.1