MIME-Version: 1.0
References: <20211210172034.13614-1-mcroce@linux.microsoft.com>
 <CAADnVQJRVpL0HL=Lz8_e-ZU5y0WrQ_Z0KvQXF2w8rE660Jr62g@mail.gmail.com> <CAFnufp33Dm_5gffiFYQ+Maf4Bj9fE3WLMpFf3cJ=F5mm71mTEQ@mail.gmail.com>
In-Reply-To: <CAFnufp33Dm_5gffiFYQ+Maf4Bj9fE3WLMpFf3cJ=F5mm71mTEQ@mail.gmail.com>
From:   Alexei Starovoitov <alexei.starovoitov@gmail.com>
Date:   Wed, 15 Dec 2021 09:29:44 -0800
Message-ID: <CAADnVQ+OeO=f1rzv_F9HFQmJCcJ7=FojkOuZWvx7cT-XLjVDcQ@mail.gmail.com>
Subject: Re: [PATCH bpf-next] bpf: limit bpf_core_types_are_compat() recursion
To:     Matteo Croce <mcroce@linux.microsoft.com>
Cc:     bpf <bpf@vger.kernel.org>, Alexei Starovoitov <ast@kernel.org>,
        Daniel Borkmann <daniel@iogearbox.net>,
        Andrii Nakryiko <andrii@kernel.org>,
        LKML <linux-kernel@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Precedence: bulk

On Wed, Dec 15, 2021 at 6:54 AM Matteo Croce <mcroce@linux.microsoft.com> wrote:
> >
> > Maybe do a level check here?
> > Since calling it and immediately returning doesn't conserve
> > the stack.
> > If it gets called it can finish fine, but
> > calling it again would be too much.
> > In other words checking the level here gives us
> > room for one more frame.
> >
>
> I thought that the compiler was smart enough to return before
> allocating most of the frame.
> I tried and this is true only with gcc, not with clang.

Interesting. That's a surprise.
Could you share the asm that gcc generates?

> > > +                       err = __bpf_core_types_are_compat(local_btf, local_id,
> > > +                                                         targ_btf, targ_id,
> > > +                                                         level - 1);
> > > +                       if (err <= 0)
> > > +                               return err;
> > > +               }
> > > +
> > > +               /* tail recurse for return type check */
> > > +               btf_type_skip_modifiers(local_btf, local_type->type, &local_id);
> > > +               btf_type_skip_modifiers(targ_btf, targ_type->type, &targ_id);
> > > +               goto recur;
> > > +       }
> > > +       default:
> > > +               pr_warn("unexpected kind %s relocated, local [%d], target [%d]\n",
> > > +                       btf_type_str(local_type), local_id, targ_id);
> >
> > That should be bpf_log() instead.
> >
>
> To do that I need a struct bpf_verifier_log, which is not present
> there, neither in bpf_core_spec_match() or bpf_core_apply_relo_insn().

It is there. See:
        err = bpf_core_apply_relo_insn((void *)ctx->log, insn, ...

> Should we drop the message at all?

Passing it into bpf_core_spec_match() and further into
bpf_core_types_are_compat() is probably unnecessary.
All callers have an error check with a log right after.
So I think we won't lose anything if we drop this log.

>
> > > +               return 0;
> > > +       }
> > > +}
> >
> > Please add tests that exercise this logic by enabling
> > additional lskels and a new test that hits the recursion limit.
> > I suspect we don't have such case in selftests.
> >
> > Thanks!
>
> Will do!

Thanks!