Received-SPF: softfail (google.com: domain of transitioning linux-kernel-owner@vger.kernel.org does not designate 23.128.96.19 as permitted sender) client-ip=23.128.96.19;
From:   Shung-Hsi Yu <shung-hsi.yu@suse.com>
To:     netdev@vger.kernel.org, bpf@vger.kernel.org,
        linux-kernel@vger.kernel.org
CC:     Shung-Hsi Yu <shung-hsi.yu@suse.com>,
        Alexei Starovoitov <ast@kernel.org>,
        Daniel Borkmann <daniel@iogearbox.net>,
        Andrii Nakryiko <andrii@kernel.org>,
        Martin KaFai Lau <kafai@fb.com>,
        Song Liu <songliubraving@fb.com>, Yonghong Song <yhs@fb.com>,
        John Fastabend <john.fastabend@gmail.com>,
        KP Singh <kpsingh@kernel.org>
Subject: [PATCH bpf-next 2/4] bpf: verifier: explain opcode check in check_ld_imm()
Date:   Fri, 20 May 2022 19:37:26 +0800
Message-ID: <20220520113728.12708-3-shung-hsi.yu@suse.com>
In-Reply-To: <20220520113728.12708-1-shung-hsi.yu@suse.com>
References: <20220520113728.12708-1-shung-hsi.yu@suse.com>
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?2gJ05teQjU4KSUTff8mCtagtPpZgEbIjgl7I7MXD0LgaK8aSv7LdOfbyVP1U?=
 =?us-ascii?Q?VmBRX0DiZlBhuLiznPb6JPxMzW3Xijj4o0D4SmpCsZF4091cFUiE+lw8xe/u?=
 =?us-ascii?Q?gkiI78yyK68f1oxM+E19G5aI7idsxBL0s0PNMmHyxxMlRLXI6aGPGgRLRsTg?=
 =?us-ascii?Q?rf92pa8rgFhWACEQOu4NZEQ2Ehr1IUKY9Sy0a26kWv0sP1TeLiYef5rVJLlE?=
 =?us-ascii?Q?SO0u/a87gs0zGRCTP6ubzsouAyAX+XuWkjH6ck6vWx3JD06pKlP9e/XSuaJk?=
 =?us-ascii?Q?Sncc8C3dLslM8W9Pe0iq3H0ETFNtT92ZvDB4swzzC93EBNb01gSaplqGAcR5?=
 =?us-ascii?Q?l70YvaIxzOZkjBXKi0JxFsM9sWHVoItlYq5u8UyK0WmmyKI6mSmKax4NF39v?=
 =?us-ascii?Q?xYh+scn57QzD1gJIw43xmgduQ/9cESH5YA5VstoB9EiPOESej45CGaXG0apM?=
 =?us-ascii?Q?+LG0rSE0nuICFtnktAGdJnHBYyYajVjomzLtvMyxGxCXWEAJQsqeMAdsTAbg?=
 =?us-ascii?Q?mlg6njE2e18oE31OA5y7sj4ikGxz3ie7b0F/NUyvTw4BmLbxXYTdLULbFGBM?=
 =?us-ascii?Q?CRNjjiMRGzZan5SmQLTB6bZUUV3wjD75xJipFBWDrEsR4T8KED+oYelapxDx?=
 =?us-ascii?Q?1xiZUYhhfsgKlHE6gYH2Z6iR7F6DKQsKit5APvKb+1kG5dafS8rAKS4QlsA7?=
 =?us-ascii?Q?mCniiHFb0looMmIulkX9EYICCaYnUG7V0AZbx4mQ/YZMCesTh5xOtDL3mQf2?=
 =?us-ascii?Q?RKm32su000yOCW+N60xCL1/lbLFURVOx+WGJykTWi6Ppxo00RCrc/dPhuxD1?=
 =?us-ascii?Q?Nrv260oBclEgc5+nG6fMJkNw0tHJdQOcPbQCuhWfH3c3ftf+lIHP/lFIEag1?=
 =?us-ascii?Q?JXmgfyRgZZmZj73ljcfn+NVt2pjndxvg6+2IpoGwL5gj47yFD/tyHDgnnbtA?=
 =?us-ascii?Q?Wj9DaSAye20ESJmu0aIoeduqW7mo+pQ9s/8WLjVQcrTL10lBVfHkeYCYPTJl?=
 =?us-ascii?Q?Hf4tJMzug/01tSywF8zoQb7VtLMG/AUzXSEV8kyQfb44+DGUWMCbmMkv1pOt?=
 =?us-ascii?Q?isx/nGS99bAFcLnvHkSfFeR35U0YUrybeeQnUnjkdvBITAd/3HEVNrf0hi5D?=
 =?us-ascii?Q?+o4W+WV0706ycK1C8n4RVgGlBha8hhBzB1BR2luiTuQfJxHJ/0cqtIC6vjud?=
 =?us-ascii?Q?UAIwWuTqBrk7gAg+wI9BX9RVzBUDUKMCHJP32mXnjVcDk9+XX+IUcpm2Vrw1?=
 =?us-ascii?Q?WMqvMtFrnPW0Xqpu2vZa9agMQfFUAj2boY1wWykD14l0gMQwubAPbXiTlbbp?=
 =?us-ascii?Q?tdHPcfXN3jTgQPWFhdiFGcNMtQXla9fbFiclzMh+Z4S8pwUG04CnO3A4OOf3?=
 =?us-ascii?Q?RRONUnpGYLM3rz5++fLnL48YycxdHiftl1K6DUPuGJ7ujq6T22r3YpZ8syMx?=
 =?us-ascii?Q?2Z9+z/NPdlXYOdaf8ybfKNMUW4zM1RpHVVDiDcrLqHuUTXVdp8ey1ZPUnQg5?=
 =?us-ascii?Q?e9mAjEXizjkO6YI2BtnSjndUncbeTzqzMTelD2vpwhF1Bi6brLUyBkmPYmkf?=
 =?us-ascii?Q?RQF091kdQ9BG7UBHt6yqdPVKeH70l8NMEM73LKS1y+CWBvk/CKHLiCSejXVz?=
 =?us-ascii?Q?DIuXozteNH3yCWwET3d+I6GGUu8LrYHwHjb0zWd2LcsSW9G8D4aM9eLjER12?=
 =?us-ascii?Q?AD40KiT5NQAiNQPB7IL/X7SVIhg6dRgWW5hk7mLj3dpBm6gDWDe6tp+PAZPF?=
 =?us-ascii?Q?KJNALQqVJw=3D=3D?=
X-OriginatorOrg: suse.com
X-MS-Exchange-CrossTenant-Network-Message-Id: d3d3a47b-e156-4503-f524-08da3a552ec9
X-MS-Exchange-CrossTenant-AuthSource: DB9PR04MB8107.eurprd04.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 20 May 2022 11:37:56.0933
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: f7a17af6-1c5c-4a36-aa8b-f5be247aa4ba
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: WA03VNJyUWJ9gpmt0KRV5Uzh+kUkVcs3FwiTx6DR54X1hZXWVNRoDciQU9QPP9nr6x7bVXs7Q7JHhF39BOKTDQ==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB6PR04MB3253
X-Spam-Status: No, score=-2.0 required=5.0 tests=BAYES_00,DKIM_SIGNED,
	DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,
	MAILING_LIST_MULTI,RDNS_NONE,SPF_HELO_NONE,T_SCC_BODY_TEXT_LINE
	autolearn=no autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
	lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

The BPF_SIZE check in the beginning of check_ld_imm() actually guard
against program with JMP instructions that goes to the second
instruction of BPF_LD_IMM64, but may be easily dismissed as an simple
opcode check that's duplicating the effort of bpf_opcode_in_insntable().

Add comment to better reflect the importance of the check.

Signed-off-by: Shung-Hsi Yu <shung-hsi.yu@suse.com>
---
 kernel/bpf/verifier.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 79a2695ee2e2..133929751f80 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -9921,6 +9921,10 @@ static int check_ld_imm(struct bpf_verifier_env *env=
, struct bpf_insn *insn)
 	struct bpf_map *map;
 	int err;
=20
+	/* checks that this is not the second part of BPF_LD_IMM64, which is
+	 * skipped over during opcode check, but a JMP with invalid offset may
+	 * cause check_ld_imm() to be called upon it.
+	 */
 	if (BPF_SIZE(insn->code) !=3D BPF_DW) {
 		verbose(env, "invalid BPF_LD_IMM insn\n");
 		return -EINVAL;
--=20
2.36.1