Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:5 as permitted sender) client-ip=2620:137:e000::3:5;
Subject: Re: [PATCH bpf-next] Detect jumping to reserved code during
 check_cfg()
To:     Hao Sun <sunhao.th@gmail.com>
Cc:     John Fastabend <john.fastabend@gmail.com>,
        Alexei Starovoitov <ast@kernel.org>,
        Andrii Nakryiko <andrii@kernel.org>,
        Martin KaFai Lau <martin.lau@linux.dev>,
        Song Liu <song@kernel.org>,
        Yonghong Song <yonghong.song@linux.dev>,
        KP Singh <kpsingh@kernel.org>,
        Stanislav Fomichev <sdf@google.com>,
        Hao Luo <haoluo@google.com>, Jiri Olsa <jolsa@kernel.org>,
        bpf@vger.kernel.org, linux-kernel@vger.kernel.org
References: <20231009-jmp-into-reserved-fields-v1-1-d8006e2ac1f6@gmail.com>
 <6524f6f77b896_66abc2084d@john.notmuch>
 <92f824ec-9538-501c-e63e-8483ffe14bad@iogearbox.net>
 <CACkBjsbM8=NLwwEUea21vqCrn-w9cn21gL3BNpU4AupYnuCvJg@mail.gmail.com>
From:   Daniel Borkmann <daniel@iogearbox.net>
Message-ID: <0c892e68-3092-0b21-3331-a5e3cad43800@iogearbox.net>
Date:   Tue, 10 Oct 2023 17:35:05 +0200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101
 Thunderbird/60.7.2
MIME-Version: 1.0
In-Reply-To: <CACkBjsbM8=NLwwEUea21vqCrn-w9cn21gL3BNpU4AupYnuCvJg@mail.gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 10/10/23 11:17 AM, Hao Sun wrote:
[...]
> I regard this as a fix, because the verifier log is not correct, since
> the program does
> not contain any invalid ld_imm64 instructions in this case.
> 
> I haven't met other cases not captured via check_ld_imm(), but somehow, I think
> we probably want to convert the check there as an internal bug,
> because we already
> have bpf_opcode_in_insntable() check in resolve_pseudo_ldimm64(). Once we meet
> invalid insn code here, then somewhere else in the verifier is
> probably wrong. But
> I'm not sure, maybe something like this:

Makes sense, you could probably add this into your series as a separate commit.

> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index eed7350e15f4..bed97de568a5 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -14532,8 +14532,8 @@ static int check_ld_imm(struct
> bpf_verifier_env *env, struct bpf_insn *insn)
>          int err;
> 
>          if (BPF_SIZE(insn->code) != BPF_DW) {
> -               verbose(env, "invalid BPF_LD_IMM insn\n");
> -               return -EINVAL;
> +               verbose(env, "verifier internal bug, invalid BPF_LD_IMM\n");

If so please stick to the common style as we have in other locations:

verbose(env, "verifier internal error: <xyz>\n");

> +               return -EFAULT;
>          }
>          if (insn->off != 0) {
>                  verbose(env, "BPF_LD_IMM64 uses reserved fields\n");
>