Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.33 as permitted sender) client-ip=23.128.96.33;
MIME-Version: 1.0
References: <20231011-jmp-into-reserved-fields-v3-0-97d2aa979788@gmail.com>
 <20231011-jmp-into-reserved-fields-v3-1-97d2aa979788@gmail.com> <CAADnVQJnhfbALtNkCauS_ZwRfybcb_mryEvZW7Uu1uOSshQ9Ew@mail.gmail.com>
In-Reply-To: <CAADnVQJnhfbALtNkCauS_ZwRfybcb_mryEvZW7Uu1uOSshQ9Ew@mail.gmail.com>
From:   Hao Sun <sunhao.th@gmail.com>
Date:   Thu, 12 Oct 2023 08:32:36 +0200
Message-ID: <CACkBjsabY6e1Zh1R+gyuqwpuDiXJwLDc9s9wEEqfb=1P11QeOg@mail.gmail.com>
Subject: Re: [PATCH bpf-next v3 1/3] bpf: Detect jumping to reserved code
 during check_cfg()
To:     Alexei Starovoitov <alexei.starovoitov@gmail.com>
Cc:     Alexei Starovoitov <ast@kernel.org>,
        Daniel Borkmann <daniel@iogearbox.net>,
        John Fastabend <john.fastabend@gmail.com>,
        Andrii Nakryiko <andrii@kernel.org>,
        Martin KaFai Lau <martin.lau@linux.dev>,
        Song Liu <song@kernel.org>,
        Yonghong Song <yonghong.song@linux.dev>,
        KP Singh <kpsingh@kernel.org>,
        Stanislav Fomichev <sdf@google.com>,
        Hao Luo <haoluo@google.com>, Jiri Olsa <jolsa@kernel.org>,
        bpf <bpf@vger.kernel.org>, LKML <linux-kernel@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

On Wed, Oct 11, 2023 at 3:39=E2=80=AFPM Alexei Starovoitov
<alexei.starovoitov@gmail.com> wrote:
>
> On Wed, Oct 11, 2023 at 2:01=E2=80=AFAM Hao Sun <sunhao.th@gmail.com> wro=
te:
> >
> > Currently, we don't check if the branch-taken of a jump is reserved cod=
e of
> > ld_imm64. Instead, such a issue is captured in check_ld_imm(). The veri=
fier
> > gives the following log in such case:
> >
> > func#0 @0
> > 0: R1=3Dctx(off=3D0,imm=3D0) R10=3Dfp0
> > 0: (18) r4 =3D 0xffff888103436000       ; R4_w=3Dmap_ptr(off=3D0,ks=3D4=
,vs=3D128,imm=3D0)
> > 2: (18) r1 =3D 0x1d                     ; R1_w=3D29
> > 4: (55) if r4 !=3D 0x0 goto pc+4        ; R4_w=3Dmap_ptr(off=3D0,ks=3D4=
,vs=3D128,imm=3D0)
> > 5: (1c) w1 -=3D w1                      ; R1_w=3D0
> > 6: (18) r5 =3D 0x32                     ; R5_w=3D50
> > 8: (56) if w5 !=3D 0xfffffff4 goto pc-2
> > mark_precise: frame0: last_idx 8 first_idx 0 subseq_idx -1
> > mark_precise: frame0: regs=3Dr5 stack=3D before 6: (18) r5 =3D 0x32
> > 7: R5_w=3D50
> > 7: BUG_ld_00
> > invalid BPF_LD_IMM insn
> >
> > Here the verifier rejects the program because it thinks insn at 7 is an
> > invalid BPF_LD_IMM, but such a error log is not accurate since the issu=
e
> > is jumping to reserved code not because the program contains invalid in=
sn.
> > Therefore, make the verifier check the jump target during check_cfg(). =
For
> > the same program, the verifier reports the following log:
> >
> > func#0 @0
> > jump to reserved code from insn 8 to 7
> >
> > Signed-off-by: Hao Sun <sunhao.th@gmail.com>
> > ---
> >  kernel/bpf/verifier.c | 7 +++++++
> >  1 file changed, 7 insertions(+)
> >
> > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> > index eed7350e15f4..725ac0b464cf 100644
> > --- a/kernel/bpf/verifier.c
> > +++ b/kernel/bpf/verifier.c
> > @@ -14980,6 +14980,7 @@ static int push_insn(int t, int w, int e, struc=
t bpf_verifier_env *env,
> >  {
> >         int *insn_stack =3D env->cfg.insn_stack;
> >         int *insn_state =3D env->cfg.insn_state;
> > +       struct bpf_insn *insns =3D env->prog->insnsi;
> >
> >         if (e =3D=3D FALLTHROUGH && insn_state[t] >=3D (DISCOVERED | FA=
LLTHROUGH))
> >                 return DONE_EXPLORING;
> > @@ -14993,6 +14994,12 @@ static int push_insn(int t, int w, int e, stru=
ct bpf_verifier_env *env,
> >                 return -EINVAL;
> >         }
> >
> > +       if (e =3D=3D BRANCH && insns[w].code =3D=3D 0) {
> > +               verbose_linfo(env, t, "%d", t);
> > +               verbose(env, "jump to reserved code from insn %d to %d\=
n", t, w);
> > +               return -EINVAL;
> > +       }
>
> I don't think we should be changing the verifier to make
> fuzzer logs more readable.
>
> Same with patch 2. The code is fine as-is.

Confused, the changes are not for fuzzer logs but to handle jumping to
the middle of ld_imm64. Like jumping out of bounds, both are similar
issues and can be handled in one place.

The current code handles such incorrect jumps in check_ld_imm(), which
is strange, and the error log "BAD_LD_IMM" rather than "bad jump" is
also strange.

The second one is just for verifier debugging because the only
caller of check_ld_imm() is do_check(), before which we already
have resolve_pseudo_ldimm64() which has opcode_in_insntable()
to check the validity of insn code. The only reason we could see
an invalid ld_imm64 in check_id_imm() is errors somewhere else.