Received-SPF: pass (google.com: domain of linux-kernel+bounces-24979-linux.lists.archive=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) client-ip=139.178.88.99;
Message-ID: <7bbb2960-bfad-49bf-b54e-e31a9351d40d@linux.dev>
Date: Fri, 12 Jan 2024 10:38:07 -0800
Precedence: bulk
MIME-Version: 1.0
Subject: Re: [PATCH v3 1/2] bpf: Reject variable offset alu on
 PTR_TO_FLOW_KEYS
Content-Language: en-GB
To: Hao Sun <sunhao.th@gmail.com>, bpf@vger.kernel.org
Cc: willemb@google.com, ast@kernel.org, andrii@kernel.org,
 daniel@iogearbox.net, eddyz87@gmail.com, linux-kernel@vger.kernel.org
References: <20240112152011.6264-1-sunhao.th@gmail.com>
From: Yonghong Song <yonghong.song@linux.dev>
In-Reply-To: <20240112152011.6264-1-sunhao.th@gmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit


On 1/12/24 7:20 AM, Hao Sun wrote:
> For PTR_TO_FLOW_KEYS, check_flow_keys_access() only uses fixed off
> for validation. However, variable offset ptr alu is not prohibited
> for this ptr kind. So the variable offset is not checked.
>
> The following prog is accepted:
> func#0 @0
> 0: R1=ctx() R10=fp0
> 0: (bf) r6 = r1                       ; R1=ctx() R6_w=ctx()
> 1: (79) r7 = *(u64 *)(r6 +144)        ; R6_w=ctx() R7_w=flow_keys()
> 2: (b7) r8 = 1024                     ; R8_w=1024
> 3: (37) r8 /= 1                       ; R8_w=scalar()
> 4: (57) r8 &= 1024                    ; R8_w=scalar(smin=smin32=0,
> smax=umax=smax32=umax32=1024,var_off=(0x0; 0x400))
> 5: (0f) r7 += r8
> mark_precise: frame0: last_idx 5 first_idx 0 subseq_idx -1
> mark_precise: frame0: regs=r8 stack= before 4: (57) r8 &= 1024
> mark_precise: frame0: regs=r8 stack= before 3: (37) r8 /= 1
> mark_precise: frame0: regs=r8 stack= before 2: (b7) r8 = 1024
> 6: R7_w=flow_keys(smin=smin32=0,smax=umax=smax32=umax32=1024,var_off
> =(0x0; 0x400)) R8_w=scalar(smin=smin32=0,smax=umax=smax32=umax32=1024,
> var_off=(0x0; 0x400))
> 6: (79) r0 = *(u64 *)(r7 +0)          ; R0_w=scalar()
> 7: (95) exit
>
> This prog loads flow_keys to r7, and adds the variable offset r8
> to r7, and finally causes out-of-bounds access:
>
> BUG: unable to handle page fault for address: ffffc90014c80038
> ...
> Call Trace:
>   <TASK>
>   bpf_dispatcher_nop_func include/linux/bpf.h:1231 [inline]
>   __bpf_prog_run include/linux/filter.h:651 [inline]
>   bpf_prog_run include/linux/filter.h:658 [inline]
>   bpf_prog_run_pin_on_cpu include/linux/filter.h:675 [inline]
>   bpf_flow_dissect+0x15f/0x350 net/core/flow_dissector.c:991
>   bpf_prog_test_run_flow_dissector+0x39d/0x620 net/bpf/test_run.c:1359
>   bpf_prog_test_run kernel/bpf/syscall.c:4107 [inline]
>   __sys_bpf+0xf8f/0x4560 kernel/bpf/syscall.c:5475
>   __do_sys_bpf kernel/bpf/syscall.c:5561 [inline]
>   __se_sys_bpf kernel/bpf/syscall.c:5559 [inline]
>   __x64_sys_bpf+0x73/0xb0 kernel/bpf/syscall.c:5559
>   do_syscall_x64 arch/x86/entry/common.c:52 [inline]
>   do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:83
>   entry_SYSCALL_64_after_hwframe+0x63/0x6b
>
> Fix this by rejecting ptr alu with variable offset on flow_keys.
> Applying the patch makes the program rejected with "R7 pointer
> arithmetic on flow_keys prohibited"
>
> Fixes: d58e468b1112 ("flow_dissector: implements flow dissector BPF hook")
> Signed-off-by: Hao Sun <sunhao.th@gmail.com>

Acked-by: Yonghong Song <yonghong.song@linux.dev>

> ---
>   kernel/bpf/verifier.c | 4 ++++
>   1 file changed, 4 insertions(+)
>
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index adbf330d364b..65f598694d55 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -12826,6 +12826,10 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env,
>   	}
>   
>   	switch (base_type(ptr_reg->type)) {
> +	case PTR_TO_FLOW_KEYS:
> +		if (known)
> +			break;
> +		fallthrough;
>   	case CONST_PTR_TO_MAP:
>   		/* smin_val represents the known value */
>   		if (known && smin_val == 0 && opcode == BPF_ADD)