Re: [PATCH bpf-next v2] bpf: Detect jumping to reserved code during check_cfg()
From: Daniel Borkmann
Date: Tue Oct 10 2023 - 11:27:24 EST
On 10/10/23 4:46 PM, Eduard Zingerman wrote:
On Tue, 2023-10-10 at 14:03 +0200, Hao Sun wrote:
Currently, we don't check if the branch-taken of a jump is reserved code of
ld_imm64. Instead, such a issue is captured in check_ld_imm(). The verifier
gives the following log in such case:
func#0 @0
0: R1=ctx(off=0,imm=0) R10=fp0
0: (18) r4 = 0xffff888103436000 ; R4_w=map_ptr(off=0,ks=4,vs=128,imm=0)
2: (18) r1 = 0x1d ; R1_w=29
4: (55) if r4 != 0x0 goto pc+4 ; R4_w=map_ptr(off=0,ks=4,vs=128,imm=0)
5: (1c) w1 -= w1 ; R1_w=0
6: (18) r5 = 0x32 ; R5_w=50
8: (56) if w5 != 0xfffffff4 goto pc-2
mark_precise: frame0: last_idx 8 first_idx 0 subseq_idx -1
mark_precise: frame0: regs=r5 stack= before 6: (18) r5 = 0x32
7: R5_w=50
7: BUG_ld_00
invalid BPF_LD_IMM insn
Here the verifier rejects the program because it thinks insn at 7 is an
invalid BPF_LD_IMM, but such a error log is not accurate since the issue
is jumping to reserved code not because the program contains invalid insn.
Therefore, make the verifier check the jump target during check_cfg(). For
the same program, the verifier reports the following log:
func#0 @0
jump to reserved code from insn 8 to 7
Also adjust existing tests in ld_imm64.c, testing forward/back jump to
reserved code.
Signed-off-by: Hao Sun <sunhao.th@xxxxxxxxx>
Please see a nitpick below.
Acked-by: Eduard Zingerman <eddyz87@xxxxxxxxx>
---
Changes in v2:
- Adjust existing test cases
- Link to v1: https://lore.kernel.org/bpf/20231009-jmp-into-reserved-fields-v1-1-d8006e2ac1f6@xxxxxxxxx/
---
kernel/bpf/verifier.c | 7 +++++++
tools/testing/selftests/bpf/verifier/ld_imm64.c | 8 +++-----
2 files changed, 10 insertions(+), 5 deletions(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index eed7350e15f4..725ac0b464cf 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -14980,6 +14980,7 @@ static int push_insn(int t, int w, int e, struct bpf_verifier_env *env,
{
int *insn_stack = env->cfg.insn_stack;
int *insn_state = env->cfg.insn_state;
+ struct bpf_insn *insns = env->prog->insnsi;
if (e == FALLTHROUGH && insn_state[t] >= (DISCOVERED | FALLTHROUGH))
return DONE_EXPLORING;
@@ -14993,6 +14994,12 @@ static int push_insn(int t, int w, int e, struct bpf_verifier_env *env,
return -EINVAL;
}
+ if (e == BRANCH && insns[w].code == 0) {
+ verbose_linfo(env, t, "%d", t);
+ verbose(env, "jump to reserved code from insn %d to %d\n", t, w);
+ return -EINVAL;
+ }
+
if (e == BRANCH) {
/* mark branch target for state pruning */
mark_prune_point(env, w);
diff --git a/tools/testing/selftests/bpf/verifier/ld_imm64.c b/tools/testing/selftests/bpf/verifier/ld_imm64.c
index f9297900cea6..c34aa78f1877 100644
--- a/tools/testing/selftests/bpf/verifier/ld_imm64.c
+++ b/tools/testing/selftests/bpf/verifier/ld_imm64.c
@@ -9,22 +9,20 @@
BPF_MOV64_IMM(BPF_REG_0, 2),
BPF_EXIT_INSN(),
},
- .errstr = "invalid BPF_LD_IMM insn",
- .errstr_unpriv = "R1 pointer comparison",
+ .errstr = "jump to reserved code",
.result = REJECT,
},
{
"test2 ld_imm64",
.insns = {
- BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, 1),
BPF_LD_IMM64(BPF_REG_0, 0),
+ BPF_JMP_IMM(BPF_JEQ, BPF_REG_1, 0, -2),
This change is not really necessary, the test reports same error
either way.
If we don't have a backward jump covered, we could probably also make this
a new test case rather than modifying an existing one. Aside from that it
would probably also make sense to make this a separate commit, so it eases
backporting a bit.
BPF_LD_IMM64(BPF_REG_0, 0),
BPF_LD_IMM64(BPF_REG_0, 1),
BPF_LD_IMM64(BPF_REG_0, 1),
BPF_EXIT_INSN(),
},
- .errstr = "invalid BPF_LD_IMM insn",
- .errstr_unpriv = "R1 pointer comparison",
+ .errstr = "jump to reserved code",
.result = REJECT,
},
{
---
base-commit: 3157b7ce14bbf468b0ca8613322a05c37b5ae25d
change-id: 20231009-jmp-into-reserved-fields-fc1a98a8e7dc
Best regards,