Commit 24b4d2ab authored by Alex Gartrell's avatar Alex Gartrell Committed by David S. Miller
Browse files

ebpf: Allow dereferences of PTR_TO_STACK registers 



mov %rsp, %r1           ; r1 = rsp
        add $-8, %r1            ; r1 = rsp - 8
        store_q $123, -8(%rsp)  ; *(u64*)r1 = 123  <- valid
        store_q $123, (%r1)     ; *(u64*)r1 = 123  <- previously invalid
        mov $0, %r0
        exit                    ; Always need to exit

And we'd get the following error:

	0: (bf) r1 = r10
	1: (07) r1 += -8
	2: (7a) *(u64 *)(r10 -8) = 999
	3: (7a) *(u64 *)(r1 +0) = 999
	R1 invalid mem access 'fp'

	Unable to load program

We already know that a register is a stack address and the appropriate
offset, so we should be able to validate those references as well.

Signed-off-by: default avatarAlex Gartrell <agartrell@fb.com>
Acked-by: default avatarAlexei Starovoitov <ast@plumgrid.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 6ecfdd28

kernel/bpf/verifier.c

+5 −1
Original line number Original line Diff line number Diff line
@@ -648,6 +648,9 @@ static int check_mem_access(struct verifier_env *env, u32 regno, int off, 
	struct verifier_state *state = &env->cur_state;

	struct verifier_state *state = &env->cur_state;

	int size, err = 0;

	int size, err = 0;





	if (state->regs[regno].type == PTR_TO_STACK)

		off += state->regs[regno].imm;



	size = bpf_size_to_bytes(bpf_size);

	size = bpf_size_to_bytes(bpf_size);

	if (size < 0)

	if (size < 0)

		return size;

		return size;
@@ -667,7 +670,8 @@ static int check_mem_access(struct verifier_env *env, u32 regno, int off, 
		if (!err && t == BPF_READ && value_regno >= 0)

		if (!err && t == BPF_READ && value_regno >= 0)

			mark_reg_unknown_value(state->regs, value_regno);

			mark_reg_unknown_value(state->regs, value_regno);





	} else if (state->regs[regno].type == FRAME_PTR) {

	} else if (state->regs[regno].type == FRAME_PTR ||

		   state->regs[regno].type == PTR_TO_STACK) {

		if (off >= 0 || off < -MAX_BPF_STACK) {

		if (off >= 0 || off < -MAX_BPF_STACK) {

			verbose("invalid stack off=%d size=%d\n", off, size);

			verbose("invalid stack off=%d size=%d\n", off, size);

			return -EACCES;

			return -EACCES;

samples/bpf/test_verifier.c

+59 −0
Original line number Original line Diff line number Diff line
@@ -822,6 +822,65 @@ static struct bpf_test tests[] = { 
		.result = ACCEPT,

		.result = ACCEPT,

		.prog_type = BPF_PROG_TYPE_SCHED_CLS,

		.prog_type = BPF_PROG_TYPE_SCHED_CLS,

	},

	},

	{

		"PTR_TO_STACK store/load",

		.insns = {

			BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),

			BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -10),

			BPF_ST_MEM(BPF_DW, BPF_REG_1, 2, 0xfaceb00c),

			BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 2),

			BPF_EXIT_INSN(),

		},

		.result = ACCEPT,

	},

	{

		"PTR_TO_STACK store/load - bad alignment on off",

		.insns = {

			BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),

			BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),

			BPF_ST_MEM(BPF_DW, BPF_REG_1, 2, 0xfaceb00c),

			BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 2),

			BPF_EXIT_INSN(),

		},

		.result = REJECT,

		.errstr = "misaligned access off -6 size 8",

	},

	{

		"PTR_TO_STACK store/load - bad alignment on reg",

		.insns = {

			BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),

			BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -10),

			BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),

			BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),

			BPF_EXIT_INSN(),

		},

		.result = REJECT,

		.errstr = "misaligned access off -2 size 8",

	},

	{

		"PTR_TO_STACK store/load - out of bounds low",

		.insns = {

			BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),

			BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -80000),

			BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),

			BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),

			BPF_EXIT_INSN(),

		},

		.result = REJECT,

		.errstr = "invalid stack off=-79992 size=8",

	},

	{

		"PTR_TO_STACK store/load - out of bounds high",

		.insns = {

			BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),

			BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),

			BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),

			BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),

			BPF_EXIT_INSN(),

		},

		.result = REJECT,

		.errstr = "invalid stack off=0 size=8",

	},

};

};





static int probe_filter_length(struct bpf_insn *fp)

static int probe_filter_length(struct bpf_insn *fp)

CRA Git | Maintained and supported by SUSTech CRA and CCSE