Commit 68db35b1 authored by Daniel Borkmann's avatar Daniel Borkmann
Browse files

Merge branch 'bpf-map-val-as-key' 



Paul Chaignon says:

====================
Currently, helpers that expect ARG_PTR_TO_MAP_KEY and ARG_PTR_TO_MAP_VALUE
can only access stack and packet memory.  This patchset allows these
helpers to directly access map values by passing registers of type
PTR_TO_MAP_VALUE.

The first patch changes the verifier; the second adds new test cases.

The first three versions of this patchset were sent on the iovisor-dev
mailing list only.

Changelogs:
  Changes in v5:
    - Refactor using check_helper_mem_access.
  Changes in v4:
    - Rebase.
  Changes in v3:
    - Bug fixes.
    - Negative test cases.
  Changes in v2:
    - Additional test cases for adjusted maps.
====================

Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
parents 0e25d14e 5f90dd6a

kernel/bpf/verifier.c

+7 −17
Original line number Original line Diff line number Diff line
@@ -1914,7 +1914,7 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 regno, 
	if (arg_type == ARG_PTR_TO_MAP_KEY ||

	if (arg_type == ARG_PTR_TO_MAP_KEY ||

	    arg_type == ARG_PTR_TO_MAP_VALUE) {

	    arg_type == ARG_PTR_TO_MAP_VALUE) {

		expected_type = PTR_TO_STACK;

		expected_type = PTR_TO_STACK;

		if (!type_is_pkt_pointer(type) &&

		if (!type_is_pkt_pointer(type) && type != PTR_TO_MAP_VALUE &&

		    type != expected_type)

		    type != expected_type)

			goto err_type;

			goto err_type;

	} else if (arg_type == ARG_CONST_SIZE ||

	} else if (arg_type == ARG_CONST_SIZE ||
@@ -1966,14 +1966,9 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 regno, 
			verbose(env, "invalid map_ptr to access map->key\n");

			verbose(env, "invalid map_ptr to access map->key\n");

			return -EACCES;

			return -EACCES;

		}

		}

		if (type_is_pkt_pointer(type))

		err = check_helper_mem_access(env, regno,

			err = check_packet_access(env, regno, reg->off,

					      meta->map_ptr->key_size, false,

						  meta->map_ptr->key_size,

					      NULL);

						  false);

		else

			err = check_stack_boundary(env, regno,

						   meta->map_ptr->key_size,

						   false, NULL);

	} else if (arg_type == ARG_PTR_TO_MAP_VALUE) {

	} else if (arg_type == ARG_PTR_TO_MAP_VALUE) {

		/* bpf_map_xxx(..., map_ptr, ..., value) call:

		/* bpf_map_xxx(..., map_ptr, ..., value) call:

		 * check [value, value + map->value_size) validity

		 * check [value, value + map->value_size) validity
@@ -1983,14 +1978,9 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 regno, 
			verbose(env, "invalid map_ptr to access map->value\n");

			verbose(env, "invalid map_ptr to access map->value\n");

			return -EACCES;

			return -EACCES;

		}

		}

		if (type_is_pkt_pointer(type))

		err = check_helper_mem_access(env, regno,

			err = check_packet_access(env, regno, reg->off,

					      meta->map_ptr->value_size, false,

						  meta->map_ptr->value_size,

					      NULL);

						  false);

		else

			err = check_stack_boundary(env, regno,

						   meta->map_ptr->value_size,

						   false, NULL);

	} else if (arg_type_is_mem_size(arg_type)) {

	} else if (arg_type_is_mem_size(arg_type)) {

		bool zero_size_allowed = (arg_type == ARG_CONST_SIZE_OR_ZERO);

		bool zero_size_allowed = (arg_type == ARG_CONST_SIZE_OR_ZERO);

tools/testing/selftests/bpf/test_verifier.c

+266 −0
Original line number Original line Diff line number Diff line
@@ -64,6 +64,7 @@ struct bpf_test { 
	struct bpf_insn	insns[MAX_INSNS];

	struct bpf_insn	insns[MAX_INSNS];

	int fixup_map1[MAX_FIXUPS];

	int fixup_map1[MAX_FIXUPS];

	int fixup_map2[MAX_FIXUPS];

	int fixup_map2[MAX_FIXUPS];

	int fixup_map3[MAX_FIXUPS];

	int fixup_prog[MAX_FIXUPS];

	int fixup_prog[MAX_FIXUPS];

	int fixup_map_in_map[MAX_FIXUPS];

	int fixup_map_in_map[MAX_FIXUPS];

	const char *errstr;

	const char *errstr;
@@ -88,6 +89,11 @@ struct test_val { 
	int foo[MAX_ENTRIES];

	int foo[MAX_ENTRIES];

};

};





struct other_val {

	long long foo;

	long long bar;

};



static struct bpf_test tests[] = {

static struct bpf_test tests[] = {

	{

	{

		"add+sub+mul",

		"add+sub+mul",
@@ -5593,6 +5599,257 @@ static struct bpf_test tests[] = { 
		.errstr = "R1 min value is negative",

		.errstr = "R1 min value is negative",

		.prog_type = BPF_PROG_TYPE_TRACEPOINT,

		.prog_type = BPF_PROG_TYPE_TRACEPOINT,

	},

	},

	{

		"map lookup helper access to map",

		.insns = {

			BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

			BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

			BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),

			BPF_LD_MAP_FD(BPF_REG_1, 0),

			BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),

			BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),

			BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),

			BPF_LD_MAP_FD(BPF_REG_1, 0),

			BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),

			BPF_EXIT_INSN(),

		},

		.fixup_map3 = { 3, 8 },

		.result = ACCEPT,

		.prog_type = BPF_PROG_TYPE_TRACEPOINT,

	},

	{

		"map update helper access to map",

		.insns = {

			BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

			BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

			BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),

			BPF_LD_MAP_FD(BPF_REG_1, 0),

			BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),

			BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),

			BPF_MOV64_IMM(BPF_REG_4, 0),

			BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),

			BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),

			BPF_LD_MAP_FD(BPF_REG_1, 0),

			BPF_EMIT_CALL(BPF_FUNC_map_update_elem),

			BPF_EXIT_INSN(),

		},

		.fixup_map3 = { 3, 10 },

		.result = ACCEPT,

		.prog_type = BPF_PROG_TYPE_TRACEPOINT,

	},

	{

		"map update helper access to map: wrong size",

		.insns = {

			BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

			BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

			BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),

			BPF_LD_MAP_FD(BPF_REG_1, 0),

			BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),

			BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),

			BPF_MOV64_IMM(BPF_REG_4, 0),

			BPF_MOV64_REG(BPF_REG_3, BPF_REG_0),

			BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),

			BPF_LD_MAP_FD(BPF_REG_1, 0),

			BPF_EMIT_CALL(BPF_FUNC_map_update_elem),

			BPF_EXIT_INSN(),

		},

		.fixup_map1 = { 3 },

		.fixup_map3 = { 10 },

		.result = REJECT,

		.errstr = "invalid access to map value, value_size=8 off=0 size=16",

		.prog_type = BPF_PROG_TYPE_TRACEPOINT,

	},

	{

		"map helper access to adjusted map (via const imm)",

		.insns = {

			BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

			BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

			BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),

			BPF_LD_MAP_FD(BPF_REG_1, 0),

			BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),

			BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),

			BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),

			BPF_ALU64_IMM(BPF_ADD, BPF_REG_2,

				      offsetof(struct other_val, bar)),

			BPF_LD_MAP_FD(BPF_REG_1, 0),

			BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),

			BPF_EXIT_INSN(),

		},

		.fixup_map3 = { 3, 9 },

		.result = ACCEPT,

		.prog_type = BPF_PROG_TYPE_TRACEPOINT,

	},

	{

		"map helper access to adjusted map (via const imm): out-of-bound 1",

		.insns = {

			BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

			BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

			BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),

			BPF_LD_MAP_FD(BPF_REG_1, 0),

			BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),

			BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),

			BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),

			BPF_ALU64_IMM(BPF_ADD, BPF_REG_2,

				      sizeof(struct other_val) - 4),

			BPF_LD_MAP_FD(BPF_REG_1, 0),

			BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),

			BPF_EXIT_INSN(),

		},

		.fixup_map3 = { 3, 9 },

		.result = REJECT,

		.errstr = "invalid access to map value, value_size=16 off=12 size=8",

		.prog_type = BPF_PROG_TYPE_TRACEPOINT,

	},

	{

		"map helper access to adjusted map (via const imm): out-of-bound 2",

		.insns = {

			BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

			BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

			BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),

			BPF_LD_MAP_FD(BPF_REG_1, 0),

			BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),

			BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),

			BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),

			BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -4),

			BPF_LD_MAP_FD(BPF_REG_1, 0),

			BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),

			BPF_EXIT_INSN(),

		},

		.fixup_map3 = { 3, 9 },

		.result = REJECT,

		.errstr = "invalid access to map value, value_size=16 off=-4 size=8",

		.prog_type = BPF_PROG_TYPE_TRACEPOINT,

	},

	{

		"map helper access to adjusted map (via const reg)",

		.insns = {

			BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

			BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

			BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),

			BPF_LD_MAP_FD(BPF_REG_1, 0),

			BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),

			BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),

			BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),

			BPF_MOV64_IMM(BPF_REG_3,

				      offsetof(struct other_val, bar)),

			BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),

			BPF_LD_MAP_FD(BPF_REG_1, 0),

			BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),

			BPF_EXIT_INSN(),

		},

		.fixup_map3 = { 3, 10 },

		.result = ACCEPT,

		.prog_type = BPF_PROG_TYPE_TRACEPOINT,

	},

	{

		"map helper access to adjusted map (via const reg): out-of-bound 1",

		.insns = {

			BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

			BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

			BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),

			BPF_LD_MAP_FD(BPF_REG_1, 0),

			BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),

			BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),

			BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),

			BPF_MOV64_IMM(BPF_REG_3,

				      sizeof(struct other_val) - 4),

			BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),

			BPF_LD_MAP_FD(BPF_REG_1, 0),

			BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),

			BPF_EXIT_INSN(),

		},

		.fixup_map3 = { 3, 10 },

		.result = REJECT,

		.errstr = "invalid access to map value, value_size=16 off=12 size=8",

		.prog_type = BPF_PROG_TYPE_TRACEPOINT,

	},

	{

		"map helper access to adjusted map (via const reg): out-of-bound 2",

		.insns = {

			BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

			BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

			BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),

			BPF_LD_MAP_FD(BPF_REG_1, 0),

			BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),

			BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),

			BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),

			BPF_MOV64_IMM(BPF_REG_3, -4),

			BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),

			BPF_LD_MAP_FD(BPF_REG_1, 0),

			BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),

			BPF_EXIT_INSN(),

		},

		.fixup_map3 = { 3, 10 },

		.result = REJECT,

		.errstr = "invalid access to map value, value_size=16 off=-4 size=8",

		.prog_type = BPF_PROG_TYPE_TRACEPOINT,

	},

	{

		"map helper access to adjusted map (via variable)",

		.insns = {

			BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

			BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

			BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),

			BPF_LD_MAP_FD(BPF_REG_1, 0),

			BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),

			BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),

			BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),

			BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),

			BPF_JMP_IMM(BPF_JGT, BPF_REG_3,

				    offsetof(struct other_val, bar), 4),

			BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),

			BPF_LD_MAP_FD(BPF_REG_1, 0),

			BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),

			BPF_EXIT_INSN(),

		},

		.fixup_map3 = { 3, 11 },

		.result = ACCEPT,

		.prog_type = BPF_PROG_TYPE_TRACEPOINT,

	},

	{

		"map helper access to adjusted map (via variable): no max check",

		.insns = {

			BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

			BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

			BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),

			BPF_LD_MAP_FD(BPF_REG_1, 0),

			BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),

			BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),

			BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),

			BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),

			BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),

			BPF_LD_MAP_FD(BPF_REG_1, 0),

			BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),

			BPF_EXIT_INSN(),

		},

		.fixup_map3 = { 3, 10 },

		.result = REJECT,

		.errstr = "R2 unbounded memory access, make sure to bounds check any array access into a map",

		.prog_type = BPF_PROG_TYPE_TRACEPOINT,

	},

	{

		"map helper access to adjusted map (via variable): wrong max check",

		.insns = {

			BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),

			BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),

			BPF_ST_MEM(BPF_DW, BPF_REG_2, 0, 0),

			BPF_LD_MAP_FD(BPF_REG_1, 0),

			BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),

			BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),

			BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),

			BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_0, 0),

			BPF_JMP_IMM(BPF_JGT, BPF_REG_3,

				    offsetof(struct other_val, bar) + 1, 4),

			BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_3),

			BPF_LD_MAP_FD(BPF_REG_1, 0),

			BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),

			BPF_EXIT_INSN(),

		},

		.fixup_map3 = { 3, 11 },

		.result = REJECT,

		.errstr = "invalid access to map value, value_size=16 off=9 size=8",

		.prog_type = BPF_PROG_TYPE_TRACEPOINT,

	},

	{

	{

		"map element value is preserved across register spilling",

		"map element value is preserved across register spilling",

		.insns = {

		.insns = {
@@ -11533,6 +11790,7 @@ static void do_test_fixup(struct bpf_test *test, struct bpf_insn *prog, 
{

{

	int *fixup_map1 = test->fixup_map1;

	int *fixup_map1 = test->fixup_map1;

	int *fixup_map2 = test->fixup_map2;

	int *fixup_map2 = test->fixup_map2;

	int *fixup_map3 = test->fixup_map3;

	int *fixup_prog = test->fixup_prog;

	int *fixup_prog = test->fixup_prog;

	int *fixup_map_in_map = test->fixup_map_in_map;

	int *fixup_map_in_map = test->fixup_map_in_map;
@@ -11556,6 +11814,14 @@ static void do_test_fixup(struct bpf_test *test, struct bpf_insn *prog, 
		} while (*fixup_map2);

		} while (*fixup_map2);

	}

	}





	if (*fixup_map3) {

		map_fds[1] = create_map(sizeof(struct other_val), 1);

		do {

			prog[*fixup_map3].imm = map_fds[1];

			fixup_map3++;

		} while (*fixup_map3);

	}



	if (*fixup_prog) {

	if (*fixup_prog) {

		map_fds[2] = create_prog_array();

		map_fds[2] = create_prog_array();

		do {

		do {

CRA Git | Maintained and supported by SUSTech CRA and CCSE