Commit c3969de8 authored by Alexei Starovoitov's avatar Alexei Starovoitov
Browse files

Merge branch 'variable-stack-access' 



Andrey Ignatov says:

====================
The patch set adds support for stack access with variable offset from helpers.

Patch 1 is the main patch in the set and provides more details.
Patch 2 adds selftests for new functionality.
====================

Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parents dd399ac9 8ff80e96

kernel/bpf/verifier.c

+54 −21
Original line number Diff line number Diff line
@@ -2157,6 +2157,29 @@ static int check_xadd(struct bpf_verifier_env *env, int insn_idx, struct bpf_ins 
				BPF_SIZE(insn->code), BPF_WRITE, -1, true);

}



static int __check_stack_boundary(struct bpf_verifier_env *env, u32 regno,

				  int off, int access_size,

				  bool zero_size_allowed)

{

	struct bpf_reg_state *reg = reg_state(env, regno);



	if (off >= 0 || off < -MAX_BPF_STACK || off + access_size > 0 ||

	    access_size < 0 || (access_size == 0 && !zero_size_allowed)) {

		if (tnum_is_const(reg->var_off)) {

			verbose(env, "invalid stack type R%d off=%d access_size=%d\n",

				regno, off, access_size);

		} else {

			char tn_buf[48];



			tnum_strn(tn_buf, sizeof(tn_buf), reg->var_off);

			verbose(env, "invalid stack type R%d var_off=%s access_size=%d\n",

				regno, tn_buf, access_size);

		}

		return -EACCES;

	}

	return 0;

}



/* when register 'regno' is passed into function that will read 'access_size'

 * bytes from that pointer, make sure that it's within stack boundary

 * and all elements of stack are initialized.
@@ -2169,7 +2192,7 @@ static int check_stack_boundary(struct bpf_verifier_env *env, int regno, 
{

	struct bpf_reg_state *reg = reg_state(env, regno);

	struct bpf_func_state *state = func(env, reg);

	int off, i, slot, spi;

	int err, min_off, max_off, i, slot, spi;



	if (reg->type != PTR_TO_STACK) {

		/* Allow zero-byte read from NULL, regardless of pointer type */
@@ -2183,21 +2206,23 @@ static int check_stack_boundary(struct bpf_verifier_env *env, int regno, 
		return -EACCES;

	}



	/* Only allow fixed-offset stack reads */

	if (!tnum_is_const(reg->var_off)) {

		char tn_buf[48];



		tnum_strn(tn_buf, sizeof(tn_buf), reg->var_off);

		verbose(env, "invalid variable stack read R%d var_off=%s\n",

			regno, tn_buf);

		return -EACCES;

	}

	off = reg->off + reg->var_off.value;

	if (off >= 0 || off < -MAX_BPF_STACK || off + access_size > 0 ||

	    access_size < 0 || (access_size == 0 && !zero_size_allowed)) {

		verbose(env, "invalid stack type R%d off=%d access_size=%d\n",

			regno, off, access_size);

		return -EACCES;

	if (tnum_is_const(reg->var_off)) {

		min_off = max_off = reg->var_off.value + reg->off;

		err = __check_stack_boundary(env, regno, min_off, access_size,

					     zero_size_allowed);

		if (err)

			return err;

	} else {

		min_off = reg->smin_value + reg->off;

		max_off = reg->umax_value + reg->off;

		err = __check_stack_boundary(env, regno, min_off, access_size,

					     zero_size_allowed);

		if (err)

			return err;

		err = __check_stack_boundary(env, regno, max_off, access_size,

					     zero_size_allowed);

		if (err)

			return err;

	}



	if (meta && meta->raw_mode) {
@@ -2206,10 +2231,10 @@ static int check_stack_boundary(struct bpf_verifier_env *env, int regno, 
		return 0;

	}



	for (i = 0; i < access_size; i++) {

	for (i = min_off; i < max_off + access_size; i++) {

		u8 *stype;



		slot = -(off + i) - 1;

		slot = -i - 1;

		spi = slot / BPF_REG_SIZE;

		if (state->allocated_stack <= slot)

			goto err;
@@ -2222,8 +2247,16 @@ static int check_stack_boundary(struct bpf_verifier_env *env, int regno, 
			goto mark;

		}

err:

		if (tnum_is_const(reg->var_off)) {

			verbose(env, "invalid indirect read from stack off %d+%d size %d\n",

			off, i, access_size);

				min_off, i - min_off, access_size);

		} else {

			char tn_buf[48];



			tnum_strn(tn_buf, sizeof(tn_buf), reg->var_off);

			verbose(env, "invalid indirect read from stack var_off %s+%d size %d\n",

				tn_buf, i - min_off, access_size);

		}

		return -EACCES;

mark:

		/* reading any byte out of 8-byte 'spill_slot' will cause
@@ -2232,7 +2265,7 @@ mark: 
		mark_reg_read(env, &state->stack[spi].spilled_ptr,

			      state->stack[spi].spilled_ptr.parent);

	}

	return update_stack_depth(env, state, off);

	return update_stack_depth(env, state, min_off);

}



static int check_helper_mem_access(struct bpf_verifier_env *env, int regno,

tools/testing/selftests/bpf/verifier/var_off.c

+77 −2
Original line number Diff line number Diff line
@@ -40,7 +40,7 @@ 
	.prog_type = BPF_PROG_TYPE_LWT_IN,

},

{

	"indirect variable-offset stack access",

	"indirect variable-offset stack access, out of bound",

	.insns = {

	/* Fill the top 8 bytes of the stack */

	BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
@@ -60,7 +60,82 @@ 
	BPF_EXIT_INSN(),

	},

	.fixup_map_hash_8b = { 5 },

	.errstr = "variable stack read R2",

	.errstr = "invalid stack type R2 var_off",

	.result = REJECT,

	.prog_type = BPF_PROG_TYPE_LWT_IN,

},

{

	"indirect variable-offset stack access, max_off+size > max_initialized",

	.insns = {

	/* Fill only the second from top 8 bytes of the stack. */

	BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, 0),

	/* Get an unknown value. */

	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),

	/* Make it small and 4-byte aligned. */

	BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 4),

	BPF_ALU64_IMM(BPF_SUB, BPF_REG_2, 16),

	/* Add it to fp.  We now have either fp-12 or fp-16, but we don't know

	 * which. fp-12 size 8 is partially uninitialized stack.

	 */

	BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_10),

	/* Dereference it indirectly. */

	BPF_LD_MAP_FD(BPF_REG_1, 0),

	BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),

	BPF_MOV64_IMM(BPF_REG_0, 0),

	BPF_EXIT_INSN(),

	},

	.fixup_map_hash_8b = { 5 },

	.errstr = "invalid indirect read from stack var_off",

	.result = REJECT,

	.prog_type = BPF_PROG_TYPE_LWT_IN,

},

{

	"indirect variable-offset stack access, min_off < min_initialized",

	.insns = {

	/* Fill only the top 8 bytes of the stack. */

	BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

	/* Get an unknown value */

	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),

	/* Make it small and 4-byte aligned. */

	BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 4),

	BPF_ALU64_IMM(BPF_SUB, BPF_REG_2, 16),

	/* Add it to fp.  We now have either fp-12 or fp-16, but we don't know

	 * which. fp-16 size 8 is partially uninitialized stack.

	 */

	BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_10),

	/* Dereference it indirectly. */

	BPF_LD_MAP_FD(BPF_REG_1, 0),

	BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),

	BPF_MOV64_IMM(BPF_REG_0, 0),

	BPF_EXIT_INSN(),

	},

	.fixup_map_hash_8b = { 5 },

	.errstr = "invalid indirect read from stack var_off",

	.result = REJECT,

	.prog_type = BPF_PROG_TYPE_LWT_IN,

},

{

	"indirect variable-offset stack access, ok",

	.insns = {

	/* Fill the top 16 bytes of the stack. */

	BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, 0),

	BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),

	/* Get an unknown value. */

	BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 0),

	/* Make it small and 4-byte aligned. */

	BPF_ALU64_IMM(BPF_AND, BPF_REG_2, 4),

	BPF_ALU64_IMM(BPF_SUB, BPF_REG_2, 16),

	/* Add it to fp.  We now have either fp-12 or fp-16, we don't know

	 * which, but either way it points to initialized stack.

	 */

	BPF_ALU64_REG(BPF_ADD, BPF_REG_2, BPF_REG_10),

	/* Dereference it indirectly. */

	BPF_LD_MAP_FD(BPF_REG_1, 0),

	BPF_EMIT_CALL(BPF_FUNC_map_lookup_elem),

	BPF_MOV64_IMM(BPF_REG_0, 0),

	BPF_EXIT_INSN(),

	},

	.fixup_map_hash_8b = { 6 },

	.result = ACCEPT,

	.prog_type = BPF_PROG_TYPE_LWT_IN,

},

CRA Git | Maintained and supported by SUSTech CRA and CCSE