2019-01-26 06:24:43 +07:00
|
|
|
{
|
|
|
|
|
"subtraction bounds (map value) variant 1",
|
|
|
|
|
.insns = {
|
|
|
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
|
|
|
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
|
|
|
|
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
|
|
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
|
|
|
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
|
|
|
|
|
BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
|
|
|
|
|
BPF_JMP_IMM(BPF_JGT, BPF_REG_1, 0xff, 7),
|
|
|
|
|
BPF_LDX_MEM(BPF_B, BPF_REG_3, BPF_REG_0, 1),
|
|
|
|
|
BPF_JMP_IMM(BPF_JGT, BPF_REG_3, 0xff, 5),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_3),
|
|
|
|
|
BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 56),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
|
|
|
|
|
BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
},
|
|
|
|
|
.fixup_map_hash_8b = { 3 },
|
|
|
|
|
.errstr = "R0 max value is outside of the array range",
|
|
|
|
|
.result = REJECT,
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"subtraction bounds (map value) variant 2",
|
|
|
|
|
.insns = {
|
|
|
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
|
|
|
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
|
|
|
|
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
|
|
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
|
|
|
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 8),
|
|
|
|
|
BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
|
|
|
|
|
BPF_JMP_IMM(BPF_JGT, BPF_REG_1, 0xff, 6),
|
|
|
|
|
BPF_LDX_MEM(BPF_B, BPF_REG_3, BPF_REG_0, 1),
|
|
|
|
|
BPF_JMP_IMM(BPF_JGT, BPF_REG_3, 0xff, 4),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, BPF_REG_1, BPF_REG_3),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
|
|
|
|
|
BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
},
|
|
|
|
|
.fixup_map_hash_8b = { 3 },
|
|
|
|
|
.errstr = "R0 min value is negative, either use unsigned index or do a if (index >=0) check.",
|
|
|
|
|
.errstr_unpriv = "R1 has unknown scalar with mixed signed bounds",
|
|
|
|
|
.result = REJECT,
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"check subtraction on pointers for unpriv",
|
|
|
|
|
.insns = {
|
|
|
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
|
|
|
BPF_LD_MAP_FD(BPF_REG_ARG1, 0),
|
|
|
|
|
BPF_MOV64_REG(BPF_REG_ARG2, BPF_REG_FP),
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_ARG2, -8),
|
|
|
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_ARG2, 0, 9),
|
|
|
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
|
|
|
|
|
BPF_MOV64_REG(BPF_REG_9, BPF_REG_FP),
|
|
|
|
|
BPF_ALU64_REG(BPF_SUB, BPF_REG_9, BPF_REG_0),
|
|
|
|
|
BPF_LD_MAP_FD(BPF_REG_ARG1, 0),
|
|
|
|
|
BPF_MOV64_REG(BPF_REG_ARG2, BPF_REG_FP),
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_ARG2, -8),
|
|
|
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_ARG2, 0, 0),
|
|
|
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
|
|
|
|
|
BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
BPF_STX_MEM(BPF_DW, BPF_REG_0, BPF_REG_9, 0),
|
|
|
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
},
|
|
|
|
|
.fixup_map_hash_8b = { 1, 9 },
|
|
|
|
|
.result = ACCEPT,
|
|
|
|
|
.result_unpriv = REJECT,
|
|
|
|
|
.errstr_unpriv = "R9 pointer -= pointer prohibited",
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"bounds check based on zero-extended MOV",
|
|
|
|
|
.insns = {
|
|
|
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
|
|
|
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
|
|
|
|
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
|
|
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
|
|
|
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
|
|
|
|
|
/* r2 = 0x0000'0000'ffff'ffff */
|
|
|
|
|
BPF_MOV32_IMM(BPF_REG_2, 0xffffffff),
|
|
|
|
|
/* r2 = 0 */
|
|
|
|
|
BPF_ALU64_IMM(BPF_RSH, BPF_REG_2, 32),
|
|
|
|
|
/* no-op */
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
|
|
|
|
|
/* access at offset 0 */
|
|
|
|
|
BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
|
|
|
|
|
/* exit */
|
|
|
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
},
|
|
|
|
|
.fixup_map_hash_8b = { 3 },
|
|
|
|
|
.result = ACCEPT
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"bounds check based on sign-extended MOV. test1",
|
|
|
|
|
.insns = {
|
|
|
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
|
|
|
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
|
|
|
|
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
|
|
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
|
|
|
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
|
|
|
|
|
/* r2 = 0xffff'ffff'ffff'ffff */
|
|
|
|
|
BPF_MOV64_IMM(BPF_REG_2, 0xffffffff),
|
|
|
|
|
/* r2 = 0xffff'ffff */
|
|
|
|
|
BPF_ALU64_IMM(BPF_RSH, BPF_REG_2, 32),
|
|
|
|
|
/* r0 = <oob pointer> */
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
|
|
|
|
|
/* access to OOB pointer */
|
|
|
|
|
BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
|
|
|
|
|
/* exit */
|
|
|
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
},
|
|
|
|
|
.fixup_map_hash_8b = { 3 },
|
|
|
|
|
.errstr = "map_value pointer and 4294967295",
|
|
|
|
|
.result = REJECT
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"bounds check based on sign-extended MOV. test2",
|
|
|
|
|
.insns = {
|
|
|
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
|
|
|
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
|
|
|
|
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
|
|
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
|
|
|
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
|
|
|
|
|
/* r2 = 0xffff'ffff'ffff'ffff */
|
|
|
|
|
BPF_MOV64_IMM(BPF_REG_2, 0xffffffff),
|
|
|
|
|
/* r2 = 0xfff'ffff */
|
|
|
|
|
BPF_ALU64_IMM(BPF_RSH, BPF_REG_2, 36),
|
|
|
|
|
/* r0 = <oob pointer> */
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_2),
|
|
|
|
|
/* access to OOB pointer */
|
|
|
|
|
BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
|
|
|
|
|
/* exit */
|
|
|
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
},
|
|
|
|
|
.fixup_map_hash_8b = { 3 },
|
|
|
|
|
.errstr = "R0 min value is outside of the array range",
|
|
|
|
|
.result = REJECT
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"bounds check based on reg_off + var_off + insn_off. test1",
|
|
|
|
|
.insns = {
|
|
|
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
|
|
|
|
|
offsetof(struct __sk_buff, mark)),
|
|
|
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
|
|
|
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
|
|
|
|
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
|
|
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
|
|
|
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
|
|
|
|
|
BPF_ALU64_IMM(BPF_AND, BPF_REG_6, 1),
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, (1 << 29) - 1),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_6),
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, (1 << 29) - 1),
|
|
|
|
|
BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 3),
|
|
|
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
},
|
|
|
|
|
.fixup_map_hash_8b = { 4 },
|
|
|
|
|
.errstr = "value_size=8 off=1073741825",
|
|
|
|
|
.result = REJECT,
|
|
|
|
|
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"bounds check based on reg_off + var_off + insn_off. test2",
|
|
|
|
|
.insns = {
|
|
|
|
|
BPF_LDX_MEM(BPF_W, BPF_REG_6, BPF_REG_1,
|
|
|
|
|
offsetof(struct __sk_buff, mark)),
|
|
|
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
|
|
|
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
|
|
|
|
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
|
|
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
|
|
|
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 4),
|
|
|
|
|
BPF_ALU64_IMM(BPF_AND, BPF_REG_6, 1),
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_6, (1 << 30) - 1),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_6),
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, (1 << 29) - 1),
|
|
|
|
|
BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 3),
|
|
|
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
},
|
|
|
|
|
.fixup_map_hash_8b = { 4 },
|
|
|
|
|
.errstr = "value 1073741823",
|
|
|
|
|
.result = REJECT,
|
|
|
|
|
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"bounds check after truncation of non-boundary-crossing range",
|
|
|
|
|
.insns = {
|
|
|
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
|
|
|
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
|
|
|
|
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
|
|
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
|
|
|
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
|
|
|
|
|
/* r1 = [0x00, 0xff] */
|
|
|
|
|
BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
|
|
|
|
|
BPF_MOV64_IMM(BPF_REG_2, 1),
|
|
|
|
|
/* r2 = 0x10'0000'0000 */
|
|
|
|
|
BPF_ALU64_IMM(BPF_LSH, BPF_REG_2, 36),
|
|
|
|
|
/* r1 = [0x10'0000'0000, 0x10'0000'00ff] */
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, BPF_REG_1, BPF_REG_2),
|
|
|
|
|
/* r1 = [0x10'7fff'ffff, 0x10'8000'00fe] */
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x7fffffff),
|
|
|
|
|
/* r1 = [0x00, 0xff] */
|
|
|
|
|
BPF_ALU32_IMM(BPF_SUB, BPF_REG_1, 0x7fffffff),
|
|
|
|
|
/* r1 = 0 */
|
|
|
|
|
BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
|
|
|
|
|
/* no-op */
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
|
|
|
|
|
/* access at offset 0 */
|
|
|
|
|
BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
|
|
|
|
|
/* exit */
|
|
|
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
},
|
|
|
|
|
.fixup_map_hash_8b = { 3 },
|
|
|
|
|
.result = ACCEPT
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"bounds check after truncation of boundary-crossing range (1)",
|
|
|
|
|
.insns = {
|
|
|
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
|
|
|
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
|
|
|
|
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
|
|
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
|
|
|
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
|
|
|
|
|
/* r1 = [0x00, 0xff] */
|
|
|
|
|
BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0xffffff80 >> 1),
|
|
|
|
|
/* r1 = [0xffff'ff80, 0x1'0000'007f] */
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0xffffff80 >> 1),
|
|
|
|
|
/* r1 = [0xffff'ff80, 0xffff'ffff] or
|
|
|
|
|
* [0x0000'0000, 0x0000'007f]
|
|
|
|
|
*/
|
|
|
|
|
BPF_ALU32_IMM(BPF_ADD, BPF_REG_1, 0),
|
|
|
|
|
BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 0xffffff80 >> 1),
|
|
|
|
|
/* r1 = [0x00, 0xff] or
|
|
|
|
|
* [0xffff'ffff'0000'0080, 0xffff'ffff'ffff'ffff]
|
|
|
|
|
*/
|
|
|
|
|
BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 0xffffff80 >> 1),
|
|
|
|
|
/* r1 = 0 or
|
|
|
|
|
* [0x00ff'ffff'ff00'0000, 0x00ff'ffff'ffff'ffff]
|
|
|
|
|
*/
|
|
|
|
|
BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
|
bpf: Test_verifier, #65 error message updates for trunc of boundary-cross
After changes to add update_reg_bounds after ALU ops and 32-bit bounds
tracking truncation of boundary crossing range will fail earlier and with
a different error message. Now the test error trace is the following
11: (17) r1 -= 2147483584
12: R0_w=map_value(id=0,off=0,ks=8,vs=8,imm=0)
R1_w=invP(id=0,smin_value=-2147483584,smax_value=63)
R10=fp0 fp-8_w=mmmmmmmm
12: (17) r1 -= 2147483584
13: R0_w=map_value(id=0,off=0,ks=8,vs=8,imm=0)
R1_w=invP(id=0,
umin_value=18446744069414584448,umax_value=18446744071562068095,
var_off=(0xffffffff00000000; 0xffffffff))
R10=fp0 fp-8_w=mmmmmmmm
13: (77) r1 >>= 8
14: R0_w=map_value(id=0,off=0,ks=8,vs=8,imm=0)
R1_w=invP(id=0,
umin_value=72057594021150720,umax_value=72057594029539328,
var_off=(0xffffffff000000; 0xffffff),
s32_min_value=-16777216,s32_max_value=-1,
u32_min_value=-16777216)
R10=fp0 fp-8_w=mmmmmmmm
14: (0f) r0 += r1
value 72057594021150720 makes map_value pointer be out of bounds
Because we have 'umin_value == umax_value' instead of previously
where 'umin_value != umax_value' we can now fail earlier noting
that pointer addition is out of bounds.
Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/158560428103.10843.6316594510312781186.stgit@john-Precision-5820-Tower
2020-03-31 04:38:01 +07:00
|
|
|
/* error on OOB pointer computation */
|
2019-01-26 06:24:43 +07:00
|
|
|
BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
|
|
|
|
|
/* exit */
|
|
|
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
},
|
|
|
|
|
.fixup_map_hash_8b = { 3 },
|
|
|
|
|
/* not actually fully unbounded, but the bound is very high */
|
bpf: Test_verifier, #65 error message updates for trunc of boundary-cross
After changes to add update_reg_bounds after ALU ops and 32-bit bounds
tracking truncation of boundary crossing range will fail earlier and with
a different error message. Now the test error trace is the following
11: (17) r1 -= 2147483584
12: R0_w=map_value(id=0,off=0,ks=8,vs=8,imm=0)
R1_w=invP(id=0,smin_value=-2147483584,smax_value=63)
R10=fp0 fp-8_w=mmmmmmmm
12: (17) r1 -= 2147483584
13: R0_w=map_value(id=0,off=0,ks=8,vs=8,imm=0)
R1_w=invP(id=0,
umin_value=18446744069414584448,umax_value=18446744071562068095,
var_off=(0xffffffff00000000; 0xffffffff))
R10=fp0 fp-8_w=mmmmmmmm
13: (77) r1 >>= 8
14: R0_w=map_value(id=0,off=0,ks=8,vs=8,imm=0)
R1_w=invP(id=0,
umin_value=72057594021150720,umax_value=72057594029539328,
var_off=(0xffffffff000000; 0xffffff),
s32_min_value=-16777216,s32_max_value=-1,
u32_min_value=-16777216)
R10=fp0 fp-8_w=mmmmmmmm
14: (0f) r0 += r1
value 72057594021150720 makes map_value pointer be out of bounds
Because we have 'umin_value == umax_value' instead of previously
where 'umin_value != umax_value' we can now fail earlier noting
that pointer addition is out of bounds.
Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/158560428103.10843.6316594510312781186.stgit@john-Precision-5820-Tower
2020-03-31 04:38:01 +07:00
|
|
|
.errstr = "value 72057594021150720 makes map_value pointer be out of bounds",
|
2019-01-26 06:24:43 +07:00
|
|
|
.result = REJECT
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"bounds check after truncation of boundary-crossing range (2)",
|
|
|
|
|
.insns = {
|
|
|
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
|
|
|
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
|
|
|
|
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
|
|
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
|
|
|
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 9),
|
|
|
|
|
/* r1 = [0x00, 0xff] */
|
|
|
|
|
BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0xffffff80 >> 1),
|
|
|
|
|
/* r1 = [0xffff'ff80, 0x1'0000'007f] */
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0xffffff80 >> 1),
|
|
|
|
|
/* r1 = [0xffff'ff80, 0xffff'ffff] or
|
|
|
|
|
* [0x0000'0000, 0x0000'007f]
|
|
|
|
|
* difference to previous test: truncation via MOV32
|
|
|
|
|
* instead of ALU32.
|
|
|
|
|
*/
|
|
|
|
|
BPF_MOV32_REG(BPF_REG_1, BPF_REG_1),
|
|
|
|
|
BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 0xffffff80 >> 1),
|
|
|
|
|
/* r1 = [0x00, 0xff] or
|
|
|
|
|
* [0xffff'ffff'0000'0080, 0xffff'ffff'ffff'ffff]
|
|
|
|
|
*/
|
|
|
|
|
BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 0xffffff80 >> 1),
|
|
|
|
|
/* r1 = 0 or
|
|
|
|
|
* [0x00ff'ffff'ff00'0000, 0x00ff'ffff'ffff'ffff]
|
|
|
|
|
*/
|
|
|
|
|
BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
|
bpf: Test_verifier, #65 error message updates for trunc of boundary-cross
After changes to add update_reg_bounds after ALU ops and 32-bit bounds
tracking truncation of boundary crossing range will fail earlier and with
a different error message. Now the test error trace is the following
11: (17) r1 -= 2147483584
12: R0_w=map_value(id=0,off=0,ks=8,vs=8,imm=0)
R1_w=invP(id=0,smin_value=-2147483584,smax_value=63)
R10=fp0 fp-8_w=mmmmmmmm
12: (17) r1 -= 2147483584
13: R0_w=map_value(id=0,off=0,ks=8,vs=8,imm=0)
R1_w=invP(id=0,
umin_value=18446744069414584448,umax_value=18446744071562068095,
var_off=(0xffffffff00000000; 0xffffffff))
R10=fp0 fp-8_w=mmmmmmmm
13: (77) r1 >>= 8
14: R0_w=map_value(id=0,off=0,ks=8,vs=8,imm=0)
R1_w=invP(id=0,
umin_value=72057594021150720,umax_value=72057594029539328,
var_off=(0xffffffff000000; 0xffffff),
s32_min_value=-16777216,s32_max_value=-1,
u32_min_value=-16777216)
R10=fp0 fp-8_w=mmmmmmmm
14: (0f) r0 += r1
value 72057594021150720 makes map_value pointer be out of bounds
Because we have 'umin_value == umax_value' instead of previously
where 'umin_value != umax_value' we can now fail earlier noting
that pointer addition is out of bounds.
Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/158560428103.10843.6316594510312781186.stgit@john-Precision-5820-Tower
2020-03-31 04:38:01 +07:00
|
|
|
/* error on OOB pointer computation */
|
2019-01-26 06:24:43 +07:00
|
|
|
BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
|
|
|
|
|
/* exit */
|
|
|
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
},
|
|
|
|
|
.fixup_map_hash_8b = { 3 },
|
|
|
|
|
/* not actually fully unbounded, but the bound is very high */
|
bpf: Test_verifier, #65 error message updates for trunc of boundary-cross
After changes to add update_reg_bounds after ALU ops and 32-bit bounds
tracking truncation of boundary crossing range will fail earlier and with
a different error message. Now the test error trace is the following
11: (17) r1 -= 2147483584
12: R0_w=map_value(id=0,off=0,ks=8,vs=8,imm=0)
R1_w=invP(id=0,smin_value=-2147483584,smax_value=63)
R10=fp0 fp-8_w=mmmmmmmm
12: (17) r1 -= 2147483584
13: R0_w=map_value(id=0,off=0,ks=8,vs=8,imm=0)
R1_w=invP(id=0,
umin_value=18446744069414584448,umax_value=18446744071562068095,
var_off=(0xffffffff00000000; 0xffffffff))
R10=fp0 fp-8_w=mmmmmmmm
13: (77) r1 >>= 8
14: R0_w=map_value(id=0,off=0,ks=8,vs=8,imm=0)
R1_w=invP(id=0,
umin_value=72057594021150720,umax_value=72057594029539328,
var_off=(0xffffffff000000; 0xffffff),
s32_min_value=-16777216,s32_max_value=-1,
u32_min_value=-16777216)
R10=fp0 fp-8_w=mmmmmmmm
14: (0f) r0 += r1
value 72057594021150720 makes map_value pointer be out of bounds
Because we have 'umin_value == umax_value' instead of previously
where 'umin_value != umax_value' we can now fail earlier noting
that pointer addition is out of bounds.
Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/158560428103.10843.6316594510312781186.stgit@john-Precision-5820-Tower
2020-03-31 04:38:01 +07:00
|
|
|
.errstr = "value 72057594021150720 makes map_value pointer be out of bounds",
|
2019-01-26 06:24:43 +07:00
|
|
|
.result = REJECT
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"bounds check after wrapping 32-bit addition",
|
|
|
|
|
.insns = {
|
|
|
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
|
|
|
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
|
|
|
|
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
|
|
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
|
|
|
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 5),
|
|
|
|
|
/* r1 = 0x7fff'ffff */
|
|
|
|
|
BPF_MOV64_IMM(BPF_REG_1, 0x7fffffff),
|
|
|
|
|
/* r1 = 0xffff'fffe */
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 0x7fffffff),
|
|
|
|
|
/* r1 = 0 */
|
|
|
|
|
BPF_ALU32_IMM(BPF_ADD, BPF_REG_1, 2),
|
|
|
|
|
/* no-op */
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
|
|
|
|
|
/* access at offset 0 */
|
|
|
|
|
BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
|
|
|
|
|
/* exit */
|
|
|
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
},
|
|
|
|
|
.fixup_map_hash_8b = { 3 },
|
|
|
|
|
.result = ACCEPT
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"bounds check after shift with oversized count operand",
|
|
|
|
|
.insns = {
|
|
|
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
|
|
|
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
|
|
|
|
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
|
|
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
|
|
|
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
|
|
|
|
|
BPF_MOV64_IMM(BPF_REG_2, 32),
|
|
|
|
|
BPF_MOV64_IMM(BPF_REG_1, 1),
|
|
|
|
|
/* r1 = (u32)1 << (u32)32 = ? */
|
|
|
|
|
BPF_ALU32_REG(BPF_LSH, BPF_REG_1, BPF_REG_2),
|
|
|
|
|
/* r1 = [0x0000, 0xffff] */
|
|
|
|
|
BPF_ALU64_IMM(BPF_AND, BPF_REG_1, 0xffff),
|
|
|
|
|
/* computes unknown pointer, potentially OOB */
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
|
|
|
|
|
/* potentially OOB access */
|
|
|
|
|
BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
|
|
|
|
|
/* exit */
|
|
|
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
},
|
|
|
|
|
.fixup_map_hash_8b = { 3 },
|
|
|
|
|
.errstr = "R0 max value is outside of the array range",
|
|
|
|
|
.result = REJECT
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"bounds check after right shift of maybe-negative number",
|
|
|
|
|
.insns = {
|
|
|
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
|
|
|
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
|
|
|
|
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
|
|
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
|
|
|
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
|
|
|
|
|
/* r1 = [0x00, 0xff] */
|
|
|
|
|
BPF_LDX_MEM(BPF_B, BPF_REG_1, BPF_REG_0, 0),
|
|
|
|
|
/* r1 = [-0x01, 0xfe] */
|
|
|
|
|
BPF_ALU64_IMM(BPF_SUB, BPF_REG_1, 1),
|
|
|
|
|
/* r1 = 0 or 0xff'ffff'ffff'ffff */
|
|
|
|
|
BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
|
|
|
|
|
/* r1 = 0 or 0xffff'ffff'ffff */
|
|
|
|
|
BPF_ALU64_IMM(BPF_RSH, BPF_REG_1, 8),
|
|
|
|
|
/* computes unknown pointer, potentially OOB */
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
|
|
|
|
|
/* potentially OOB access */
|
|
|
|
|
BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_0, 0),
|
|
|
|
|
/* exit */
|
|
|
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
},
|
|
|
|
|
.fixup_map_hash_8b = { 3 },
|
|
|
|
|
.errstr = "R0 unbounded memory access",
|
|
|
|
|
.result = REJECT
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"bounds check after 32-bit right shift with 64-bit input",
|
|
|
|
|
.insns = {
|
|
|
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
|
|
|
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
|
|
|
|
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
|
|
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
|
|
|
|
|
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 6),
|
|
|
|
|
/* r1 = 2 */
|
|
|
|
|
BPF_MOV64_IMM(BPF_REG_1, 2),
|
|
|
|
|
/* r1 = 1<<32 */
|
|
|
|
|
BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 31),
|
|
|
|
|
/* r1 = 0 (NOT 2!) */
|
|
|
|
|
BPF_ALU32_IMM(BPF_RSH, BPF_REG_1, 31),
|
|
|
|
|
/* r1 = 0xffff'fffe (NOT 0!) */
|
|
|
|
|
BPF_ALU32_IMM(BPF_SUB, BPF_REG_1, 2),
|
bpf: Test_verifier, #70 error message updates for 32-bit right shift
After changes to add update_reg_bounds after ALU ops and adding ALU32
bounds tracking the error message is changed in the 32-bit right shift
tests.
Test "#70/u bounds check after 32-bit right shift with 64-bit input FAIL"
now fails with,
Unexpected error message!
EXP: R0 invalid mem access
RES: func#0 @0
7: (b7) r1 = 2
8: R0_w=map_value(id=0,off=0,ks=8,vs=8,imm=0) R1_w=invP2 R10=fp0 fp-8_w=mmmmmmmm
8: (67) r1 <<= 31
9: R0_w=map_value(id=0,off=0,ks=8,vs=8,imm=0) R1_w=invP4294967296 R10=fp0 fp-8_w=mmmmmmmm
9: (74) w1 >>= 31
10: R0_w=map_value(id=0,off=0,ks=8,vs=8,imm=0) R1_w=invP0 R10=fp0 fp-8_w=mmmmmmmm
10: (14) w1 -= 2
11: R0_w=map_value(id=0,off=0,ks=8,vs=8,imm=0) R1_w=invP4294967294 R10=fp0 fp-8_w=mmmmmmmm
11: (0f) r0 += r1
math between map_value pointer and 4294967294 is not allowed
And test "#70/p bounds check after 32-bit right shift with 64-bit input
FAIL" now fails with,
Unexpected error message!
EXP: R0 invalid mem access
RES: func#0 @0
7: (b7) r1 = 2
8: R0_w=map_value(id=0,off=0,ks=8,vs=8,imm=0) R1_w=inv2 R10=fp0 fp-8_w=mmmmmmmm
8: (67) r1 <<= 31
9: R0_w=map_value(id=0,off=0,ks=8,vs=8,imm=0) R1_w=inv4294967296 R10=fp0 fp-8_w=mmmmmmmm
9: (74) w1 >>= 31
10: R0_w=map_value(id=0,off=0,ks=8,vs=8,imm=0) R1_w=inv0 R10=fp0 fp-8_w=mmmmmmmm
10: (14) w1 -= 2
11: R0_w=map_value(id=0,off=0,ks=8,vs=8,imm=0) R1_w=inv4294967294 R10=fp0 fp-8_w=mmmmmmmm
11: (0f) r0 += r1
last_idx 11 first_idx 0
regs=2 stack=0 before 10: (14) w1 -= 2
regs=2 stack=0 before 9: (74) w1 >>= 31
regs=2 stack=0 before 8: (67) r1 <<= 31
regs=2 stack=0 before 7: (b7) r1 = 2
math between map_value pointer and 4294967294 is not allowed
Before this series we did not trip the "math between map_value pointer..."
error because check_reg_sane_offset is never called in
adjust_ptr_min_max_vals(). Instead we have a register state that looks
like this at line 11*,
11: R0_w=map_value(id=0,off=0,ks=8,vs=8,
smin_value=0,smax_value=0,
umin_value=0,umax_value=0,
var_off=(0x0; 0x0))
R1_w=invP(id=0,
smin_value=0,smax_value=4294967295,
umin_value=0,umax_value=4294967295,
var_off=(0xfffffffe; 0x0))
R10=fp(id=0,off=0,
smin_value=0,smax_value=0,
umin_value=0,umax_value=0,
var_off=(0x0; 0x0)) fp-8_w=mmmmmmmm
11: (0f) r0 += r1
In R1 'smin_val != smax_val' yet we have a tnum_const as seen
by 'var_off(0xfffffffe; 0x0))' with a 0x0 mask. So we hit this check
in adjust_ptr_min_max_vals()
if ((known && (smin_val != smax_val || umin_val != umax_val)) ||
smin_val > smax_val || umin_val > umax_val) {
/* Taint dst register if offset had invalid bounds derived from
* e.g. dead branches.
*/
__mark_reg_unknown(env, dst_reg);
return 0;
}
So we don't throw an error here and instead only throw an error
later in the verification when the memory access is made.
The root cause in verifier without alu32 bounds tracking is having
'umin_value = 0' and 'umax_value = U64_MAX' from BPF_SUB which we set
when 'umin_value < umax_val' here,
if (dst_reg->umin_value < umax_val) {
/* Overflow possible, we know nothing */
dst_reg->umin_value = 0;
dst_reg->umax_value = U64_MAX;
} else { ...}
Later in adjust_calar_min_max_vals we previously did a
coerce_reg_to_size() which will clamp the U64_MAX to U32_MAX by
truncating to 32bits. But either way without a call to update_reg_bounds
the less precise bounds tracking will fall out of the alu op
verification.
After latest changes we now exit adjust_scalar_min_max_vals with the
more precise umin value, due to zero extension propogating bounds from
alu32 bounds into alu64 bounds and then calling update_reg_bounds.
This then causes the verifier to trigger an earlier error and we get
the error in the output above.
This patch updates tests to reflect new error message.
* I have a local patch to print entire verifier state regardless if we
believe it is a constant so we can get a full picture of the state.
Usually if tnum_is_const() then bounds are also smin=smax, etc. but
this is not always true and is a bit subtle. Being able to see these
states helps understand dataflow imo. Let me know if we want something
similar upstream.
Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/158507161475.15666.3061518385241144063.stgit@john-Precision-5820-Tower
2020-03-25 00:40:14 +07:00
|
|
|
/* error on computing OOB pointer */
|
2019-01-26 06:24:43 +07:00
|
|
|
BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
|
|
|
|
|
/* exit */
|
|
|
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
},
|
|
|
|
|
.fixup_map_hash_8b = { 3 },
|
bpf: Test_verifier, #70 error message updates for 32-bit right shift
After changes to add update_reg_bounds after ALU ops and adding ALU32
bounds tracking the error message is changed in the 32-bit right shift
tests.
Test "#70/u bounds check after 32-bit right shift with 64-bit input FAIL"
now fails with,
Unexpected error message!
EXP: R0 invalid mem access
RES: func#0 @0
7: (b7) r1 = 2
8: R0_w=map_value(id=0,off=0,ks=8,vs=8,imm=0) R1_w=invP2 R10=fp0 fp-8_w=mmmmmmmm
8: (67) r1 <<= 31
9: R0_w=map_value(id=0,off=0,ks=8,vs=8,imm=0) R1_w=invP4294967296 R10=fp0 fp-8_w=mmmmmmmm
9: (74) w1 >>= 31
10: R0_w=map_value(id=0,off=0,ks=8,vs=8,imm=0) R1_w=invP0 R10=fp0 fp-8_w=mmmmmmmm
10: (14) w1 -= 2
11: R0_w=map_value(id=0,off=0,ks=8,vs=8,imm=0) R1_w=invP4294967294 R10=fp0 fp-8_w=mmmmmmmm
11: (0f) r0 += r1
math between map_value pointer and 4294967294 is not allowed
And test "#70/p bounds check after 32-bit right shift with 64-bit input
FAIL" now fails with,
Unexpected error message!
EXP: R0 invalid mem access
RES: func#0 @0
7: (b7) r1 = 2
8: R0_w=map_value(id=0,off=0,ks=8,vs=8,imm=0) R1_w=inv2 R10=fp0 fp-8_w=mmmmmmmm
8: (67) r1 <<= 31
9: R0_w=map_value(id=0,off=0,ks=8,vs=8,imm=0) R1_w=inv4294967296 R10=fp0 fp-8_w=mmmmmmmm
9: (74) w1 >>= 31
10: R0_w=map_value(id=0,off=0,ks=8,vs=8,imm=0) R1_w=inv0 R10=fp0 fp-8_w=mmmmmmmm
10: (14) w1 -= 2
11: R0_w=map_value(id=0,off=0,ks=8,vs=8,imm=0) R1_w=inv4294967294 R10=fp0 fp-8_w=mmmmmmmm
11: (0f) r0 += r1
last_idx 11 first_idx 0
regs=2 stack=0 before 10: (14) w1 -= 2
regs=2 stack=0 before 9: (74) w1 >>= 31
regs=2 stack=0 before 8: (67) r1 <<= 31
regs=2 stack=0 before 7: (b7) r1 = 2
math between map_value pointer and 4294967294 is not allowed
Before this series we did not trip the "math between map_value pointer..."
error because check_reg_sane_offset is never called in
adjust_ptr_min_max_vals(). Instead we have a register state that looks
like this at line 11*,
11: R0_w=map_value(id=0,off=0,ks=8,vs=8,
smin_value=0,smax_value=0,
umin_value=0,umax_value=0,
var_off=(0x0; 0x0))
R1_w=invP(id=0,
smin_value=0,smax_value=4294967295,
umin_value=0,umax_value=4294967295,
var_off=(0xfffffffe; 0x0))
R10=fp(id=0,off=0,
smin_value=0,smax_value=0,
umin_value=0,umax_value=0,
var_off=(0x0; 0x0)) fp-8_w=mmmmmmmm
11: (0f) r0 += r1
In R1 'smin_val != smax_val' yet we have a tnum_const as seen
by 'var_off(0xfffffffe; 0x0))' with a 0x0 mask. So we hit this check
in adjust_ptr_min_max_vals()
if ((known && (smin_val != smax_val || umin_val != umax_val)) ||
smin_val > smax_val || umin_val > umax_val) {
/* Taint dst register if offset had invalid bounds derived from
* e.g. dead branches.
*/
__mark_reg_unknown(env, dst_reg);
return 0;
}
So we don't throw an error here and instead only throw an error
later in the verification when the memory access is made.
The root cause in verifier without alu32 bounds tracking is having
'umin_value = 0' and 'umax_value = U64_MAX' from BPF_SUB which we set
when 'umin_value < umax_val' here,
if (dst_reg->umin_value < umax_val) {
/* Overflow possible, we know nothing */
dst_reg->umin_value = 0;
dst_reg->umax_value = U64_MAX;
} else { ...}
Later in adjust_calar_min_max_vals we previously did a
coerce_reg_to_size() which will clamp the U64_MAX to U32_MAX by
truncating to 32bits. But either way without a call to update_reg_bounds
the less precise bounds tracking will fall out of the alu op
verification.
After latest changes we now exit adjust_scalar_min_max_vals with the
more precise umin value, due to zero extension propogating bounds from
alu32 bounds into alu64 bounds and then calling update_reg_bounds.
This then causes the verifier to trigger an earlier error and we get
the error in the output above.
This patch updates tests to reflect new error message.
* I have a local patch to print entire verifier state regardless if we
believe it is a constant so we can get a full picture of the state.
Usually if tnum_is_const() then bounds are also smin=smax, etc. but
this is not always true and is a bit subtle. Being able to see these
states helps understand dataflow imo. Let me know if we want something
similar upstream.
Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/158507161475.15666.3061518385241144063.stgit@john-Precision-5820-Tower
2020-03-25 00:40:14 +07:00
|
|
|
.errstr = "math between map_value pointer and 4294967294 is not allowed",
|
2019-01-26 06:24:43 +07:00
|
|
|
.result = REJECT,
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"bounds check map access with off+size signed 32bit overflow. test1",
|
|
|
|
|
.insns = {
|
|
|
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
|
|
|
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
|
|
|
|
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
|
|
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
|
|
|
|
|
BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x7ffffffe),
|
|
|
|
|
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
|
|
|
|
|
BPF_JMP_A(0),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
},
|
|
|
|
|
.fixup_map_hash_8b = { 3 },
|
|
|
|
|
.errstr = "map_value pointer and 2147483646",
|
|
|
|
|
.result = REJECT
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"bounds check map access with off+size signed 32bit overflow. test2",
|
|
|
|
|
.insns = {
|
|
|
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
|
|
|
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
|
|
|
|
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
|
|
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
|
|
|
|
|
BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x1fffffff),
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x1fffffff),
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 0x1fffffff),
|
|
|
|
|
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 0),
|
|
|
|
|
BPF_JMP_A(0),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
},
|
|
|
|
|
.fixup_map_hash_8b = { 3 },
|
|
|
|
|
.errstr = "pointer offset 1073741822",
|
|
|
|
|
.errstr_unpriv = "R0 pointer arithmetic of map value goes out of range",
|
|
|
|
|
.result = REJECT
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"bounds check map access with off+size signed 32bit overflow. test3",
|
|
|
|
|
.insns = {
|
|
|
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
|
|
|
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
|
|
|
|
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
|
|
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
|
|
|
|
|
BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
BPF_ALU64_IMM(BPF_SUB, BPF_REG_0, 0x1fffffff),
|
|
|
|
|
BPF_ALU64_IMM(BPF_SUB, BPF_REG_0, 0x1fffffff),
|
|
|
|
|
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 2),
|
|
|
|
|
BPF_JMP_A(0),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
},
|
|
|
|
|
.fixup_map_hash_8b = { 3 },
|
|
|
|
|
.errstr = "pointer offset -1073741822",
|
|
|
|
|
.errstr_unpriv = "R0 pointer arithmetic of map value goes out of range",
|
|
|
|
|
.result = REJECT
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"bounds check map access with off+size signed 32bit overflow. test4",
|
|
|
|
|
.insns = {
|
|
|
|
|
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
|
|
|
|
|
BPF_MOV64_REG(BPF_REG_2, BPF_REG_10),
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
|
|
|
|
|
BPF_LD_MAP_FD(BPF_REG_1, 0),
|
|
|
|
|
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_map_lookup_elem),
|
|
|
|
|
BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
BPF_MOV64_IMM(BPF_REG_1, 1000000),
|
|
|
|
|
BPF_ALU64_IMM(BPF_MUL, BPF_REG_1, 1000000),
|
|
|
|
|
BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
|
|
|
|
|
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 2),
|
|
|
|
|
BPF_JMP_A(0),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
},
|
|
|
|
|
.fixup_map_hash_8b = { 3 },
|
|
|
|
|
.errstr = "map_value pointer and 1000000000000",
|
|
|
|
|
.result = REJECT
|
|
|
|
|
},
|
2020-03-31 04:38:21 +07:00
|
|
|
{
|
2020-03-31 17:00:30 +07:00
|
|
|
"bounds check mixed 32bit and 64bit arithmetic. test1",
|
2020-03-31 04:38:21 +07:00
|
|
|
.insns = {
|
|
|
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
|
|
|
BPF_MOV64_IMM(BPF_REG_1, -1),
|
|
|
|
|
BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 32),
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1),
|
|
|
|
|
/* r1 = 0xffffFFFF00000001 */
|
|
|
|
|
BPF_JMP32_IMM(BPF_JGT, BPF_REG_1, 1, 3),
|
|
|
|
|
/* check ALU64 op keeps 32bit bounds */
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1),
|
|
|
|
|
BPF_JMP32_IMM(BPF_JGT, BPF_REG_1, 2, 1),
|
|
|
|
|
BPF_JMP_A(1),
|
|
|
|
|
/* invalid ldx if bounds are lost above */
|
|
|
|
|
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, -1),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
},
|
|
|
|
|
.result = ACCEPT
|
|
|
|
|
},
|
|
|
|
|
{
|
2020-03-31 17:00:30 +07:00
|
|
|
"bounds check mixed 32bit and 64bit arithmetic. test2",
|
2020-03-31 04:38:21 +07:00
|
|
|
.insns = {
|
|
|
|
|
BPF_MOV64_IMM(BPF_REG_0, 0),
|
|
|
|
|
BPF_MOV64_IMM(BPF_REG_1, -1),
|
|
|
|
|
BPF_ALU64_IMM(BPF_LSH, BPF_REG_1, 32),
|
|
|
|
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 1),
|
|
|
|
|
/* r1 = 0xffffFFFF00000001 */
|
|
|
|
|
BPF_MOV64_IMM(BPF_REG_2, 3),
|
|
|
|
|
/* r1 = 0x2 */
|
|
|
|
|
BPF_ALU32_IMM(BPF_ADD, BPF_REG_1, 1),
|
|
|
|
|
/* check ALU32 op zero extends 64bit bounds */
|
|
|
|
|
BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 1),
|
|
|
|
|
BPF_JMP_A(1),
|
|
|
|
|
/* invalid ldx if bounds are lost above */
|
|
|
|
|
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, -1),
|
|
|
|
|
BPF_EXIT_INSN(),
|
|
|
|
|
},
|
|
|
|
|
.result = ACCEPT
|
|
|
|
|
},
|