1. 01 Jul, 2024 7 commits
  2. 27 Jun, 2024 1 commit
  3. 26 Jun, 2024 5 commits
    • Alan Maguire's avatar
      libbpf: Fix clang compilation error in btf_relocate.c · 0f31c2c6
      Alan Maguire authored
      When building with clang for ARCH=i386, the following errors are
      observed:
      
        CC      kernel/bpf/btf_relocate.o
      ./tools/lib/bpf/btf_relocate.c:206:23: error: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Werror,-Wsingle-bit-bitfield-constant-conversion]
        206 |                 info[id].needs_size = true;
            |                                     ^ ~
      ./tools/lib/bpf/btf_relocate.c:256:25: error: implicit truncation from 'int' to a one-bit wide bit-field changes value from 1 to -1 [-Werror,-Wsingle-bit-bitfield-constant-conversion]
        256 |                         base_info.needs_size = true;
            |                                              ^ ~
      2 errors generated.
      
      The problem is we use 1-bit, 31-bit bitfields in a signed int.
      Changing to
      
      	bool needs_size: 1;
      	unsigned int size:31;
      
      ...resolves the error and pahole reports that 4 bytes are used
      for the underlying representation:
      
      $ pahole btf_name_info tools/lib/bpf/btf_relocate.o
      struct btf_name_info {
      	const char  *              name;                 /*     0     8 */
      	unsigned int               needs_size:1;         /*     8: 0  4 */
      	unsigned int               size:31;              /*     8: 1  4 */
      	__u32                      id;                   /*    12     4 */
      
      	/* size: 16, cachelines: 1, members: 4 */
      	/* last cacheline: 16 bytes */
      };
      Signed-off-by: default avatarAlan Maguire <alan.maguire@oracle.com>
      Signed-off-by: default avatarAndrii Nakryiko <andrii@kernel.org>
      Link: https://lore.kernel.org/bpf/20240624192903.854261-1-alan.maguire@oracle.com
      0f31c2c6
    • Ma Ke's avatar
      selftests/bpf: Don't close(-1) in serial_test_fexit_stress() · d07980f7
      Ma Ke authored
      Guard close() with extra link_fd[i] > 0 and fexit_fd[i] > 0
      check to prevent close(-1).
      Signed-off-by: default avatarMa Ke <make24@iscas.ac.cn>
      Signed-off-by: default avatarAndrii Nakryiko <andrii@kernel.org>
      Link: https://lore.kernel.org/bpf/20240623131753.2133829-1-make24@iscas.ac.cn
      d07980f7
    • Matt Bobrowski's avatar
      bpf: add new negative selftests to cover missing check_func_arg_reg_off() and reg->type check · aa293983
      Matt Bobrowski authored
      Add new negative selftests which are intended to cover the
      out-of-bounds memory access that could be performed on a
      CONST_PTR_TO_DYNPTR within functions taking a ARG_PTR_TO_DYNPTR |
      MEM_RDONLY as an argument, and acceptance of invalid register types
      i.e. PTR_TO_BTF_ID within functions taking a ARG_PTR_TO_DYNPTR |
      MEM_RDONLY.
      Reported-by: default avatarKumar Kartikeya Dwivedi <memxor@gmail.com>
      Acked-by: default avatarKumar Kartikeya Dwivedi <memxor@gmail.com>
      Acked-by: default avatarEduard Zingerman <eddyz87@gmail.com>
      Signed-off-by: default avatarMatt Bobrowski <mattbobrowski@google.com>
      Link: https://lore.kernel.org/r/20240625062857.92760-2-mattbobrowski@google.comSigned-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
      aa293983
    • Matt Bobrowski's avatar
      bpf: add missing check_func_arg_reg_off() to prevent out-of-bounds memory accesses · ec2b9a5e
      Matt Bobrowski authored
      Currently, it's possible to pass in a modified CONST_PTR_TO_DYNPTR to
      a global function as an argument. The adverse effects of this is that
      BPF helpers can continue to make use of this modified
      CONST_PTR_TO_DYNPTR from within the context of the global function,
      which can unintentionally result in out-of-bounds memory accesses and
      therefore compromise overall system stability i.e.
      
      [  244.157771] BUG: KASAN: slab-out-of-bounds in bpf_dynptr_data+0x137/0x140
      [  244.161345] Read of size 8 at addr ffff88810914be68 by task test_progs/302
      [  244.167151] CPU: 0 PID: 302 Comm: test_progs Tainted: G O E 6.10.0-rc3-00131-g66b58671 #533
      [  244.174318] Call Trace:
      [  244.175787]  <TASK>
      [  244.177356]  dump_stack_lvl+0x66/0xa0
      [  244.179531]  print_report+0xce/0x670
      [  244.182314]  ? __virt_addr_valid+0x200/0x3e0
      [  244.184908]  kasan_report+0xd7/0x110
      [  244.187408]  ? bpf_dynptr_data+0x137/0x140
      [  244.189714]  ? bpf_dynptr_data+0x137/0x140
      [  244.192020]  bpf_dynptr_data+0x137/0x140
      [  244.194264]  bpf_prog_b02a02fdd2bdc5fa_global_call_bpf_dynptr_data+0x22/0x26
      [  244.198044]  bpf_prog_b0fe7b9d7dc3abde_callback_adjust_bpf_dynptr_reg_off+0x1f/0x23
      [  244.202136]  bpf_user_ringbuf_drain+0x2c7/0x570
      [  244.204744]  ? 0xffffffffc0009e58
      [  244.206593]  ? __pfx_bpf_user_ringbuf_drain+0x10/0x10
      [  244.209795]  bpf_prog_33ab33f6a804ba2d_user_ringbuf_callback_const_ptr_to_dynptr_reg_off+0x47/0x4b
      [  244.215922]  bpf_trampoline_6442502480+0x43/0xe3
      [  244.218691]  __x64_sys_prlimit64+0x9/0xf0
      [  244.220912]  do_syscall_64+0xc1/0x1d0
      [  244.223043]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
      [  244.226458] RIP: 0033:0x7ffa3eb8f059
      [  244.228582] Code: 08 89 e8 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 8f 1d 0d 00 f7 d8 64 89 01 48
      [  244.241307] RSP: 002b:00007ffa3e9c6eb8 EFLAGS: 00000206 ORIG_RAX: 000000000000012e
      [  244.246474] RAX: ffffffffffffffda RBX: 00007ffa3e9c7cdc RCX: 00007ffa3eb8f059
      [  244.250478] RDX: 00007ffa3eb162b4 RSI: 0000000000000000 RDI: 00007ffa3e9c7fb0
      [  244.255396] RBP: 00007ffa3e9c6ed0 R08: 00007ffa3e9c76c0 R09: 0000000000000000
      [  244.260195] R10: 0000000000000000 R11: 0000000000000206 R12: ffffffffffffff80
      [  244.264201] R13: 000000000000001c R14: 00007ffc5d6b4260 R15: 00007ffa3e1c7000
      [  244.268303]  </TASK>
      
      Add a check_func_arg_reg_off() to the path in which the BPF verifier
      verifies the arguments of global function arguments, specifically
      those which take an argument of type ARG_PTR_TO_DYNPTR |
      MEM_RDONLY. Also, process_dynptr_func() doesn't appear to perform any
      explicit and strict type matching on the supplied register type, so
      let's also enforce that a register either type PTR_TO_STACK or
      CONST_PTR_TO_DYNPTR is by the caller.
      Reported-by: default avatarKumar Kartikeya Dwivedi <memxor@gmail.com>
      Acked-by: default avatarKumar Kartikeya Dwivedi <memxor@gmail.com>
      Acked-by: default avatarEduard Zingerman <eddyz87@gmail.com>
      Signed-off-by: default avatarMatt Bobrowski <mattbobrowski@google.com>
      Link: https://lore.kernel.org/r/20240625062857.92760-1-mattbobrowski@google.comSigned-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
      ec2b9a5e
    • Leon Hwang's avatar
      bpf: Fix tailcall cases in test_bpf · d65f3767
      Leon Hwang authored
      Since f663a03c ("bpf, x64: Remove tail call detection"),
      tail_call_reachable won't be detected in x86 JIT. And, tail_call_reachable
      is provided by verifier.
      
      Therefore, in test_bpf, the tail_call_reachable must be provided in test
      cases before running.
      
      Fix and test:
      
      [  174.828662] test_bpf: #0 Tail call leaf jited:1 170 PASS
      [  174.829574] test_bpf: #1 Tail call 2 jited:1 244 PASS
      [  174.830363] test_bpf: #2 Tail call 3 jited:1 296 PASS
      [  174.830924] test_bpf: #3 Tail call 4 jited:1 719 PASS
      [  174.831863] test_bpf: #4 Tail call load/store leaf jited:1 197 PASS
      [  174.832240] test_bpf: #5 Tail call load/store jited:1 326 PASS
      [  174.832240] test_bpf: #6 Tail call error path, max count reached jited:1 2214 PASS
      [  174.835713] test_bpf: #7 Tail call count preserved across function calls jited:1 609751 PASS
      [  175.446098] test_bpf: #8 Tail call error path, NULL target jited:1 472 PASS
      [  175.447597] test_bpf: #9 Tail call error path, index out of range jited:1 206 PASS
      [  175.448833] test_bpf: test_tail_calls: Summary: 10 PASSED, 0 FAILED, [10/10 JIT'ed]
      Reported-by: default avatarkernel test robot <oliver.sang@intel.com>
      Closes: https://lore.kernel.org/oe-lkp/202406251415.c51865bc-oliver.sang@intel.com
      Fixes: f663a03c ("bpf, x64: Remove tail call detection")
      Signed-off-by: default avatarLeon Hwang <hffilwlqm@gmail.com>
      Link: https://lore.kernel.org/r/20240625145351.40072-1-hffilwlqm@gmail.comSigned-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
      d65f3767
  4. 24 Jun, 2024 1 commit
  5. 23 Jun, 2024 2 commits
  6. 21 Jun, 2024 24 commits