bpf: correct slot_type marking logic to allow more stack slot sharing

commit 0bae2d4d62d523f06ff1a8e88ce38b45400acd28 upstream.

Verifier is supposed to support sharing stack slot allocated to ptr with
SCALAR_VALUE for privileged program. However this doesn't happen for some
cases.

The reason is verifier is not clearing slot_type STACK_SPILL for all bytes,
it only clears part of them, while verifier is using:

  slot_type[0] == STACK_SPILL

as a convention to check one slot is ptr type.

So, the consequence of partial clearing slot_type is verifier could treat a
partially overridden ptr slot, which should now be a SCALAR_VALUE slot,
still as ptr slot, and rejects some valid programs.

Before this patch, test_xdp_noinline.o under bpf selftests, bpf_lxc.o and
bpf_netdev.o under Cilium bpf repo, when built with -mattr=+alu32 are
rejected due to this issue. After this patch, they all accepted.

There is no processed insn number change before and after this patch on
Cilium bpf programs.

Reviewed-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Signed-off-by: Jiong Wang <jiong.wang@netronome.com>
Reviewed-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
[OP: adjusted context for 4.19]
Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index a5259ff30073bd783fa948a9276ddcec1edb7e6a..b6f008dcb30c1749dc4189f70801c5180e4356f2 100644 (file)
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -1039,6 +1039,10 @@ static int check_stack_write(struct bpf_verifier_env *env,
 
                /* regular write of data into stack destroys any spilled ptr */
                state->stack[spi].spilled_ptr.type = NOT_INIT;
+               /* Mark slots as STACK_MISC if they belonged to spilled ptr. */
+               if (state->stack[spi].slot_type[0] == STACK_SPILL)
+                       for (i = 0; i < BPF_REG_SIZE; i++)
+                               state->stack[spi].slot_type[i] = STACK_MISC;
 
                /* only mark the slot as written if all 8 bytes were written
                 * otherwise read propagation may incorrectly stop too soon
@@ -1056,6 +1060,7 @@ static int check_stack_write(struct bpf_verifier_env *env,
                    register_is_null(&cur->regs[value_regno]))
                        type = STACK_ZERO;
 
+               /* Mark slots affected by this stack write. */
                for (i = 0; i < size; i++)
                        state->stack[spi].slot_type[(slot - i) % BPF_REG_SIZE] =
                                type;

diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c
index c7d17781dbfee1a1a362f951b5dfc0974305bf84..6b9ed915c6b04777040973d4e0941039b0289296 100644 (file)
--- a/tools/testing/selftests/bpf/test_verifier.c
+++ b/tools/testing/selftests/bpf/test_verifier.c
@@ -956,15 +956,45 @@ static struct bpf_test tests[] = {
                        BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
                        /* mess up with R1 pointer on stack */
                        BPF_ST_MEM(BPF_B, BPF_REG_10, -7, 0x23),
-                       /* fill back into R0 should fail */
+                       /* fill back into R0 is fine for priv.
+                        * R0 now becomes SCALAR_VALUE.
+                        */
                        BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
+                       /* Load from R0 should fail. */
+                       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_0, 8),
                        BPF_EXIT_INSN(),
                },
                .errstr_unpriv = "attempt to corrupt spilled",
-               .errstr = "corrupted spill",
+               .errstr = "R0 invalid mem access 'inv",
                .result = REJECT,
                .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS,
        },
+       {
+               "check corrupted spill/fill, LSB",
+               .insns = {
+                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
+                       BPF_ST_MEM(BPF_H, BPF_REG_10, -8, 0xcafe),
+                       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
+                       BPF_EXIT_INSN(),
+               },
+               .errstr_unpriv = "attempt to corrupt spilled",
+               .result_unpriv = REJECT,
+               .result = ACCEPT,
+               .retval = POINTER_VALUE,
+       },
+       {
+               "check corrupted spill/fill, MSB",
+               .insns = {
+                       BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_1, -8),
+                       BPF_ST_MEM(BPF_W, BPF_REG_10, -4, 0x12345678),
+                       BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8),
+                       BPF_EXIT_INSN(),
+               },
+               .errstr_unpriv = "attempt to corrupt spilled",
+               .result_unpriv = REJECT,
+               .result = ACCEPT,
+               .retval = POINTER_VALUE,
+       },
        {
                "invalid src register in STX",
                .insns = {