LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
* [PATCH] bpf: fix misaligned access for BPF_PROG_TYPE_PERF_EVENT program type on x86_32 platform
@ 2018-04-26  9:57 Wang YanQing
  2018-04-27 22:48 ` Alexei Starovoitov
  0 siblings, 1 reply; 6+ messages in thread
From: Wang YanQing @ 2018-04-26  9:57 UTC (permalink / raw)
  To: daniel; +Cc: ast, netdev, linux-kernel

All the testcases for BPF_PROG_TYPE_PERF_EVENT program type in
test_verifier(kselftest) report below errors on x86_32:
"
172/p unpriv: spill/fill of different pointers ldx FAIL
Unexpected error message!
0: (bf) r6 = r10
1: (07) r6 += -8
2: (15) if r1 == 0x0 goto pc+3
R1=ctx(id=0,off=0,imm=0) R6=fp-8,call_-1 R10=fp0,call_-1
3: (bf) r2 = r10
4: (07) r2 += -76
5: (7b) *(u64 *)(r6 +0) = r2
6: (55) if r1 != 0x0 goto pc+1
R1=ctx(id=0,off=0,imm=0) R2=fp-76,call_-1 R6=fp-8,call_-1 R10=fp0,call_-1 fp-8=fp
7: (7b) *(u64 *)(r6 +0) = r1
8: (79) r1 = *(u64 *)(r6 +0)
9: (79) r1 = *(u64 *)(r1 +68)
invalid bpf_context access off=68 size=8

378/p check bpf_perf_event_data->sample_period byte load permitted FAIL
Failed to load prog 'Permission denied'!
0: (b7) r0 = 0
1: (71) r0 = *(u8 *)(r1 +68)
invalid bpf_context access off=68 size=1

379/p check bpf_perf_event_data->sample_period half load permitted FAIL
Failed to load prog 'Permission denied'!
0: (b7) r0 = 0
1: (69) r0 = *(u16 *)(r1 +68)
invalid bpf_context access off=68 size=2

380/p check bpf_perf_event_data->sample_period word load permitted FAIL
Failed to load prog 'Permission denied'!
0: (b7) r0 = 0
1: (61) r0 = *(u32 *)(r1 +68)
invalid bpf_context access off=68 size=4

381/p check bpf_perf_event_data->sample_period dword load permitted FAIL
Failed to load prog 'Permission denied'!
0: (b7) r0 = 0
1: (79) r0 = *(u64 *)(r1 +68)
invalid bpf_context access off=68 size=8
"

This patch fix it, the fix isn't only necessary for x86_32, it will fix the
same problem for other platforms too, if their size of bpf_user_pt_regs_t
can't divide exactly into 8.

Signed-off-by: Wang YanQing <udknight@gmail.com>
---
 Hi all!
 After mainline accept this patch, then we need to submit a sync patch
 to update the tools/include/uapi/linux/bpf_perf_event.h.

 Thanks.

 include/uapi/linux/bpf_perf_event.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/uapi/linux/bpf_perf_event.h b/include/uapi/linux/bpf_perf_event.h
index eb1b9d2..ff4c092 100644
--- a/include/uapi/linux/bpf_perf_event.h
+++ b/include/uapi/linux/bpf_perf_event.h
@@ -12,7 +12,7 @@
 
 struct bpf_perf_event_data {
 	bpf_user_pt_regs_t regs;
-	__u64 sample_period;
+	__u64 sample_period __attribute__((aligned(8)));
 	__u64 addr;
 };
 
-- 
1.8.5.6.2.g3d8a54e.dirty

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: [PATCH] bpf: fix misaligned access for BPF_PROG_TYPE_PERF_EVENT program type on x86_32 platform
  2018-04-26  9:57 [PATCH] bpf: fix misaligned access for BPF_PROG_TYPE_PERF_EVENT program type on x86_32 platform Wang YanQing
@ 2018-04-27 22:48 ` Alexei Starovoitov
  2018-04-27 23:33   ` Daniel Borkmann
  0 siblings, 1 reply; 6+ messages in thread
From: Alexei Starovoitov @ 2018-04-27 22:48 UTC (permalink / raw)
  To: Wang YanQing, daniel, ast, netdev, linux-kernel

On Thu, Apr 26, 2018 at 05:57:49PM +0800, Wang YanQing wrote:
> All the testcases for BPF_PROG_TYPE_PERF_EVENT program type in
> test_verifier(kselftest) report below errors on x86_32:
> "
> 172/p unpriv: spill/fill of different pointers ldx FAIL
> Unexpected error message!
> 0: (bf) r6 = r10
> 1: (07) r6 += -8
> 2: (15) if r1 == 0x0 goto pc+3
> R1=ctx(id=0,off=0,imm=0) R6=fp-8,call_-1 R10=fp0,call_-1
> 3: (bf) r2 = r10
> 4: (07) r2 += -76
> 5: (7b) *(u64 *)(r6 +0) = r2
> 6: (55) if r1 != 0x0 goto pc+1
> R1=ctx(id=0,off=0,imm=0) R2=fp-76,call_-1 R6=fp-8,call_-1 R10=fp0,call_-1 fp-8=fp
> 7: (7b) *(u64 *)(r6 +0) = r1
> 8: (79) r1 = *(u64 *)(r6 +0)
> 9: (79) r1 = *(u64 *)(r1 +68)
> invalid bpf_context access off=68 size=8
> 
> 378/p check bpf_perf_event_data->sample_period byte load permitted FAIL
> Failed to load prog 'Permission denied'!
> 0: (b7) r0 = 0
> 1: (71) r0 = *(u8 *)(r1 +68)
> invalid bpf_context access off=68 size=1
> 
> 379/p check bpf_perf_event_data->sample_period half load permitted FAIL
> Failed to load prog 'Permission denied'!
> 0: (b7) r0 = 0
> 1: (69) r0 = *(u16 *)(r1 +68)
> invalid bpf_context access off=68 size=2
> 
> 380/p check bpf_perf_event_data->sample_period word load permitted FAIL
> Failed to load prog 'Permission denied'!
> 0: (b7) r0 = 0
> 1: (61) r0 = *(u32 *)(r1 +68)
> invalid bpf_context access off=68 size=4
> 
> 381/p check bpf_perf_event_data->sample_period dword load permitted FAIL
> Failed to load prog 'Permission denied'!
> 0: (b7) r0 = 0
> 1: (79) r0 = *(u64 *)(r1 +68)
> invalid bpf_context access off=68 size=8
> "
> 
> This patch fix it, the fix isn't only necessary for x86_32, it will fix the
> same problem for other platforms too, if their size of bpf_user_pt_regs_t
> can't divide exactly into 8.
> 
> Signed-off-by: Wang YanQing <udknight@gmail.com>
> ---
>  Hi all!
>  After mainline accept this patch, then we need to submit a sync patch
>  to update the tools/include/uapi/linux/bpf_perf_event.h.
> 
>  Thanks.
> 
>  include/uapi/linux/bpf_perf_event.h | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/include/uapi/linux/bpf_perf_event.h b/include/uapi/linux/bpf_perf_event.h
> index eb1b9d2..ff4c092 100644
> --- a/include/uapi/linux/bpf_perf_event.h
> +++ b/include/uapi/linux/bpf_perf_event.h
> @@ -12,7 +12,7 @@
>  
>  struct bpf_perf_event_data {
>  	bpf_user_pt_regs_t regs;
> -	__u64 sample_period;
> +	__u64 sample_period __attribute__((aligned(8)));

I don't think this necessary.
imo it's a bug in pe_prog_is_valid_access
that should have allowed 8-byte access to 4-byte aligned sample_period.
The access rewritten by pe_prog_convert_ctx_access anyway,
no alignment issues as far as I can see.

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: [PATCH] bpf: fix misaligned access for BPF_PROG_TYPE_PERF_EVENT program type on x86_32 platform
  2018-04-27 22:48 ` Alexei Starovoitov
@ 2018-04-27 23:33   ` Daniel Borkmann
  2018-04-28  5:29     ` Wang YanQing
  0 siblings, 1 reply; 6+ messages in thread
From: Daniel Borkmann @ 2018-04-27 23:33 UTC (permalink / raw)
  To: Alexei Starovoitov, Wang YanQing, ast, netdev, linux-kernel

On 04/28/2018 12:48 AM, Alexei Starovoitov wrote:
> On Thu, Apr 26, 2018 at 05:57:49PM +0800, Wang YanQing wrote:
>> All the testcases for BPF_PROG_TYPE_PERF_EVENT program type in
>> test_verifier(kselftest) report below errors on x86_32:
>> "
>> 172/p unpriv: spill/fill of different pointers ldx FAIL
>> Unexpected error message!
>> 0: (bf) r6 = r10
>> 1: (07) r6 += -8
>> 2: (15) if r1 == 0x0 goto pc+3
>> R1=ctx(id=0,off=0,imm=0) R6=fp-8,call_-1 R10=fp0,call_-1
>> 3: (bf) r2 = r10
>> 4: (07) r2 += -76
>> 5: (7b) *(u64 *)(r6 +0) = r2
>> 6: (55) if r1 != 0x0 goto pc+1
>> R1=ctx(id=0,off=0,imm=0) R2=fp-76,call_-1 R6=fp-8,call_-1 R10=fp0,call_-1 fp-8=fp
>> 7: (7b) *(u64 *)(r6 +0) = r1
>> 8: (79) r1 = *(u64 *)(r6 +0)
>> 9: (79) r1 = *(u64 *)(r1 +68)
>> invalid bpf_context access off=68 size=8
>>
>> 378/p check bpf_perf_event_data->sample_period byte load permitted FAIL
>> Failed to load prog 'Permission denied'!
>> 0: (b7) r0 = 0
>> 1: (71) r0 = *(u8 *)(r1 +68)
>> invalid bpf_context access off=68 size=1
>>
>> 379/p check bpf_perf_event_data->sample_period half load permitted FAIL
>> Failed to load prog 'Permission denied'!
>> 0: (b7) r0 = 0
>> 1: (69) r0 = *(u16 *)(r1 +68)
>> invalid bpf_context access off=68 size=2
>>
>> 380/p check bpf_perf_event_data->sample_period word load permitted FAIL
>> Failed to load prog 'Permission denied'!
>> 0: (b7) r0 = 0
>> 1: (61) r0 = *(u32 *)(r1 +68)
>> invalid bpf_context access off=68 size=4
>>
>> 381/p check bpf_perf_event_data->sample_period dword load permitted FAIL
>> Failed to load prog 'Permission denied'!
>> 0: (b7) r0 = 0
>> 1: (79) r0 = *(u64 *)(r1 +68)
>> invalid bpf_context access off=68 size=8
>> "
>>
>> This patch fix it, the fix isn't only necessary for x86_32, it will fix the
>> same problem for other platforms too, if their size of bpf_user_pt_regs_t
>> can't divide exactly into 8.
>>
>> Signed-off-by: Wang YanQing <udknight@gmail.com>
>> ---
>>  Hi all!
>>  After mainline accept this patch, then we need to submit a sync patch
>>  to update the tools/include/uapi/linux/bpf_perf_event.h.
>>
>>  Thanks.
>>
>>  include/uapi/linux/bpf_perf_event.h | 2 +-
>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/include/uapi/linux/bpf_perf_event.h b/include/uapi/linux/bpf_perf_event.h
>> index eb1b9d2..ff4c092 100644
>> --- a/include/uapi/linux/bpf_perf_event.h
>> +++ b/include/uapi/linux/bpf_perf_event.h
>> @@ -12,7 +12,7 @@
>>  
>>  struct bpf_perf_event_data {
>>  	bpf_user_pt_regs_t regs;
>> -	__u64 sample_period;
>> +	__u64 sample_period __attribute__((aligned(8)));
> 
> I don't think this necessary.
> imo it's a bug in pe_prog_is_valid_access
> that should have allowed 8-byte access to 4-byte aligned sample_period.
> The access rewritten by pe_prog_convert_ctx_access anyway,
> no alignment issues as far as I can see.

Right, good point. Wang, could you give the below a test run:

diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index 56ba0f2..95b9142 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -833,8 +833,14 @@ static bool pe_prog_is_valid_access(int off, int size, enum bpf_access_type type
 		return false;
 	if (type != BPF_READ)
 		return false;
-	if (off % size != 0)
-		return false;
+	if (off % size != 0) {
+		if (sizeof(long) != 4)
+			return false;
+		if (size != 8)
+			return false;
+		if (off % size != 4)
+			return false;
+	}

 	switch (off) {
 	case bpf_ctx_range(struct bpf_perf_event_data, sample_period):

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: [PATCH] bpf: fix misaligned access for BPF_PROG_TYPE_PERF_EVENT program type on x86_32 platform
  2018-04-27 23:33   ` Daniel Borkmann
@ 2018-04-28  5:29     ` Wang YanQing
  2018-05-07  7:23       ` Wang YanQing
  0 siblings, 1 reply; 6+ messages in thread
From: Wang YanQing @ 2018-04-28  5:29 UTC (permalink / raw)
  To: Daniel Borkmann; +Cc: Alexei Starovoitov, ast, netdev, linux-kernel

On Sat, Apr 28, 2018 at 01:33:15AM +0200, Daniel Borkmann wrote:
> On 04/28/2018 12:48 AM, Alexei Starovoitov wrote:
> > On Thu, Apr 26, 2018 at 05:57:49PM +0800, Wang YanQing wrote:
> >> All the testcases for BPF_PROG_TYPE_PERF_EVENT program type in
> >> test_verifier(kselftest) report below errors on x86_32:
> >> "
> >> 172/p unpriv: spill/fill of different pointers ldx FAIL
> >> Unexpected error message!
> >> 0: (bf) r6 = r10
> >> 1: (07) r6 += -8
> >> 2: (15) if r1 == 0x0 goto pc+3
> >> R1=ctx(id=0,off=0,imm=0) R6=fp-8,call_-1 R10=fp0,call_-1
> >> 3: (bf) r2 = r10
> >> 4: (07) r2 += -76
> >> 5: (7b) *(u64 *)(r6 +0) = r2
> >> 6: (55) if r1 != 0x0 goto pc+1
> >> R1=ctx(id=0,off=0,imm=0) R2=fp-76,call_-1 R6=fp-8,call_-1 R10=fp0,call_-1 fp-8=fp
> >> 7: (7b) *(u64 *)(r6 +0) = r1
> >> 8: (79) r1 = *(u64 *)(r6 +0)
> >> 9: (79) r1 = *(u64 *)(r1 +68)
> >> invalid bpf_context access off=68 size=8
> >>
> >> 378/p check bpf_perf_event_data->sample_period byte load permitted FAIL
> >> Failed to load prog 'Permission denied'!
> >> 0: (b7) r0 = 0
> >> 1: (71) r0 = *(u8 *)(r1 +68)
> >> invalid bpf_context access off=68 size=1
> >>
> >> 379/p check bpf_perf_event_data->sample_period half load permitted FAIL
> >> Failed to load prog 'Permission denied'!
> >> 0: (b7) r0 = 0
> >> 1: (69) r0 = *(u16 *)(r1 +68)
> >> invalid bpf_context access off=68 size=2
> >>
> >> 380/p check bpf_perf_event_data->sample_period word load permitted FAIL
> >> Failed to load prog 'Permission denied'!
> >> 0: (b7) r0 = 0
> >> 1: (61) r0 = *(u32 *)(r1 +68)
> >> invalid bpf_context access off=68 size=4
> >>
> >> 381/p check bpf_perf_event_data->sample_period dword load permitted FAIL
> >> Failed to load prog 'Permission denied'!
> >> 0: (b7) r0 = 0
> >> 1: (79) r0 = *(u64 *)(r1 +68)
> >> invalid bpf_context access off=68 size=8
> >> "
> >>
> >> This patch fix it, the fix isn't only necessary for x86_32, it will fix the
> >> same problem for other platforms too, if their size of bpf_user_pt_regs_t
> >> can't divide exactly into 8.
> >>
> >> Signed-off-by: Wang YanQing <udknight@gmail.com>
> >> ---
> >>  Hi all!
> >>  After mainline accept this patch, then we need to submit a sync patch
> >>  to update the tools/include/uapi/linux/bpf_perf_event.h.
> >>
> >>  Thanks.
> >>
> >>  include/uapi/linux/bpf_perf_event.h | 2 +-
> >>  1 file changed, 1 insertion(+), 1 deletion(-)
> >>
> >> diff --git a/include/uapi/linux/bpf_perf_event.h b/include/uapi/linux/bpf_perf_event.h
> >> index eb1b9d2..ff4c092 100644
> >> --- a/include/uapi/linux/bpf_perf_event.h
> >> +++ b/include/uapi/linux/bpf_perf_event.h
> >> @@ -12,7 +12,7 @@
> >>  
> >>  struct bpf_perf_event_data {
> >>  	bpf_user_pt_regs_t regs;
> >> -	__u64 sample_period;
> >> +	__u64 sample_period __attribute__((aligned(8)));
> > 
> > I don't think this necessary.
> > imo it's a bug in pe_prog_is_valid_access
> > that should have allowed 8-byte access to 4-byte aligned sample_period.
> > The access rewritten by pe_prog_convert_ctx_access anyway,
> > no alignment issues as far as I can see.
> 
> Right, good point. Wang, could you give the below a test run:
> 
> diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
> index 56ba0f2..95b9142 100644
> --- a/kernel/trace/bpf_trace.c
> +++ b/kernel/trace/bpf_trace.c
> @@ -833,8 +833,14 @@ static bool pe_prog_is_valid_access(int off, int size, enum bpf_access_type type
>  		return false;
>  	if (type != BPF_READ)
>  		return false;
> -	if (off % size != 0)
> -		return false;
> +	if (off % size != 0) {
> +		if (sizeof(long) != 4)
> +			return false;
> +		if (size != 8)
> +			return false;
> +		if (off % size != 4)
> +			return false;
> +	}
> 
>  	switch (off) {
>  	case bpf_ctx_range(struct bpf_perf_event_data, sample_period):
Hi all!

I have tested this patch, but test_verifier reports the same errors
for the five testcases.

The reason is they all failed to pass the test of bpf_ctx_narrow_access_ok.

Thanks.

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: [PATCH] bpf: fix misaligned access for BPF_PROG_TYPE_PERF_EVENT program type on x86_32 platform
  2018-04-28  5:29     ` Wang YanQing
@ 2018-05-07  7:23       ` Wang YanQing
  2018-05-07  8:25         ` Daniel Borkmann
  0 siblings, 1 reply; 6+ messages in thread
From: Wang YanQing @ 2018-05-07  7:23 UTC (permalink / raw)
  To: Daniel Borkmann, Alexei Starovoitov, ast, netdev, linux-kernel

On Sat, Apr 28, 2018 at 01:29:17PM +0800, Wang YanQing wrote:
> On Sat, Apr 28, 2018 at 01:33:15AM +0200, Daniel Borkmann wrote:
> > On 04/28/2018 12:48 AM, Alexei Starovoitov wrote:
> > > On Thu, Apr 26, 2018 at 05:57:49PM +0800, Wang YanQing wrote:
> > >> All the testcases for BPF_PROG_TYPE_PERF_EVENT program type in
> > >> test_verifier(kselftest) report below errors on x86_32:
> > >> "
> > >> 172/p unpriv: spill/fill of different pointers ldx FAIL
> > >> Unexpected error message!
> > >> 0: (bf) r6 = r10
> > >> 1: (07) r6 += -8
> > >> 2: (15) if r1 == 0x0 goto pc+3
> > >> R1=ctx(id=0,off=0,imm=0) R6=fp-8,call_-1 R10=fp0,call_-1
> > >> 3: (bf) r2 = r10
> > >> 4: (07) r2 += -76
> > >> 5: (7b) *(u64 *)(r6 +0) = r2
> > >> 6: (55) if r1 != 0x0 goto pc+1
> > >> R1=ctx(id=0,off=0,imm=0) R2=fp-76,call_-1 R6=fp-8,call_-1 R10=fp0,call_-1 fp-8=fp
> > >> 7: (7b) *(u64 *)(r6 +0) = r1
> > >> 8: (79) r1 = *(u64 *)(r6 +0)
> > >> 9: (79) r1 = *(u64 *)(r1 +68)
> > >> invalid bpf_context access off=68 size=8
> > >>
> > >> 378/p check bpf_perf_event_data->sample_period byte load permitted FAIL
> > >> Failed to load prog 'Permission denied'!
> > >> 0: (b7) r0 = 0
> > >> 1: (71) r0 = *(u8 *)(r1 +68)
> > >> invalid bpf_context access off=68 size=1
> > >>
> > >> 379/p check bpf_perf_event_data->sample_period half load permitted FAIL
> > >> Failed to load prog 'Permission denied'!
> > >> 0: (b7) r0 = 0
> > >> 1: (69) r0 = *(u16 *)(r1 +68)
> > >> invalid bpf_context access off=68 size=2
> > >>
> > >> 380/p check bpf_perf_event_data->sample_period word load permitted FAIL
> > >> Failed to load prog 'Permission denied'!
> > >> 0: (b7) r0 = 0
> > >> 1: (61) r0 = *(u32 *)(r1 +68)
> > >> invalid bpf_context access off=68 size=4
> > >>
> > >> 381/p check bpf_perf_event_data->sample_period dword load permitted FAIL
> > >> Failed to load prog 'Permission denied'!
> > >> 0: (b7) r0 = 0
> > >> 1: (79) r0 = *(u64 *)(r1 +68)
> > >> invalid bpf_context access off=68 size=8
> > >> "
> > >>
> > >> This patch fix it, the fix isn't only necessary for x86_32, it will fix the
> > >> same problem for other platforms too, if their size of bpf_user_pt_regs_t
> > >> can't divide exactly into 8.
> > >>
> > >> Signed-off-by: Wang YanQing <udknight@gmail.com>
> > >> ---
> > >>  Hi all!
> > >>  After mainline accept this patch, then we need to submit a sync patch
> > >>  to update the tools/include/uapi/linux/bpf_perf_event.h.
> > >>
> > >>  Thanks.
> > >>
> > >>  include/uapi/linux/bpf_perf_event.h | 2 +-
> > >>  1 file changed, 1 insertion(+), 1 deletion(-)
> > >>
> > >> diff --git a/include/uapi/linux/bpf_perf_event.h b/include/uapi/linux/bpf_perf_event.h
> > >> index eb1b9d2..ff4c092 100644
> > >> --- a/include/uapi/linux/bpf_perf_event.h
> > >> +++ b/include/uapi/linux/bpf_perf_event.h
> > >> @@ -12,7 +12,7 @@
> > >>  
> > >>  struct bpf_perf_event_data {
> > >>  	bpf_user_pt_regs_t regs;
> > >> -	__u64 sample_period;
> > >> +	__u64 sample_period __attribute__((aligned(8)));
> > > 
> > > I don't think this necessary.
> > > imo it's a bug in pe_prog_is_valid_access
> > > that should have allowed 8-byte access to 4-byte aligned sample_period.
> > > The access rewritten by pe_prog_convert_ctx_access anyway,
> > > no alignment issues as far as I can see.
> > 
> > Right, good point. Wang, could you give the below a test run:
> > 
> > diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
> > index 56ba0f2..95b9142 100644
> > --- a/kernel/trace/bpf_trace.c
> > +++ b/kernel/trace/bpf_trace.c
> > @@ -833,8 +833,14 @@ static bool pe_prog_is_valid_access(int off, int size, enum bpf_access_type type
> >  		return false;
> >  	if (type != BPF_READ)
> >  		return false;
> > -	if (off % size != 0)
> > -		return false;
> > +	if (off % size != 0) {
> > +		if (sizeof(long) != 4)
> > +			return false;
> > +		if (size != 8)
> > +			return false;
> > +		if (off % size != 4)
> > +			return false;
> > +	}
> > 
> >  	switch (off) {
> >  	case bpf_ctx_range(struct bpf_perf_event_data, sample_period):
> Hi all!
> 
> I have tested this patch, but test_verifier reports the same errors
> for the five testcases.
> 
> The reason is they all failed to pass the test of bpf_ctx_narrow_access_ok.
> 
> Thanks.
Hi! Daniel Borkmann.

Do you have any plan to fix bpf_ctx_narrow_access_ok for these problems?

Thanks.

^ permalink raw reply	[flat|nested] 6+ messages in thread

* Re: [PATCH] bpf: fix misaligned access for BPF_PROG_TYPE_PERF_EVENT program type on x86_32 platform
  2018-05-07  7:23       ` Wang YanQing
@ 2018-05-07  8:25         ` Daniel Borkmann
  0 siblings, 0 replies; 6+ messages in thread
From: Daniel Borkmann @ 2018-05-07  8:25 UTC (permalink / raw)
  To: Wang YanQing, Alexei Starovoitov, ast, netdev, linux-kernel

On 05/07/2018 09:23 AM, Wang YanQing wrote:
> On Sat, Apr 28, 2018 at 01:29:17PM +0800, Wang YanQing wrote:
>> On Sat, Apr 28, 2018 at 01:33:15AM +0200, Daniel Borkmann wrote:
>>> On 04/28/2018 12:48 AM, Alexei Starovoitov wrote:
>>>> On Thu, Apr 26, 2018 at 05:57:49PM +0800, Wang YanQing wrote:
>>>>> All the testcases for BPF_PROG_TYPE_PERF_EVENT program type in
>>>>> test_verifier(kselftest) report below errors on x86_32:
>>>>> "
>>>>> 172/p unpriv: spill/fill of different pointers ldx FAIL
>>>>> Unexpected error message!
>>>>> 0: (bf) r6 = r10
>>>>> 1: (07) r6 += -8
>>>>> 2: (15) if r1 == 0x0 goto pc+3
>>>>> R1=ctx(id=0,off=0,imm=0) R6=fp-8,call_-1 R10=fp0,call_-1
>>>>> 3: (bf) r2 = r10
>>>>> 4: (07) r2 += -76
>>>>> 5: (7b) *(u64 *)(r6 +0) = r2
>>>>> 6: (55) if r1 != 0x0 goto pc+1
>>>>> R1=ctx(id=0,off=0,imm=0) R2=fp-76,call_-1 R6=fp-8,call_-1 R10=fp0,call_-1 fp-8=fp
>>>>> 7: (7b) *(u64 *)(r6 +0) = r1
>>>>> 8: (79) r1 = *(u64 *)(r6 +0)
>>>>> 9: (79) r1 = *(u64 *)(r1 +68)
>>>>> invalid bpf_context access off=68 size=8
>>>>>
>>>>> 378/p check bpf_perf_event_data->sample_period byte load permitted FAIL
>>>>> Failed to load prog 'Permission denied'!
>>>>> 0: (b7) r0 = 0
>>>>> 1: (71) r0 = *(u8 *)(r1 +68)
>>>>> invalid bpf_context access off=68 size=1
>>>>>
>>>>> 379/p check bpf_perf_event_data->sample_period half load permitted FAIL
>>>>> Failed to load prog 'Permission denied'!
>>>>> 0: (b7) r0 = 0
>>>>> 1: (69) r0 = *(u16 *)(r1 +68)
>>>>> invalid bpf_context access off=68 size=2
>>>>>
>>>>> 380/p check bpf_perf_event_data->sample_period word load permitted FAIL
>>>>> Failed to load prog 'Permission denied'!
>>>>> 0: (b7) r0 = 0
>>>>> 1: (61) r0 = *(u32 *)(r1 +68)
>>>>> invalid bpf_context access off=68 size=4
>>>>>
>>>>> 381/p check bpf_perf_event_data->sample_period dword load permitted FAIL
>>>>> Failed to load prog 'Permission denied'!
>>>>> 0: (b7) r0 = 0
>>>>> 1: (79) r0 = *(u64 *)(r1 +68)
>>>>> invalid bpf_context access off=68 size=8
>>>>> "
>>>>>
>>>>> This patch fix it, the fix isn't only necessary for x86_32, it will fix the
>>>>> same problem for other platforms too, if their size of bpf_user_pt_regs_t
>>>>> can't divide exactly into 8.
>>>>>
>>>>> Signed-off-by: Wang YanQing <udknight@gmail.com>
>>>>> ---
>>>>>  Hi all!
>>>>>  After mainline accept this patch, then we need to submit a sync patch
>>>>>  to update the tools/include/uapi/linux/bpf_perf_event.h.
>>>>>
>>>>>  Thanks.
>>>>>
>>>>>  include/uapi/linux/bpf_perf_event.h | 2 +-
>>>>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>>>>
>>>>> diff --git a/include/uapi/linux/bpf_perf_event.h b/include/uapi/linux/bpf_perf_event.h
>>>>> index eb1b9d2..ff4c092 100644
>>>>> --- a/include/uapi/linux/bpf_perf_event.h
>>>>> +++ b/include/uapi/linux/bpf_perf_event.h
>>>>> @@ -12,7 +12,7 @@
>>>>>  
>>>>>  struct bpf_perf_event_data {
>>>>>  	bpf_user_pt_regs_t regs;
>>>>> -	__u64 sample_period;
>>>>> +	__u64 sample_period __attribute__((aligned(8)));
>>>>
>>>> I don't think this necessary.
>>>> imo it's a bug in pe_prog_is_valid_access
>>>> that should have allowed 8-byte access to 4-byte aligned sample_period.
>>>> The access rewritten by pe_prog_convert_ctx_access anyway,
>>>> no alignment issues as far as I can see.
>>>
>>> Right, good point. Wang, could you give the below a test run:
>>>
>>> diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
>>> index 56ba0f2..95b9142 100644
>>> --- a/kernel/trace/bpf_trace.c
>>> +++ b/kernel/trace/bpf_trace.c
>>> @@ -833,8 +833,14 @@ static bool pe_prog_is_valid_access(int off, int size, enum bpf_access_type type
>>>  		return false;
>>>  	if (type != BPF_READ)
>>>  		return false;
>>> -	if (off % size != 0)
>>> -		return false;
>>> +	if (off % size != 0) {
>>> +		if (sizeof(long) != 4)
>>> +			return false;
>>> +		if (size != 8)
>>> +			return false;
>>> +		if (off % size != 4)
>>> +			return false;
>>> +	}
>>>
>>>  	switch (off) {
>>>  	case bpf_ctx_range(struct bpf_perf_event_data, sample_period):
>> Hi all!
>>
>> I have tested this patch, but test_verifier reports the same errors
>> for the five testcases.
>>
>> The reason is they all failed to pass the test of bpf_ctx_narrow_access_ok.
>>
>> Thanks.
> Hi! Daniel Borkmann.
> 
> Do you have any plan to fix bpf_ctx_narrow_access_ok for these problems?

Yep, sorry for the delay, will get to it during this week.

Thanks,
Daniel

^ permalink raw reply	[flat|nested] 6+ messages in thread

end of thread, other threads:[~2018-05-07  8:25 UTC | newest]

Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2018-04-26  9:57 [PATCH] bpf: fix misaligned access for BPF_PROG_TYPE_PERF_EVENT program type on x86_32 platform Wang YanQing
2018-04-27 22:48 ` Alexei Starovoitov
2018-04-27 23:33   ` Daniel Borkmann
2018-04-28  5:29     ` Wang YanQing
2018-05-07  7:23       ` Wang YanQing
2018-05-07  8:25         ` Daniel Borkmann

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).