Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d2f79032 authored by Daniel Borkmann's avatar Daniel Borkmann Committed by Greg Kroah-Hartman
Browse files

bpf: Do not mark insn as seen under speculative path verification 



commit fe9a5ca7e370e613a9a75a13008a3845ea759d6e upstream

... in such circumstances, we do not want to mark the instruction as seen given
the goal is still to jmp-1 rewrite/sanitize dead code, if it is not reachable
from the non-speculative path verification. We do however want to verify it for
safety regardless.

With the patch as-is all the insns that have been marked as seen before the
patch will also be marked as seen after the patch (just with a potentially
different non-zero count). An upcoming patch will also verify paths that are
unreachable in the non-speculative domain, hence this extension is needed.

Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Reviewed-by: default avatarJohn Fastabend <john.fastabend@gmail.com>
Reviewed-by: default avatarBenedict Schlueter <benedict.schlueter@rub.de>
Reviewed-by: default avatarPiotr Krysiuk <piotras@gmail.com>
Acked-by: default avatarAlexei Starovoitov <ast@kernel.org>
[OP: - env->pass_cnt is not used in 5.4, so adjust sanitize_mark_insn_seen()
       to assign "true" instead
     - drop sanitize_insn_aux_data() comment changes, as the function is not
       present in 5.4]
Signed-off-by: default avatarOvidiu Panait <ovidiu.panait@windriver.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 283d7429

kernel/bpf/verifier.c

+15 −2
Original line number Diff line number Diff line
@@ -4435,6 +4435,19 @@ static int sanitize_ptr_alu(struct bpf_verifier_env *env, 
	return !ret ? REASON_STACK : 0;

}



static void sanitize_mark_insn_seen(struct bpf_verifier_env *env)

{

	struct bpf_verifier_state *vstate = env->cur_state;



	/* If we simulate paths under speculation, we don't update the

	 * insn as 'seen' such that when we verify unreachable paths in

	 * the non-speculative domain, sanitize_dead_code() can still

	 * rewrite/sanitize them.

	 */

	if (!vstate->speculative)

		env->insn_aux_data[env->insn_idx].seen = true;

}



static int sanitize_err(struct bpf_verifier_env *env,

			const struct bpf_insn *insn, int reason,

			const struct bpf_reg_state *off_reg,
@@ -7790,7 +7803,7 @@ static int do_check(struct bpf_verifier_env *env) 
		}



		regs = cur_regs(env);

		env->insn_aux_data[env->insn_idx].seen = true;

		sanitize_mark_insn_seen(env);

		prev_insn_idx = env->insn_idx;



		if (class == BPF_ALU || class == BPF_ALU64) {
@@ -8025,7 +8038,7 @@ static int do_check(struct bpf_verifier_env *env) 
					return err;



				env->insn_idx++;

				env->insn_aux_data[env->insn_idx].seen = true;

				sanitize_mark_insn_seen(env);

			} else {

				verbose(env, "invalid BPF_LD mode\n");

				return -EINVAL;