ebpf: Allow dereferences of PTR_TO_STACK registers
mov %rsp, %r1 ; r1 = rsp add $-8, %r1 ; r1 = rsp - 8 store_q $123, -8(%rsp) ; *(u64*)r1 = 123 <- valid store_q $123, (%r1) ; *(u64*)r1 = 123 <- previously invalid mov $0, %r0 exit ; Always need to exit And we'd get the following error: 0: (bf) r1 = r10 1: (07) r1 += -8 2: (7a) *(u64 *)(r10 -8) = 999 3: (7a) *(u64 *)(r1 +0) = 999 R1 invalid mem access 'fp' Unable to load program We already know that a register is a stack address and the appropriate offset, so we should be able to validate those references as well. Signed-off-by: Alex Gartrell <agartrell@fb.com> Acked-by: Alexei Starovoitov <ast@plumgrid.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
6ecfdd28c8
commit
24b4d2abd0
|
@ -648,6 +648,9 @@ static int check_mem_access(struct verifier_env *env, u32 regno, int off,
|
||||||
struct verifier_state *state = &env->cur_state;
|
struct verifier_state *state = &env->cur_state;
|
||||||
int size, err = 0;
|
int size, err = 0;
|
||||||
|
|
||||||
|
if (state->regs[regno].type == PTR_TO_STACK)
|
||||||
|
off += state->regs[regno].imm;
|
||||||
|
|
||||||
size = bpf_size_to_bytes(bpf_size);
|
size = bpf_size_to_bytes(bpf_size);
|
||||||
if (size < 0)
|
if (size < 0)
|
||||||
return size;
|
return size;
|
||||||
|
@ -667,7 +670,8 @@ static int check_mem_access(struct verifier_env *env, u32 regno, int off,
|
||||||
if (!err && t == BPF_READ && value_regno >= 0)
|
if (!err && t == BPF_READ && value_regno >= 0)
|
||||||
mark_reg_unknown_value(state->regs, value_regno);
|
mark_reg_unknown_value(state->regs, value_regno);
|
||||||
|
|
||||||
} else if (state->regs[regno].type == FRAME_PTR) {
|
} else if (state->regs[regno].type == FRAME_PTR ||
|
||||||
|
state->regs[regno].type == PTR_TO_STACK) {
|
||||||
if (off >= 0 || off < -MAX_BPF_STACK) {
|
if (off >= 0 || off < -MAX_BPF_STACK) {
|
||||||
verbose("invalid stack off=%d size=%d\n", off, size);
|
verbose("invalid stack off=%d size=%d\n", off, size);
|
||||||
return -EACCES;
|
return -EACCES;
|
||||||
|
|
|
@ -822,6 +822,65 @@ static struct bpf_test tests[] = {
|
||||||
.result = ACCEPT,
|
.result = ACCEPT,
|
||||||
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
|
||||||
},
|
},
|
||||||
|
{
|
||||||
|
"PTR_TO_STACK store/load",
|
||||||
|
.insns = {
|
||||||
|
BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
|
||||||
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -10),
|
||||||
|
BPF_ST_MEM(BPF_DW, BPF_REG_1, 2, 0xfaceb00c),
|
||||||
|
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 2),
|
||||||
|
BPF_EXIT_INSN(),
|
||||||
|
},
|
||||||
|
.result = ACCEPT,
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"PTR_TO_STACK store/load - bad alignment on off",
|
||||||
|
.insns = {
|
||||||
|
BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
|
||||||
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
|
||||||
|
BPF_ST_MEM(BPF_DW, BPF_REG_1, 2, 0xfaceb00c),
|
||||||
|
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 2),
|
||||||
|
BPF_EXIT_INSN(),
|
||||||
|
},
|
||||||
|
.result = REJECT,
|
||||||
|
.errstr = "misaligned access off -6 size 8",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"PTR_TO_STACK store/load - bad alignment on reg",
|
||||||
|
.insns = {
|
||||||
|
BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
|
||||||
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -10),
|
||||||
|
BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),
|
||||||
|
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),
|
||||||
|
BPF_EXIT_INSN(),
|
||||||
|
},
|
||||||
|
.result = REJECT,
|
||||||
|
.errstr = "misaligned access off -2 size 8",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"PTR_TO_STACK store/load - out of bounds low",
|
||||||
|
.insns = {
|
||||||
|
BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
|
||||||
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -80000),
|
||||||
|
BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),
|
||||||
|
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),
|
||||||
|
BPF_EXIT_INSN(),
|
||||||
|
},
|
||||||
|
.result = REJECT,
|
||||||
|
.errstr = "invalid stack off=-79992 size=8",
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"PTR_TO_STACK store/load - out of bounds high",
|
||||||
|
.insns = {
|
||||||
|
BPF_MOV64_REG(BPF_REG_1, BPF_REG_10),
|
||||||
|
BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, -8),
|
||||||
|
BPF_ST_MEM(BPF_DW, BPF_REG_1, 8, 0xfaceb00c),
|
||||||
|
BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_1, 8),
|
||||||
|
BPF_EXIT_INSN(),
|
||||||
|
},
|
||||||
|
.result = REJECT,
|
||||||
|
.errstr = "invalid stack off=0 size=8",
|
||||||
|
},
|
||||||
};
|
};
|
||||||
|
|
||||||
static int probe_filter_length(struct bpf_insn *fp)
|
static int probe_filter_length(struct bpf_insn *fp)
|
||||||
|
|
Loading…
Reference in New Issue