Files
linux/include/linux
Eduard Zingerman 1ffc85d929 bpf: Verify scalar ids mapping in regsafe() using check_ids()
Make sure that the following unsafe example is rejected by verifier:

1: r9 = ... some pointer with range X ...
2: r6 = ... unbound scalar ID=a ...
3: r7 = ... unbound scalar ID=b ...
4: if (r6 > r7) goto +1
5: r6 = r7
6: if (r6 > X) goto ...
--- checkpoint ---
7: r9 += r7
8: *(u64 *)r9 = Y

This example is unsafe because not all execution paths verify r7 range.
Because of the jump at (4) the verifier would arrive at (6) in two states:
I.  r6{.id=b}, r7{.id=b} via path 1-6;
II. r6{.id=a}, r7{.id=b} via path 1-4, 6.

Currently regsafe() does not call check_ids() for scalar registers,
thus from POV of regsafe() states (I) and (II) are identical. If the
path 1-6 is taken by verifier first, and checkpoint is created at (6)
the path [1-4, 6] would be considered safe.

Changes in this commit:
- check_ids() is modified to disallow mapping multiple old_id to the
  same cur_id.
- check_scalar_ids() is added, unlike check_ids() it treats ID zero as
  a unique scalar ID.
- check_scalar_ids() needs to generate temporary unique IDs, field
  'tmp_id_gen' is added to bpf_verifier_env::idmap_scratch to
  facilitate this.
- regsafe() is updated to:
  - use check_scalar_ids() for precise scalar registers.
  - compare scalar registers using memcmp only for explore_alu_limits
    branch. This simplifies control flow for scalar case, and has no
    measurable performance impact.
- check_alu_op() is updated to avoid generating bpf_reg_state::id for
  constant scalar values when processing BPF_MOV. ID is needed to
  propagate range information for identical values, but there is
  nothing to propagate for constants.

Fixes: 75748837b7 ("bpf: Propagate scalar ranges through register assignments.")
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20230613153824.3324830-4-eddyz87@gmail.com
2023-06-13 15:15:08 -07:00
..
2023-01-16 09:26:05 +01:00
2023-03-29 12:26:32 +02:00
2023-03-06 12:33:02 +02:00
2023-04-21 14:37:03 +01:00
2023-01-19 14:46:25 +01:00
2023-05-20 05:38:01 -06:00
2023-05-31 13:06:57 +02:00
2023-02-03 08:20:55 -07:00
2023-01-13 11:48:15 +01:00
2023-03-05 10:49:37 -08:00
2023-03-23 16:02:27 -10:00
2023-04-17 18:01:23 +02:00
2023-04-20 18:20:04 +08:00
2023-01-19 16:07:40 +01:00
2023-03-06 15:49:07 -06:00
2023-01-29 15:18:33 -07:00
2023-01-29 15:18:33 -07:00
2023-02-06 19:06:58 +01:00
2023-01-19 09:24:28 +01:00
2023-03-29 16:00:23 +02:00
2023-01-11 06:52:43 -05:00
2023-03-19 10:02:04 -07:00
2023-03-06 12:33:02 +02:00
2022-12-11 19:30:20 -08:00
2023-02-13 10:11:20 +02:00
2023-03-07 22:04:45 +05:30
2023-01-19 09:24:30 +01:00
2023-03-29 12:26:32 +02:00
2023-03-15 14:58:52 +01:00
2023-01-16 09:26:06 +01:00
2023-04-03 11:16:56 +02:00
2023-01-04 14:44:13 -07:00
2023-03-06 09:57:07 +01:00
2022-12-20 03:13:45 +01:00
2023-03-17 15:00:40 +01:00
2023-01-19 15:01:19 +01:00
2023-05-18 19:52:31 -07:00
2023-01-18 17:12:47 -08:00
2023-03-16 13:08:39 -07:00
2023-03-23 17:25:46 +01:00
2023-03-29 08:19:38 +01:00
2023-04-05 20:03:01 -07:00
2023-04-21 03:02:34 -04:00
2023-03-06 09:57:11 +01:00