Messages in this thread | | | Subject | Re: linux-next: manual merge of the net-next tree with the net tree | From | Daniel Borkmann <> | Date | Fri, 19 Mar 2021 16:38:26 +0100 |
| |
On 3/19/21 4:33 PM, Alexei Starovoitov wrote: > On Fri, Mar 19, 2021 at 8:17 AM Yonghong Song <yhs@fb.com> wrote: >> On 3/19/21 12:21 AM, Daniel Borkmann wrote: >>> On 3/19/21 3:11 AM, Piotr Krysiuk wrote: >>>> Hi Daniel, >>>> >>>> On Fri, Mar 19, 2021 at 12:16 AM Stephen Rothwell <sfr@canb.auug.org.au> >>>> wrote: >>>> >>>>> diff --cc kernel/bpf/verifier.c >>>>> index 44e4ec1640f1,f9096b049cd6..000000000000 >>>>> --- a/kernel/bpf/verifier.c >>>>> +++ b/kernel/bpf/verifier.c >>>>> @@@ -5876,10 -6056,22 +6060,23 @@@ static int >>>>> retrieve_ptr_limit(const str >>>>> if (mask_to_left) >>>>> *ptr_limit = MAX_BPF_STACK + off; >>>>> else >>>>> - *ptr_limit = -off; >>>>> - return 0; >>>>> + *ptr_limit = -off - 1; >>>>> + return *ptr_limit >= max ? -ERANGE : 0; >>>>> + case PTR_TO_MAP_KEY: >>>>> + /* Currently, this code is not exercised as the only use >>>>> + * is bpf_for_each_map_elem() helper which requires >>>>> + * bpf_capble. The code has been tested manually for >>>>> + * future use. >>>>> + */ >>>>> + if (mask_to_left) { >>>>> + *ptr_limit = ptr_reg->umax_value + ptr_reg->off; >>>>> + } else { >>>>> + off = ptr_reg->smin_value + ptr_reg->off; >>>>> + *ptr_limit = ptr_reg->map_ptr->key_size - off; >>>>> + } >>>>> + return 0; >>>> >>>> PTR_TO_MAP_VALUE logic above looks like copy-paste of old >>>> PTR_TO_MAP_VALUE >>>> code from before "bpf: Fix off-by-one for area size in creating mask to >>>> left" and is apparently affected by the same off-by-one, except this time >>>> on "key_size" area and not "value_size". >>>> >>>> This needs to be fixed in the same way as we did with PTR_TO_MAP_VALUE. >>>> What is the best way to proceed? >>> >>> Hm, not sure why PTR_TO_MAP_KEY was added by 69c087ba6225 in the first >>> place, I >>> presume noone expects this to be used from unprivileged as the comment >>> says. >>> Resolution should be to remove the PTR_TO_MAP_KEY case entirely from >>> that switch >>> until we have an actual user. >> >> Alexei suggested so that we don't forget it in the future if >> bpf_capable() requirement is removed. >> https://lore.kernel.org/bpf/c837ae55-2487-2f39-47f6-a18781dc6fcc@fb.com/ >> >> I am okay with either way, fix it or remove it. > > I prefer to fix it.
If the bpf_capable() is removed, the verifier would bail out on PTR_TO_MAP_KEY if not covered in the switch given the recent fixes we did. I can fix it up after merge if we think bpf_for_each_map_elem() will be used by unpriv in future..
| |