From 80eb6ca63a66cca57f299b23c00cd930674575b8 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sat, 13 Aug 2022 15:15:58 +0200 Subject: [PATCH] 4.19-stable patches added patches: bpf-verifer-adjust_scalar_min_max_vals-to-always-call-update_reg_bounds.patch selftests-bpf-fix-dubious-pointer-arithmetic-test.patch selftests-bpf-fix-test_align-verifier-log-patterns.patch --- ...als-to-always-call-update_reg_bounds.patch | 54 ++++++ ...-fix-dubious-pointer-arithmetic-test.patch | 53 ++++++ ...fix-test_align-verifier-log-patterns.patch | 161 ++++++++++++++++++ queue-4.19/series | 3 + 4 files changed, 271 insertions(+) create mode 100644 queue-4.19/bpf-verifer-adjust_scalar_min_max_vals-to-always-call-update_reg_bounds.patch create mode 100644 queue-4.19/selftests-bpf-fix-dubious-pointer-arithmetic-test.patch create mode 100644 queue-4.19/selftests-bpf-fix-test_align-verifier-log-patterns.patch diff --git a/queue-4.19/bpf-verifer-adjust_scalar_min_max_vals-to-always-call-update_reg_bounds.patch b/queue-4.19/bpf-verifer-adjust_scalar_min_max_vals-to-always-call-update_reg_bounds.patch new file mode 100644 index 00000000000..97169d1185d --- /dev/null +++ b/queue-4.19/bpf-verifer-adjust_scalar_min_max_vals-to-always-call-update_reg_bounds.patch @@ -0,0 +1,54 @@ +From foo@baz Sat Aug 13 03:11:42 PM CEST 2022 +From: Ovidiu Panait +Date: Tue, 9 Aug 2022 10:39:45 +0300 +Subject: bpf: Verifer, adjust_scalar_min_max_vals to always call update_reg_bounds() +To: stable@vger.kernel.org +Cc: John Fastabend , Alexei Starovoitov , Ovidiu Panait +Message-ID: <20220809073947.33804-3-ovidiu.panait@windriver.com> + +From: Ovidiu Panait + +From: John Fastabend + +commit 294f2fc6da27620a506e6c050241655459ccd6bd upstream. + +Currently, for all op verification we call __red_deduce_bounds() and +__red_bound_offset() but we only call __update_reg_bounds() in bitwise +ops. However, we could benefit from calling __update_reg_bounds() in +BPF_ADD, BPF_SUB, and BPF_MUL cases as well. + +For example, a register with state 'R1_w=invP0' when we subtract from +it, + + w1 -= 2 + +Before coerce we will now have an smin_value=S64_MIN, smax_value=U64_MAX +and unsigned bounds umin_value=0, umax_value=U64_MAX. These will then +be clamped to S32_MIN, U32_MAX values by coerce in the case of alu32 op +as done in above example. However tnum will be a constant because the +ALU op is done on a constant. + +Without update_reg_bounds() we have a scenario where tnum is a const +but our unsigned bounds do not reflect this. By calling update_reg_bounds +after coerce to 32bit we further refine the umin_value to U64_MAX in the +alu64 case or U32_MAX in the alu32 case above. + +Signed-off-by: John Fastabend +Signed-off-by: Alexei Starovoitov +Link: https://lore.kernel.org/bpf/158507151689.15666.566796274289413203.stgit@john-Precision-5820-Tower +Signed-off-by: Ovidiu Panait +Signed-off-by: Greg Kroah-Hartman +--- + kernel/bpf/verifier.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -3496,6 +3496,7 @@ static int adjust_scalar_min_max_vals(st + coerce_reg_to_size(dst_reg, 4); + } + ++ __update_reg_bounds(dst_reg); + __reg_deduce_bounds(dst_reg); + __reg_bound_offset(dst_reg); + return 0; diff --git a/queue-4.19/selftests-bpf-fix-dubious-pointer-arithmetic-test.patch b/queue-4.19/selftests-bpf-fix-dubious-pointer-arithmetic-test.patch new file mode 100644 index 00000000000..13b0c05807d --- /dev/null +++ b/queue-4.19/selftests-bpf-fix-dubious-pointer-arithmetic-test.patch @@ -0,0 +1,53 @@ +From foo@baz Sat Aug 13 03:11:42 PM CEST 2022 +From: Ovidiu Panait +Date: Tue, 9 Aug 2022 10:39:47 +0300 +Subject: selftests/bpf: Fix "dubious pointer arithmetic" test +To: stable@vger.kernel.org +Cc: Jean-Philippe Brucker , John Fastabend , Alexei Starovoitov , Ovidiu Panait +Message-ID: <20220809073947.33804-5-ovidiu.panait@windriver.com> + +From: Ovidiu Panait + +From: Jean-Philippe Brucker + +commit 3615bdf6d9b19db12b1589861609b4f1c6a8d303 upstream. + +The verifier trace changed following a bugfix. After checking the 64-bit +sign, only the upper bit mask is known, not bit 31. Update the test +accordingly. + +Signed-off-by: Jean-Philippe Brucker +Acked-by: John Fastabend +Signed-off-by: Alexei Starovoitov +[OP: adjust for 4.19 selftests] +Signed-off-by: Ovidiu Panait +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/bpf/test_align.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/tools/testing/selftests/bpf/test_align.c ++++ b/tools/testing/selftests/bpf/test_align.c +@@ -475,10 +475,10 @@ static struct bpf_align_test tests[] = { + */ + {7, "R5=inv(id=0,smin_value=-9223372036854775806,smax_value=9223372036854775806,umin_value=2,umax_value=18446744073709551614,var_off=(0x2; 0xfffffffffffffffc)"}, + /* Checked s>=0 */ +- {9, "R5=inv(id=0,umin_value=2,umax_value=9223372034707292158,var_off=(0x2; 0x7fffffff7ffffffc)"}, ++ {9, "R5=inv(id=0,umin_value=2,umax_value=9223372036854775806,var_off=(0x2; 0x7ffffffffffffffc)"}, + /* packet pointer + nonnegative (4n+2) */ +- {11, "R6_w=pkt(id=1,off=0,r=0,umin_value=2,umax_value=9223372034707292158,var_off=(0x2; 0x7fffffff7ffffffc)"}, +- {13, "R4=pkt(id=1,off=4,r=0,umin_value=2,umax_value=9223372034707292158,var_off=(0x2; 0x7fffffff7ffffffc)"}, ++ {11, "R6_w=pkt(id=1,off=0,r=0,umin_value=2,umax_value=9223372036854775806,var_off=(0x2; 0x7ffffffffffffffc)"}, ++ {13, "R4=pkt(id=1,off=4,r=0,umin_value=2,umax_value=9223372036854775806,var_off=(0x2; 0x7ffffffffffffffc)"}, + /* NET_IP_ALIGN + (4n+2) == (4n), alignment is fine. + * We checked the bounds, but it might have been able + * to overflow if the packet pointer started in the +@@ -486,7 +486,7 @@ static struct bpf_align_test tests[] = { + * So we did not get a 'range' on R6, and the access + * attempt will fail. + */ +- {15, "R6=pkt(id=1,off=0,r=0,umin_value=2,umax_value=9223372034707292158,var_off=(0x2; 0x7fffffff7ffffffc)"}, ++ {15, "R6=pkt(id=1,off=0,r=0,umin_value=2,umax_value=9223372036854775806,var_off=(0x2; 0x7ffffffffffffffc)"}, + } + }, + { diff --git a/queue-4.19/selftests-bpf-fix-test_align-verifier-log-patterns.patch b/queue-4.19/selftests-bpf-fix-test_align-verifier-log-patterns.patch new file mode 100644 index 00000000000..55495880863 --- /dev/null +++ b/queue-4.19/selftests-bpf-fix-test_align-verifier-log-patterns.patch @@ -0,0 +1,161 @@ +From foo@baz Sat Aug 13 03:11:42 PM CEST 2022 +From: Ovidiu Panait +Date: Tue, 9 Aug 2022 10:39:46 +0300 +Subject: selftests/bpf: Fix test_align verifier log patterns +To: stable@vger.kernel.org +Cc: Stanislav Fomichev , Daniel Borkmann , Ovidiu Panait +Message-ID: <20220809073947.33804-4-ovidiu.panait@windriver.com> + +From: Ovidiu Panait + +From: Stanislav Fomichev + +commit 5366d2269139ba8eb6a906d73a0819947e3e4e0a upstream. + +Commit 294f2fc6da27 ("bpf: Verifer, adjust_scalar_min_max_vals to always +call update_reg_bounds()") changed the way verifier logs some of its state, +adjust the test_align accordingly. Where possible, I tried to not copy-paste +the entire log line and resorted to dropping the last closing brace instead. + +Fixes: 294f2fc6da27 ("bpf: Verifer, adjust_scalar_min_max_vals to always call update_reg_bounds()") +Signed-off-by: Stanislav Fomichev +Signed-off-by: Daniel Borkmann +Link: https://lore.kernel.org/bpf/20200515194904.229296-1-sdf@google.com +[OP: adjust for 4.19 selftests] +Signed-off-by: Ovidiu Panait +Signed-off-by: Greg Kroah-Hartman +--- + tools/testing/selftests/bpf/test_align.c | 41 +++++++++++++++---------------- + 1 file changed, 21 insertions(+), 20 deletions(-) + +--- a/tools/testing/selftests/bpf/test_align.c ++++ b/tools/testing/selftests/bpf/test_align.c +@@ -359,15 +359,15 @@ static struct bpf_align_test tests[] = { + * is still (4n), fixed offset is not changed. + * Also, we create a new reg->id. + */ +- {29, "R5_w=pkt(id=4,off=18,r=0,umax_value=2040,var_off=(0x0; 0x7fc))"}, ++ {29, "R5_w=pkt(id=4,off=18,r=0,umax_value=2040,var_off=(0x0; 0x7fc)"}, + /* At the time the word size load is performed from R5, + * its total fixed offset is NET_IP_ALIGN + reg->off (18) + * which is 20. Then the variable offset is (4n), so + * the total offset is 4-byte aligned and meets the + * load's requirements. + */ +- {33, "R4=pkt(id=4,off=22,r=22,umax_value=2040,var_off=(0x0; 0x7fc))"}, +- {33, "R5=pkt(id=4,off=18,r=22,umax_value=2040,var_off=(0x0; 0x7fc))"}, ++ {33, "R4=pkt(id=4,off=22,r=22,umax_value=2040,var_off=(0x0; 0x7fc)"}, ++ {33, "R5=pkt(id=4,off=18,r=22,umax_value=2040,var_off=(0x0; 0x7fc)"}, + }, + }, + { +@@ -410,15 +410,15 @@ static struct bpf_align_test tests[] = { + /* Adding 14 makes R6 be (4n+2) */ + {9, "R6_w=inv(id=0,umin_value=14,umax_value=1034,var_off=(0x2; 0x7fc))"}, + /* Packet pointer has (4n+2) offset */ +- {11, "R5_w=pkt(id=1,off=0,r=0,umin_value=14,umax_value=1034,var_off=(0x2; 0x7fc))"}, +- {13, "R4=pkt(id=1,off=4,r=0,umin_value=14,umax_value=1034,var_off=(0x2; 0x7fc))"}, ++ {11, "R5_w=pkt(id=1,off=0,r=0,umin_value=14,umax_value=1034,var_off=(0x2; 0x7fc)"}, ++ {13, "R4=pkt(id=1,off=4,r=0,umin_value=14,umax_value=1034,var_off=(0x2; 0x7fc)"}, + /* At the time the word size load is performed from R5, + * its total fixed offset is NET_IP_ALIGN + reg->off (0) + * which is 2. Then the variable offset is (4n+2), so + * the total offset is 4-byte aligned and meets the + * load's requirements. + */ +- {15, "R5=pkt(id=1,off=0,r=4,umin_value=14,umax_value=1034,var_off=(0x2; 0x7fc))"}, ++ {15, "R5=pkt(id=1,off=0,r=4,umin_value=14,umax_value=1034,var_off=(0x2; 0x7fc)"}, + /* Newly read value in R6 was shifted left by 2, so has + * known alignment of 4. + */ +@@ -426,15 +426,15 @@ static struct bpf_align_test tests[] = { + /* Added (4n) to packet pointer's (4n+2) var_off, giving + * another (4n+2). + */ +- {19, "R5_w=pkt(id=2,off=0,r=0,umin_value=14,umax_value=2054,var_off=(0x2; 0xffc))"}, +- {21, "R4=pkt(id=2,off=4,r=0,umin_value=14,umax_value=2054,var_off=(0x2; 0xffc))"}, ++ {19, "R5_w=pkt(id=2,off=0,r=0,umin_value=14,umax_value=2054,var_off=(0x2; 0xffc)"}, ++ {21, "R4=pkt(id=2,off=4,r=0,umin_value=14,umax_value=2054,var_off=(0x2; 0xffc)"}, + /* At the time the word size load is performed from R5, + * its total fixed offset is NET_IP_ALIGN + reg->off (0) + * which is 2. Then the variable offset is (4n+2), so + * the total offset is 4-byte aligned and meets the + * load's requirements. + */ +- {23, "R5=pkt(id=2,off=0,r=4,umin_value=14,umax_value=2054,var_off=(0x2; 0xffc))"}, ++ {23, "R5=pkt(id=2,off=0,r=4,umin_value=14,umax_value=2054,var_off=(0x2; 0xffc)"}, + }, + }, + { +@@ -469,16 +469,16 @@ static struct bpf_align_test tests[] = { + .matches = { + {4, "R5_w=pkt_end(id=0,off=0,imm=0)"}, + /* (ptr - ptr) << 2 == unknown, (4n) */ +- {6, "R5_w=inv(id=0,smax_value=9223372036854775804,umax_value=18446744073709551612,var_off=(0x0; 0xfffffffffffffffc))"}, ++ {6, "R5_w=inv(id=0,smax_value=9223372036854775804,umax_value=18446744073709551612,var_off=(0x0; 0xfffffffffffffffc)"}, + /* (4n) + 14 == (4n+2). We blow our bounds, because + * the add could overflow. + */ +- {7, "R5=inv(id=0,var_off=(0x2; 0xfffffffffffffffc))"}, ++ {7, "R5=inv(id=0,smin_value=-9223372036854775806,smax_value=9223372036854775806,umin_value=2,umax_value=18446744073709551614,var_off=(0x2; 0xfffffffffffffffc)"}, + /* Checked s>=0 */ +- {9, "R5=inv(id=0,umin_value=2,umax_value=9223372036854775806,var_off=(0x2; 0x7ffffffffffffffc))"}, ++ {9, "R5=inv(id=0,umin_value=2,umax_value=9223372034707292158,var_off=(0x2; 0x7fffffff7ffffffc)"}, + /* packet pointer + nonnegative (4n+2) */ +- {11, "R6_w=pkt(id=1,off=0,r=0,umin_value=2,umax_value=9223372036854775806,var_off=(0x2; 0x7ffffffffffffffc))"}, +- {13, "R4=pkt(id=1,off=4,r=0,umin_value=2,umax_value=9223372036854775806,var_off=(0x2; 0x7ffffffffffffffc))"}, ++ {11, "R6_w=pkt(id=1,off=0,r=0,umin_value=2,umax_value=9223372034707292158,var_off=(0x2; 0x7fffffff7ffffffc)"}, ++ {13, "R4=pkt(id=1,off=4,r=0,umin_value=2,umax_value=9223372034707292158,var_off=(0x2; 0x7fffffff7ffffffc)"}, + /* NET_IP_ALIGN + (4n+2) == (4n), alignment is fine. + * We checked the bounds, but it might have been able + * to overflow if the packet pointer started in the +@@ -486,7 +486,7 @@ static struct bpf_align_test tests[] = { + * So we did not get a 'range' on R6, and the access + * attempt will fail. + */ +- {15, "R6=pkt(id=1,off=0,r=0,umin_value=2,umax_value=9223372036854775806,var_off=(0x2; 0x7ffffffffffffffc))"}, ++ {15, "R6=pkt(id=1,off=0,r=0,umin_value=2,umax_value=9223372034707292158,var_off=(0x2; 0x7fffffff7ffffffc)"}, + } + }, + { +@@ -528,7 +528,7 @@ static struct bpf_align_test tests[] = { + /* New unknown value in R7 is (4n) */ + {11, "R7_w=inv(id=0,umax_value=1020,var_off=(0x0; 0x3fc))"}, + /* Subtracting it from R6 blows our unsigned bounds */ +- {12, "R6=inv(id=0,smin_value=-1006,smax_value=1034,var_off=(0x2; 0xfffffffffffffffc))"}, ++ {12, "R6=inv(id=0,smin_value=-1006,smax_value=1034,umin_value=2,umax_value=18446744073709551614,var_off=(0x2; 0xfffffffffffffffc)"}, + /* Checked s>= 0 */ + {14, "R6=inv(id=0,umin_value=2,umax_value=1034,var_off=(0x2; 0x7fc))"}, + /* At the time the word size load is performed from R5, +@@ -537,7 +537,8 @@ static struct bpf_align_test tests[] = { + * the total offset is 4-byte aligned and meets the + * load's requirements. + */ +- {20, "R5=pkt(id=1,off=0,r=4,umin_value=2,umax_value=1034,var_off=(0x2; 0x7fc))"}, ++ {20, "R5=pkt(id=1,off=0,r=4,umin_value=2,umax_value=1034,var_off=(0x2; 0x7fc)"}, ++ + }, + }, + { +@@ -579,18 +580,18 @@ static struct bpf_align_test tests[] = { + /* Adding 14 makes R6 be (4n+2) */ + {11, "R6_w=inv(id=0,umin_value=14,umax_value=74,var_off=(0x2; 0x7c))"}, + /* Subtracting from packet pointer overflows ubounds */ +- {13, "R5_w=pkt(id=1,off=0,r=8,umin_value=18446744073709551542,umax_value=18446744073709551602,var_off=(0xffffffffffffff82; 0x7c))"}, ++ {13, "R5_w=pkt(id=1,off=0,r=8,umin_value=18446744073709551542,umax_value=18446744073709551602,var_off=(0xffffffffffffff82; 0x7c)"}, + /* New unknown value in R7 is (4n), >= 76 */ + {15, "R7_w=inv(id=0,umin_value=76,umax_value=1096,var_off=(0x0; 0x7fc))"}, + /* Adding it to packet pointer gives nice bounds again */ +- {16, "R5_w=pkt(id=2,off=0,r=0,umin_value=2,umax_value=1082,var_off=(0x2; 0x7fc))"}, ++ {16, "R5_w=pkt(id=2,off=0,r=0,umin_value=2,umax_value=1082,var_off=(0x2; 0xfffffffc)"}, + /* At the time the word size load is performed from R5, + * its total fixed offset is NET_IP_ALIGN + reg->off (0) + * which is 2. Then the variable offset is (4n+2), so + * the total offset is 4-byte aligned and meets the + * load's requirements. + */ +- {20, "R5=pkt(id=2,off=0,r=4,umin_value=2,umax_value=1082,var_off=(0x2; 0x7fc))"}, ++ {20, "R5=pkt(id=2,off=0,r=4,umin_value=2,umax_value=1082,var_off=(0x2; 0xfffffffc)"}, + }, + }, + }; diff --git a/queue-4.19/series b/queue-4.19/series index b4d18e89d46..afd11579348 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -21,3 +21,6 @@ ovl-drop-warn_on-dentry-is-null-in-ovl_encode_fh.patch parisc-fix-device-names-in-proc-iomem.patch drm-nouveau-fix-another-off-by-one-in-nvbios_addr.patch drm-amdgpu-check-bo-s-requested-pinning-domains-against-its-preferred_domains.patch +bpf-verifer-adjust_scalar_min_max_vals-to-always-call-update_reg_bounds.patch +selftests-bpf-fix-test_align-verifier-log-patterns.patch +selftests-bpf-fix-dubious-pointer-arithmetic-test.patch -- 2.47.3