linux-stable/kernel/bpf
John Fastabend cac616db39 bpf: Verifier track null pointer branch_taken with JNE and JEQ
Currently, when considering the branches that may be taken for a jump
instruction if the register being compared is a pointer the verifier
assumes both branches may be taken. But, if the jump instruction
is comparing if a pointer is NULL we have this information in the
verifier encoded in the reg->type so we can do better in these cases.
Specifically, these two common cases can be handled.

 * If the instruction is BPF_JEQ and we are comparing against a
   zero value. This test is 'if ptr == 0 goto +X' then using the
   type information in reg->type we can decide if the ptr is not
   null. This allows us to avoid pushing both branches onto the
   stack and instead only use the != 0 case. For example
   PTR_TO_SOCK and PTR_TO_SOCK_OR_NULL encode the null pointer.
   Note if the type is PTR_TO_SOCK_OR_NULL we can not learn anything.
   And also if the value is non-zero we learn nothing because it
   could be any arbitrary value a different pointer for example

 * If the instruction is BPF_JNE and ware comparing against a zero
   value then a similar analysis as above can be done. The test in
   asm looks like 'if ptr != 0 goto +X'. Again using the type
   information if the non null type is set (from above PTR_TO_SOCK)
   we know the jump is taken.

In this patch we extend is_branch_taken() to consider this extra
information and to return only the branch that will be taken. This
resolves a verifier issue reported with C code like the following.
See progs/test_sk_lookup_kern.c in selftests.

 sk = bpf_sk_lookup_tcp(skb, tuple, tuple_len, BPF_F_CURRENT_NETNS, 0);
 bpf_printk("sk=%d\n", sk ? 1 : 0);
 if (sk)
   bpf_sk_release(sk);
 return sk ? TC_ACT_OK : TC_ACT_UNSPEC;

In the above the bpf_printk() will resolve the pointer from
PTR_TO_SOCK_OR_NULL to PTR_TO_SOCK. Then the second test guarding
the release will cause the verifier to walk both paths resulting
in the an unreleased sock reference. See verifier/ref_tracking.c
in selftests for an assembly version of the above.

After the above additional logic is added the C code above passes
as expected.

Reported-by: Andrey Ignatov <rdna@fb.com>
Suggested-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/159009164651.6313.380418298578070501.stgit@john-Precision-5820-Tower
2020-05-21 17:44:25 -07:00
..
arraymap.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2020-05-15 13:48:59 -07:00
bpf_iter.c bpf: Enable bpf_iter targets registering ctx argument types 2020-05-13 12:30:50 -07:00
bpf_lru_list.c
bpf_lru_list.h bpf: Fix a typo "inacitve" -> "inactive" 2020-04-06 21:54:10 +02:00
bpf_lsm.c bpf: lsm: Implement attach, detach and execution 2020-03-30 01:34:00 +02:00
bpf_struct_ops.c bpf: Implement CAP_BPF 2020-05-15 17:29:41 +02:00
bpf_struct_ops_types.h bpf: tcp: Support tcp_congestion_ops in bpf 2020-01-09 08:46:18 -08:00
btf.c bpf: Enable bpf_iter targets registering ctx argument types 2020-05-13 12:30:50 -07:00
cgroup.c bpf: Add support for BPF_OBJ_GET_INFO_BY_FD for bpf_link 2020-04-28 17:27:08 -07:00
core.c bpf: Implement CAP_BPF 2020-05-15 17:29:41 +02:00
cpumap.c bpf: Implement CAP_BPF 2020-05-15 17:29:41 +02:00
devmap.c xdp: export the DEV_MAP_BULK_SIZE macro 2020-04-22 20:11:29 -07:00
disasm.c
disasm.h
dispatcher.c bpf: Remove bpf_image tree 2020-03-13 12:49:52 -07:00
hashtab.c bpf: Implement CAP_BPF 2020-05-15 17:29:41 +02:00
helpers.c bpf: Implement CAP_BPF 2020-05-15 17:29:41 +02:00
inode.c bpf: Create file bpf iterator 2020-05-09 17:05:26 -07:00
local_storage.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2019-12-22 09:54:33 -08:00
lpm_trie.c bpf: Implement CAP_BPF 2020-05-15 17:29:41 +02:00
Makefile xsk: Move xskmap.c to net/xdp/ 2020-05-21 17:31:26 -07:00
map_in_map.c bpf: Implement CAP_BPF 2020-05-15 17:29:41 +02:00
map_in_map.h
map_iter.c bpf: Enable bpf_iter targets registering ctx argument types 2020-05-13 12:30:50 -07:00
offload.c bpf, offload: Replace bitwise AND by logical AND in bpf_prog_offload_info_fill 2020-02-17 16:53:49 +01:00
percpu_freelist.c bpf: Dont iterate over possible CPUs with interrupts disabled 2020-02-24 16:18:20 -08:00
percpu_freelist.h
queue_stack_maps.c bpf: Implement CAP_BPF 2020-05-15 17:29:41 +02:00
reuseport_array.c bpf: Implement CAP_BPF 2020-05-15 17:29:41 +02:00
stackmap.c bpf: Implement CAP_BPF 2020-05-15 17:29:41 +02:00
syscall.c bpf: Add get{peer, sock}name attach types for sock_addr 2020-05-19 11:32:04 -07:00
sysfs_btf.c bpf: Support llvm-objcopy for vmlinux BTF 2020-03-19 12:32:38 +01:00
task_iter.c bpf: Fix bpf_iter's task iterator logic 2020-05-14 18:37:32 -07:00
tnum.c bpf: Verifier, do explicit ALU32 bounds tracking 2020-03-30 14:59:53 -07:00
trampoline.c bpf: lsm: Implement attach, detach and execution 2020-03-30 01:34:00 +02:00
verifier.c bpf: Verifier track null pointer branch_taken with JNE and JEQ 2020-05-21 17:44:25 -07:00