This group is locked. No changes can be made to the group while it is locked.
Re: More BPF verifier questions
Edward Cree <ecree@...>
On 05/06/17 19:47, Josef Bacik wrote:
On Mon, Jun 05, 2017 at 11:11:05AM -0700, Alexei Starovoitov wrote:Here's the basic idea:Do you have an asm test case that demonstrates that?From here we want to exploit the fact that false_reg->min_value is not
r1 = -8
r2 = -1
JGT r1, r2, end
JSGT r1, 1, end
ptr += r1
*(u8 *)ptr = 0
After the JGT, we're in the false branch so r1->min_value = 0 and r1->max_value
After the JSGT, we're again in the false branch so r1->max_value = 1.
So when we add r1 to the pointer, the verifier thinks it's safe, but it's not,
because r1 is really negative.
And here's the asm:
BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0),
BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8),
BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0,
BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 7),
BPF_ST_MEM(BPF_DW, BPF_REG_10, -16, -8),
BPF_LDX_MEM(BPF_DW, BPF_REG_1, BPF_REG_10, -16),
BPF_JMP_REG(BPF_JGT, BPF_REG_1, BPF_REG_2, 3),
BPF_JMP_IMM(BPF_JSGT, BPF_REG_1, 1, 2),
BPF_ALU64_REG(BPF_ADD, BPF_REG_0, BPF_REG_1),
BPF_ST_MEM(BPF_B, BPF_REG_0, 0, 0),
The verifier currently accepts this program (with an appropriate map fd), but I
believe when run it will access invalid memory.