| Message ID | 20231009161414.235829-1-void@manifault.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 829955981c557c7fc7416581c4cd68a8a0c28620 |
| Delegated to: | BPF |
| Headers | show |
| Series | [bpf-next,1/2] bpf: Fix verifier log for async callback return values | expand |
Hello: This series was applied to bpf/bpf.git (master) by Daniel Borkmann <daniel@iogearbox.net>: On Mon, 9 Oct 2023 11:14:13 -0500 you wrote: > The verifier, as part of check_return_code(), verifies that async > callbacks such as from e.g. timers, will return 0. It does this by > correctly checking that R0->var_off is in tnum_const(0), which > effectively checks that it's in a range of 0. If this condition fails, > however, it prints an error message which says that the value should > have been in (0x0; 0x1). This results in possibly confusing output such > as the following in which an async callback returns 1: > > [...] Here is the summary with links: - [bpf-next,1/2] bpf: Fix verifier log for async callback return values https://git.kernel.org/bpf/bpf/c/829955981c55 - [bpf-next,2/2] bpf/selftests: Add testcase for async callback return value failure https://git.kernel.org/bpf/bpf/c/57ddeb86b311 You are awesome, thank you!
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index eed7350e15f4..9093fb74c88e 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -14729,7 +14729,7 @@ static int check_return_code(struct bpf_verifier_env *env, int regno) struct tnum enforce_attach_type_range = tnum_unknown; const struct bpf_prog *prog = env->prog; struct bpf_reg_state *reg; - struct tnum range = tnum_range(0, 1); + struct tnum range = tnum_range(0, 1), const_0 = tnum_const(0); enum bpf_prog_type prog_type = resolve_prog_type(env->prog); int err; struct bpf_func_state *frame = env->cur_state->frame[0]; @@ -14777,8 +14777,8 @@ static int check_return_code(struct bpf_verifier_env *env, int regno) return -EINVAL; } - if (!tnum_in(tnum_const(0), reg->var_off)) { - verbose_invalid_scalar(env, reg, &range, "async callback", "R0"); + if (!tnum_in(const_0, reg->var_off)) { + verbose_invalid_scalar(env, reg, &const_0, "async callback", "R0"); return -EINVAL; } return 0;
The verifier, as part of check_return_code(), verifies that async callbacks such as from e.g. timers, will return 0. It does this by correctly checking that R0->var_off is in tnum_const(0), which effectively checks that it's in a range of 0. If this condition fails, however, it prints an error message which says that the value should have been in (0x0; 0x1). This results in possibly confusing output such as the following in which an async callback returns 1: At async callback the register R0 has value (0x1; 0x0) should have been in (0x0; 0x1) The fix is easy -- we should just pass the tnum_const(0) as the correct range to verbose_invalid_scalar(), which will then print the following: At async callback the register R0 has value (0x1; 0x0) should have been in (0x0; 0x0) Fixes: bfc6bb74e4f1 ("bpf: Implement verifier support for validation of async callbacks.") Signed-off-by: David Vernet <void@manifault.com> --- kernel/bpf/verifier.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)