Skip to content

bpf: Do not include stack ptr register in precision backtracking bookkeeping #8980

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 2 commits into
base: bpf-next_base
Choose a base branch
from
Open

bpf: Do not include stack ptr register in precision backtracking bookkeeping #8980

wants to merge 2 commits into from
+77 −6

Conversation

kernel-patches-daemon-bpf[bot]
Copy link

Pull request for series with
subject: bpf: Do not include stack ptr register in precision backtracking bookkeeping
version: 3
url: https://patchwork.kernel.org/project/netdevbpf/list/?series=965077

@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: 25b6d5d
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=965077
version: 3

@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: 25b6d5d
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=965229
version: 4

@kernel-patches-daemon-bpf kernel-patches-daemon-bpf bot force-pushed the series/965077=>bpf-next branch from 21b88be to 2a88fe3 Compare May 22, 2025 05:10
@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: 4e2e684
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=965229
version: 4

@kernel-patches-daemon-bpf kernel-patches-daemon-bpf bot force-pushed the series/965077=>bpf-next branch from 2a88fe3 to 45e99a3 Compare May 22, 2025 15:00
@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: d90f0bc
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=965229
version: 4

@kernel-patches-daemon-bpf kernel-patches-daemon-bpf bot force-pushed the series/965077=>bpf-next branch from 45e99a3 to 644cc8c Compare May 22, 2025 15:49
@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: 5ead949
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=965229
version: 4

@kernel-patches-daemon-bpf kernel-patches-daemon-bpf bot force-pushed the series/965077=>bpf-next branch from 644cc8c to 3332561 Compare May 22, 2025 16:36
@kernel-patches-daemon-bpf
Copy link
Author

At least one diff in series https://patchwork.kernel.org/project/netdevbpf/list/?series=965229 expired. Closing PR.

@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: 079e5c5
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=966084
version: 5

@kernel-patches-daemon-bpf kernel-patches-daemon-bpf bot force-pushed the series/965077=>bpf-next branch from 3332561 to 7c4f8c1 Compare May 24, 2025 04:42
@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: db22b13
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=966084
version: 5

@kernel-patches-daemon-bpf kernel-patches-daemon-bpf bot force-pushed the series/965077=>bpf-next branch from 7c4f8c1 to 039bc43 Compare May 27, 2025 16:54
@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: 1ae7a84
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=966084
version: 5

@kernel-patches-daemon-bpf kernel-patches-daemon-bpf bot force-pushed the series/965077=>bpf-next branch from 039bc43 to 3442d68 Compare May 27, 2025 17:34
@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: 86bc9c7
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=966084
version: 5

@kernel-patches-daemon-bpf kernel-patches-daemon-bpf bot force-pushed the series/965077=>bpf-next branch from 3442d68 to 2b1b984 Compare May 27, 2025 17:47
@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: d496557
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=966084
version: 5

@kernel-patches-daemon-bpf kernel-patches-daemon-bpf bot force-pushed the series/965077=>bpf-next branch from 2b1b984 to e3ebdf8 Compare May 27, 2025 17:52
Yonghong Song added 2 commits May 27, 2025 10:59
bpf: Do not include stack ptr register in precision backtracking book…
8a70102 
…keeping

Yi Lai reported an issue ([1]) where the following warning appears
in kernel dmesg:
  [   60.643604] verifier backtracking bug
  [   60.643635] WARNING: CPU: 10 PID: 2315 at kernel/bpf/verifier.c:4302 __mark_chain_precision+0x3a6c/0x3e10
  [   60.648428] Modules linked in: bpf_testmod(OE)
  [   60.650471] CPU: 10 UID: 0 PID: 2315 Comm: test_progs Tainted: G           OE       6.15.0-rc4-gef11287f8289-dirty #327 PREEMPT(full)
  [   60.654385] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
  [   60.656682] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
  [   60.660475] RIP: 0010:__mark_chain_precision+0x3a6c/0x3e10
  [   60.662814] Code: 5a 30 84 89 ea e8 c4 d9 01 00 80 3d 3e 7d d8 04 00 0f 85 60 fa ff ff c6 05 31 7d d8 04
                       01 48 c7 c7 00 58 30 84 e8 c4 06 a5 ff <0f> 0b e9 46 fa ff ff 48 ...
  [   60.668720] RSP: 0018:ffff888116cc7298 EFLAGS: 00010246
  [   60.671075] RAX: 54d70e82dfd31900 RBX: ffff888115b65e20 RCX: 0000000000000000
  [   60.673659] RDX: 0000000000000001 RSI: 0000000000000004 RDI: 00000000ffffffff
  [   60.676241] RBP: 0000000000000400 R08: ffff8881f6f23bd3 R09: 1ffff1103ede477a
  [   60.678787] R10: dffffc0000000000 R11: ffffed103ede477b R12: ffff888115b60ae8
  [   60.681420] R13: 1ffff11022b6cbc4 R14: 00000000fffffff2 R15: 0000000000000001
  [   60.684030] FS:  00007fc2aedd80c0(0000) GS:ffff88826fa8a000(0000) knlGS:0000000000000000
  [   60.686837] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  [   60.689027] CR2: 000056325369e000 CR3: 000000011088b002 CR4: 0000000000370ef0
  [   60.691623] Call Trace:
  [   60.692821]  <TASK>
  [   60.693960]  ? __pfx_verbose+0x10/0x10
  [   60.695656]  ? __pfx_disasm_kfunc_name+0x10/0x10
  [   60.697495]  check_cond_jmp_op+0x16f7/0x39b0
  [   60.699237]  do_check+0x58fa/0xab10
  ...

Further analysis shows the warning is at line 4302 as below:

  4294                 /* static subprog call instruction, which
  4295                  * means that we are exiting current subprog,
  4296                  * so only r1-r5 could be still requested as
  4297                  * precise, r0 and r6-r10 or any stack slot in
  4298                  * the current frame should be zero by now
  4299                  */
  4300                 if (bt_reg_mask(bt) & ~BPF_REGMASK_ARGS) {
  4301                         verbose(env, "BUG regs %x\n", bt_reg_mask(bt));
  4302                         WARN_ONCE(1, "verifier backtracking bug");
  4303                         return -EFAULT;
  4304                 }

With the below test (also in the next patch):
  __used __naked static void __bpf_jmp_r10(void)
  {
	asm volatile (
	"r2 = 2314885393468386424 ll;"
	"goto +0;"
	"if r2 <= r10 goto +3;"
	"if r1 >= -1835016 goto +0;"
	"if r2 <= 8 goto +0;"
	"if r3 <= 0 goto +0;"
	"exit;"
	::: __clobber_all);
  }

  SEC("?raw_tp")
  __naked void bpf_jmp_r10(void)
  {
	asm volatile (
	"r3 = 0 ll;"
	"call __bpf_jmp_r10;"
	"r0 = 0;"
	"exit;"
	::: __clobber_all);
  }

The following is the verifier failure log:
  0: (18) r3 = 0x0                      ; R3_w=0
  2: (85) call pc+2
  caller:
   R10=fp0
  callee:
   frame1: R1=ctx() R3_w=0 R10=fp0
  5: frame1: R1=ctx() R3_w=0 R10=fp0
  ; asm volatile ("                                 \ @ verifier_precision.c:184
  5: (18) r2 = 0x20202000256c6c78       ; frame1: R2_w=0x20202000256c6c78
  7: (05) goto pc+0
  8: (bd) if r2 <= r10 goto pc+3        ; frame1: R2_w=0x20202000256c6c78 R10=fp0
  9: (35) if r1 >= 0xffe3fff8 goto pc+0         ; frame1: R1=ctx()
  10: (b5) if r2 <= 0x8 goto pc+0
  mark_precise: frame1: last_idx 10 first_idx 0 subseq_idx -1
  mark_precise: frame1: regs=r2 stack= before 9: (35) if r1 >= 0xffe3fff8 goto pc+0
  mark_precise: frame1: regs=r2 stack= before 8: (bd) if r2 <= r10 goto pc+3
  mark_precise: frame1: regs=r2,r10 stack= before 7: (05) goto pc+0
  mark_precise: frame1: regs=r2,r10 stack= before 5: (18) r2 = 0x20202000256c6c78
  mark_precise: frame1: regs=r10 stack= before 2: (85) call pc+2
  BUG regs 400

The main failure reason is due to r10 in precision backtracking bookkeeping.
Actually r10 is always precise and there is no need to add it for the precision
backtracking bookkeeping.

One way to fix the issue is to prevent bt_set_reg() if any src/dst reg is
r10. Andrii suggested to go with push_insn_history() approach to avoid
explicitly checking r10 in backtrack_insn().

This patch added push_insn_history() support for cond_jmp like 'rX <op> rY'
operations. In check_cond_jmp_op(), if any of rX or rY is a stack pointer,
push_insn_history() will record such information, and later backtrack_insn()
will do bt_set_reg() properly for those register(s).

  [1] https://lore.kernel.org/bpf/Z%2F8q3xzpU59CIYQE@ly-workstation/

Reported by: Yi Lai <[email protected]>
Fixes: 407958a ("bpf: encapsulate precision backtracking bookkeeping")
Signed-off-by: Yonghong Song <[email protected]>
selftests/bpf: Add tests with stack ptr register in conditional jmp
2543842 
Add two tests:
  - one test has 'rX <op> r10' where rX is not r10, and
  - another test has 'rX <op> rY' where rX and rY are not r10
    but there is an early insn 'rX = r10'.

Without previous verifier change, both tests will fail.

Signed-off-by: Yonghong Song <[email protected]>
@kernel-patches-daemon-bpf
Copy link
Author

Upstream branch: ca56fbd
series: https://patchwork.kernel.org/project/netdevbpf/list/?series=966084
version: 5

@kernel-patches-daemon-bpf kernel-patches-daemon-bpf bot force-pushed the series/965077=>bpf-next branch from e3ebdf8 to 2543842 Compare May 27, 2025 17:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
bpf-next new V5-ci-pass V5
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
0 participants