Re: [PATCH bpf] bpf: do not modify min/max bounds on scalars with constant values

2018-01-15 Thread Y Song
On Mon, Jan 15, 2018 at 2:40 AM, Daniel Borkmann wrote: > On 01/15/2018 07:38 AM, Y Song wrote: >> On Fri, Jan 12, 2018 at 11:23 AM, Daniel Borkmann >> wrote: > [...] >>> >>> I've been thinking to additionally reject arithmetic on ctx >>> pointer in adjust_ptr_min_max_vals() right upfront as wel

Re: [PATCH bpf] bpf: do not modify min/max bounds on scalars with constant values

2018-01-15 Thread Daniel Borkmann
On 01/15/2018 07:38 AM, Y Song wrote: > On Fri, Jan 12, 2018 at 11:23 AM, Daniel Borkmann > wrote: [...] >> >> I've been thinking to additionally reject arithmetic on ctx >> pointer in adjust_ptr_min_max_vals() right upfront as well >> since we reject actual access in such case later on anyway, >

Re: [PATCH bpf] bpf: do not modify min/max bounds on scalars with constant values

2018-01-14 Thread Y Song
On Fri, Jan 12, 2018 at 11:23 AM, Daniel Borkmann wrote: > syzkaller generated a BPF proglet and triggered a warning with > the following: > > 0: (b7) r0 = 0 > 1: (d5) if r0 s<= 0x0 goto pc+0 >R0=inv0 R1=ctx(id=0,off=0,imm=0) R10=fp0 > 2: (1f) r0 -= r1 >R0=inv0 R1=ctx(id=0,off=0,imm=

Re: [PATCH bpf] bpf: do not modify min/max bounds on scalars with constant values

2018-01-12 Thread Daniel Borkmann
On 01/12/2018 08:52 PM, Edward Cree wrote: > On 12/01/18 19:23, Daniel Borkmann wrote: >> syzkaller generated a BPF proglet and triggered a warning with >> the following: >> >> 0: (b7) r0 = 0 >> 1: (d5) if r0 s<= 0x0 goto pc+0 >>R0=inv0 R1=ctx(id=0,off=0,imm=0) R10=fp0 >> 2: (1f) r0 -= r1

Re: [PATCH bpf] bpf: do not modify min/max bounds on scalars with constant values

2018-01-12 Thread Edward Cree
On 12/01/18 19:23, Daniel Borkmann wrote: > syzkaller generated a BPF proglet and triggered a warning with > the following: > > 0: (b7) r0 = 0 > 1: (d5) if r0 s<= 0x0 goto pc+0 >R0=inv0 R1=ctx(id=0,off=0,imm=0) R10=fp0 > 2: (1f) r0 -= r1 >R0=inv0 R1=ctx(id=0,off=0,imm=0) R10=fp0 > v

[PATCH bpf] bpf: do not modify min/max bounds on scalars with constant values

2018-01-12 Thread Daniel Borkmann
syzkaller generated a BPF proglet and triggered a warning with the following: 0: (b7) r0 = 0 1: (d5) if r0 s<= 0x0 goto pc+0 R0=inv0 R1=ctx(id=0,off=0,imm=0) R10=fp0 2: (1f) r0 -= r1 R0=inv0 R1=ctx(id=0,off=0,imm=0) R10=fp0 verifier internal error: known but bad sbounds What happens