• Yonghong Song's avatar
    bpf: Handle spilled PTR_TO_BTF_ID properly when checking stack_boundary · 1d68f22b
    Yonghong Song authored
    This specifically to handle the case like below:
       // ptr below is a socket ptr identified by PTR_TO_BTF_ID
       u64 param[2] = { ptr, val };
       bpf_seq_printf(seq, fmt, sizeof(fmt), param, sizeof(param));
    
    In this case, the 16 bytes stack for "param" contains:
       8 bytes for ptr with spilled PTR_TO_BTF_ID
       8 bytes for val as STACK_MISC
    
    The current verifier will complain the ptr should not be visible
    to the helper.
       ...
       16: (7b) *(u64 *)(r10 -64) = r2
       18: (7b) *(u64 *)(r10 -56) = r1
       19: (bf) r4 = r10
       ;
       20: (07) r4 += -64
       ; BPF_SEQ_PRINTF(seq, fmt1, (long)s, s->sk_protocol);
       21: (bf) r1 = r6
       22: (18) r2 = 0xffffa8d00018605a
       24: (b4) w3 = 10
       25: (b4) w5 = 16
       26: (85) call bpf_seq_printf#125
        R0=inv(id=0) R1_w=ptr_seq_file(id=0,off=0,imm=0)
        R2_w=map_value(id=0,off=90,ks=4,vs=144,imm=0) R3_w=inv10
        R4_w=fp-64 R5_w=inv16 R6=ptr_seq_file(id=0,off=0,imm=0)
        R7=ptr_netlink_sock(id=0,off=0,imm=0) R10=fp0 fp-56_w=mmmmmmmm
        fp-64_w=ptr_
       last_idx 26 first_idx 13
       regs=8 stack=0 before 25: (b4) w5 = 16
       regs=8 stack=0 before 24: (b4) w3 = 10
       invalid indirect read from stack off -64+0 size 16
    Signed-off-by: default avatarYonghong Song <yhs@fb.com>
    Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
    Acked-by: default avatarAndrii Nakryiko <andriin@fb.com>
    Link: https://lore.kernel.org/bpf/20200509175915.2476783-1-yhs@fb.com
    1d68f22b
verifier.c 313 KB