| From a7036191277f9fa68d92f2071ddc38c09b1e5ee5 Mon Sep 17 00:00:00 2001 |
| From: Daniel Borkmann <daniel@iogearbox.net> |
| Date: Tue, 4 May 2021 08:58:25 +0000 |
| Subject: bpf: No need to simulate speculative domain for immediates |
| |
| From: Daniel Borkmann <daniel@iogearbox.net> |
| |
| commit a7036191277f9fa68d92f2071ddc38c09b1e5ee5 upstream. |
| |
| In 801c6058d14a ("bpf: Fix leakage of uninitialized bpf stack under |
| speculation") we replaced masking logic with direct loads of immediates |
| if the register is a known constant. Given in this case we do not apply |
| any masking, there is also no reason for the operation to be truncated |
| under the speculative domain. |
| |
| Therefore, there is also zero reason for the verifier to branch-off and |
| simulate this case, it only needs to do it for unknown but bounded scalars. |
| As a side-effect, this also enables few test cases that were previously |
| rejected due to simulation under zero truncation. |
| |
| Signed-off-by: Daniel Borkmann <daniel@iogearbox.net> |
| Reviewed-by: Piotr Krysiuk <piotras@gmail.com> |
| Acked-by: Alexei Starovoitov <ast@kernel.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| kernel/bpf/verifier.c | 6 +++++- |
| 1 file changed, 5 insertions(+), 1 deletion(-) |
| |
| --- a/kernel/bpf/verifier.c |
| +++ b/kernel/bpf/verifier.c |
| @@ -5999,8 +5999,12 @@ do_sim: |
| /* If we're in commit phase, we're done here given we already |
| * pushed the truncated dst_reg into the speculative verification |
| * stack. |
| + * |
| + * Also, when register is a known constant, we rewrite register-based |
| + * operation to immediate-based, and thus do not need masking (and as |
| + * a consequence, do not need to simulate the zero-truncation either). |
| */ |
| - if (commit_window) |
| + if (commit_window || off_is_imm) |
| return 0; |
| |
| /* Simulate and find potential out-of-bounds access under |
