From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752706AbcFZLYL (ORCPT ); Sun, 26 Jun 2016 07:24:11 -0400 Received: from szxga04-in.huawei.com ([58.251.152.52]:22179 "EHLO szxga04-in.huawei.com" rhost-flags-OK-FAIL-OK-FAIL) by vger.kernel.org with ESMTP id S1752571AbcFZLWN (ORCPT ); Sun, 26 Jun 2016 07:22:13 -0400 From: He Kuang To: , , , , , , , , CC: Subject: [RFC PATCH v2 22/26] perf bpf: Implement boundary check code in ubpf Date: Sun, 26 Jun 2016 11:21:14 +0000 Message-ID: <1466940078-65581-23-git-send-email-hekuang@huawei.com> X-Mailer: git-send-email 1.8.3.4 In-Reply-To: <1466940078-65581-1-git-send-email-hekuang@huawei.com> References: <1466940078-65581-1-git-send-email-hekuang@huawei.com> MIME-Version: 1.0 Content-Type: text/plain X-Originating-IP: [10.107.193.250] X-CFilter-Loop: Reflected X-Mirapoint-Virus-RAPID-Raw: score=unknown(0), refid=str=0001.0A090202.576FBAD8.006A,ss=1,re=0.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0, ip=0.0.0.0, so=2014-11-16 11:51:01, dmn=2013-03-21 17:37:32 X-Mirapoint-Loop-Id: b495543de93871f16bd913f0d82a1dee Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Make sure that ubpf load/store instructions only access the context and stack region. Signed-off-by: He Kuang --- tools/perf/util/bpf-vm.c | 35 +++++++++++++++++++++++++++++++++++ tools/perf/util/bpf-vm.h | 3 ++- 2 files changed, 37 insertions(+), 1 deletion(-) diff --git a/tools/perf/util/bpf-vm.c b/tools/perf/util/bpf-vm.c index 23ac784..191ed42 100644 --- a/tools/perf/util/bpf-vm.c +++ b/tools/perf/util/bpf-vm.c @@ -2,6 +2,11 @@ #include "util.h" #include "tools/be_byteshift.h" #include "bpf-vm.h" +#include "debug.h" +#include + +#define DST regs[insn->dst_reg] +#define SRC regs[insn->src_reg] static inline void bpf_vm_jmp_call_handler(u64 *regs __maybe_unused, void *ctx __maybe_unused, @@ -30,5 +35,35 @@ static inline void *bpf_load_pointer(const void *skb __maybe_unused, return NULL; } +static bool +bounds_check(void *addr, int size, void *ctx, size_t ctx_len, void *stack) +{ + if (ctx && (addr >= ctx && (addr + size) <= (ctx + ctx_len))) { + /* Context access */ + return true; + } else if (addr >= stack && (addr + size) <= (stack + MAX_BPF_STACK)) { + /* Stack access */ + return true; + } + + pr_debug("bpf: bounds_check failed\n"); + return false; +} + +#define BOUNDS_CHECK_LOAD(size) \ + do { \ + if (!bounds_check((void *)SRC + insn->off, size, \ + ctx, ctx_len, stack)) { \ + return -1; \ + } \ + } while (0) +#define BOUNDS_CHECK_STORE(size) \ + do { \ + if (!bounds_check((void *)DST + insn->off, size, \ + ctx, ctx_len, stack)) { \ + return -1; \ + } \ + } while (0) + #define UBPF_BUILD #include <../../../kernel/bpf/vm.c> diff --git a/tools/perf/util/bpf-vm.h b/tools/perf/util/bpf-vm.h index bf96caa..66956fbb 100644 --- a/tools/perf/util/bpf-vm.h +++ b/tools/perf/util/bpf-vm.h @@ -2,6 +2,7 @@ #define _BPF_VM_H struct bpf_insn; -unsigned int __bpf_prog_run(void *ctx, const struct bpf_insn *insn); +unsigned int __bpf_prog_run(void *ctx, const struct bpf_insn *insn, + size_t ctx_len); #endif /* _BPF_VM_H */ -- 1.8.5.2