kernel-hardening - Re: arch: arm: bpf: Converting cBPF to eBPF for arm 32 bit

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAHgaXd+2vF=d5zpWTg+a=vSnv2ZA+8LCR_MXT_MDKn4r2s8sig@mail.gmail.com>
Date: Sun, 7 May 2017 01:57:48 +0530
From: Shubham Bansal <illusionist.neo@...il.com>
To: David Miller <davem@...emloft.net>
Cc: Daniel Borkmann <daniel@...earbox.net>, Kees Cook <keescook@...omium.org>, 
	Mircea Gherzan <mgherzan@...il.com>, Network Development <netdev@...r.kernel.org>, 
	kernel-hardening@...ts.openwall.com, linux-arm-kernel@...ts.infradead.org, 
	ast@...com
Subject: Re: arch: arm: bpf: Converting cBPF to eBPF for arm 32 bit

Thanks David.

Hi all,

I have two questions about the code at arch/arm64/net/bpf_jit_comp.c.

1. At line 708, " const u8 r1 = bpf2a64[BPF_REG_1]; /* r1: struct
sk_buff *skb */ ".
    Why is this code using BPF_REG_1 before saving it? As far as I
know, BPF_REG_1 has pointer to bpf program context and this code
clearly is overwriting that pointer which makes that pointer useless
for future usage. It clearly looks like a bug.

2. At line 256, " emit(A64_LDR64(prg, tmp, r3), ctx); ".
    This line of code is used to load an array( of pointers ) element,
where r3 is used as an index of that array. Shouldn't it be be
arithmetic left shifted by 3 or multiplied by 8 to get the right
address in that array of pointers ?

Apologies if any of the above question is stupid to ask.

Best,
Shubham
Best,
Shubham Bansal


On Sun, May 7, 2017 at 12:08 AM, David Miller <davem@...emloft.net> wrote:
> From: Shubham Bansal <illusionist.neo@...il.com>
> Date: Sat, 6 May 2017 22:18:16 +0530
>
>> Hi Daniel,
>>
>> Thanks for the last reply about the testing of eBPF JIT.
>>
>> I have one issue though, I am not able to find what BPF_ABS and
>> BPF_IND instruction does exactly.
>
> They are not instructions, they are modifiers for the BPF_LD
> instruction which indicate an SKB load is to be performed.
>
> You never need to ask what a BPF instruction does, it is clear
> defined in the BPF interperter found in kernel/bpf/core.c
>
> Look for the case statement LD_ABS_W and friends in __bpf_prog_run().

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.