v2, from the review of v1:
- Shift the index as a 32-bit value instead of inserting an explicit
zero-extension (Alexei). The inlined sequence is one instruction shorter
and the bounds check is untouched, so no program is accepted or rejected
differently.
- The selftest is now a separate patch (Jiri). Patch 2 keeps Jiri's
Acked-by from v1; patch 1 does not, because the kernel patch changed.
v1, the problem: bpf_get_func_arg() takes a u32 index, but the inlined
expansion compared only the low 32 bits of R2 with the argument count and
then shifted the full 64-bit register to compute the context address. R2 is
ARG_ANYTHING, so an index of 1ULL << 32 passed the bounds check as index
zero while the load was performed at ctx + (1ULL << 35).
Patch 2 depends on patch 1: without it the wide index faults in the inlined
sequence and the guest panics.
Validation, re-run with this revision (the 32-bit shift kernel):
- Disposable x86_64 QEMU guest running a BTF-enabled kernel built with
clang 22, with tracing and bpf_testmod. test_progs output, verbatim:
#150 get_func_args_fsession_test:OK
#151 get_func_args_test:OK
Summary: 2/0 PASSED, 0 SKIPPED, 0/0 FAILED
The pairs in that line are top-level tests/subtests, so both tests pass
with nothing skipped or failed; TEST_PROGS_EXIT=0 and the guest dmesg is
clean.
- The same two tests on unpatched ff47652a4b66 fault in the inlined
sequence: a page fault in bpf_prog_..._test2, with the load performed at
ctx + (1ULL << 35), which panics the guest.
- bpftool xlated dumps of both test programs show the index shifted as a
32-bit value (w2 <<= 3) at all 32 inlined helper sites on this kernel,
and the 64-bit shift (r2 <<= 3) at all 32 on unpatched ff47652a4b66.
v1:
https://lore.kernel.org/bpf/179221432098.1890560.17043109037413683447.get-func-arg-in...@gmail.com/
---
Woojin Ji (2):
bpf: Zero-extend the index in inlined bpf_get_func_arg()
selftests/bpf: Test out-of-range index bits in bpf_get_func_arg()
kernel/bpf/fixups.c | 2 +-
.../selftests/bpf/progs/get_func_args_test.c | 36 ++++++++++++++++++++++
2 files changed, 37 insertions(+), 1 deletion(-)
---
base-commit: ff47652a4b66c067c765a7ad464d930b5a9367cc
change-id: 20261018-get-func-arg-93c80d63ef45
Best regards,
--
Woojin Ji <[email protected]>
