Re: [iovisor-dev] [PATCH v3 net-next 02/12] bpf/verifier: rework value tracking

2017-07-17 Thread Edward Cree
On 12/07/17 23:07, Nadav Amit wrote: > Edward Cree wrote: >> In this specific case, there was a bug before: if (say) src and dst were >> both unknown bytes (so range 0 to 255), it would compute the new min and max >> to be 0, so it would think the result is known to be 0.

Re: [iovisor-dev] [PATCH v3 net-next 02/12] bpf/verifier: rework value tracking

2017-07-12 Thread Nadav Amit
Edward Cree wrote: > On 07/07/17 18:45, Nadav Amit wrote: >> For me changes such as: >> >>> if (dst_reg->min_value != BPF_REGISTER_MIN_RANGE) >>> - dst_reg->min_value -= min_val; >>> + dst_reg->min_value -= max_val; >> >> are purely

Re: [iovisor-dev] [PATCH v3 net-next 02/12] bpf/verifier: rework value tracking

2017-07-12 Thread Edward Cree
On 07/07/17 18:45, Nadav Amit wrote: > For me changes such as: > >> if (dst_reg->min_value != BPF_REGISTER_MIN_RANGE) >> -dst_reg->min_value -= min_val; >> +dst_reg->min_value -= max_val; > > are purely cryptic. What happened here? Was there a

Re: [iovisor-dev] [PATCH v3 net-next 02/12] bpf/verifier: rework value tracking

2017-07-07 Thread Nadav Amit
Nadav Amit wrote: > Edward Cree wrote: > >> On 06/07/17 22:21, Nadav Amit wrote: >>> I find it a bit surprising that such huge changes that can affect security >>> and robustness are performed in one patch. >> In the first version of the series, this

Re: [iovisor-dev] [PATCH v3 net-next 02/12] bpf/verifier: rework value tracking

2017-07-07 Thread Nadav Amit
Edward Cree wrote: > On 06/07/17 22:21, Nadav Amit wrote: >> I find it a bit surprising that such huge changes that can affect security >> and robustness are performed in one patch. > In the first version of the series, this was two patches, with "feed >

Re: [iovisor-dev] [PATCH v3 net-next 02/12] bpf/verifier: rework value tracking

2017-07-07 Thread Edward Cree
On 06/07/17 22:21, Nadav Amit wrote: > I find it a bit surprising that such huge changes that can affect security > and robustness are performed in one patch. In the first version of the series, this was two patches, with "feed pointer-to-unknown-scalar casts into scalar ALU path" split out from

Re: [iovisor-dev] [PATCH v3 net-next 02/12] bpf/verifier: rework value tracking

2017-07-06 Thread Nadav Amit
Edward Cree via iovisor-dev wrote: > Tracks value alignment by means of tracking known & unknown bits. > Tightens some min/max value checks and fixes a couple of bugs therein. > If pointer leaks are allowed, and adjust_ptr_min_max_vals returns -EACCES, > treat the

Re: [PATCH v3 net-next 02/12] bpf/verifier: rework value tracking

2017-06-29 Thread kbuild test robot
Hi Edward, [auto build test ERROR on net-next/master] url: https://github.com/0day-ci/linux/commits/Edward-Cree/bpf-rewrite-value-tracking-in-verifier/20170629-012559 config: ia64-allmodconfig (attached as .config) compiler: ia64-linux-gcc (GCC) 6.2.0 reproduce: wget

Re: [PATCH v3 net-next 02/12] bpf/verifier: rework value tracking

2017-06-28 Thread Daniel Borkmann
On 06/28/2017 06:07 PM, Edward Cree wrote: On 28/06/17 16:15, Daniel Borkmann wrote: On 06/27/2017 02:56 PM, Edward Cree wrote: Tracks value alignment by means of tracking known & unknown bits. Tightens some min/max value checks and fixes a couple of bugs therein. You mean the one in

Re: [PATCH v3 net-next 02/12] bpf/verifier: rework value tracking

2017-06-28 Thread Edward Cree
On 28/06/17 18:09, Daniel Borkmann wrote: > Could you elaborate on this one? If I understand it correctly, then > the scalar += pointer case would mean the following: given I have one > of the allowed pointer types in adjust_ptr_min_max_vals() then the > prior scalar type inherits the ptr type/id.

Re: [PATCH v3 net-next 02/12] bpf/verifier: rework value tracking

2017-06-28 Thread Daniel Borkmann
On 06/27/2017 02:56 PM, Edward Cree wrote: Tracks value alignment by means of tracking known & unknown bits. Tightens some min/max value checks and fixes a couple of bugs therein. If pointer leaks are allowed, and adjust_ptr_min_max_vals returns -EACCES, treat the pointer as an unknown scalar

Re: [PATCH v3 net-next 02/12] bpf/verifier: rework value tracking

2017-06-28 Thread Edward Cree
On 28/06/17 16:15, Daniel Borkmann wrote: > On 06/27/2017 02:56 PM, Edward Cree wrote: >> Tracks value alignment by means of tracking known & unknown bits. >> Tightens some min/max value checks and fixes a couple of bugs therein. > > You mean the one in relation to patch 1/12? Would be good to

Re: [PATCH v3 net-next 02/12] bpf/verifier: rework value tracking

2017-06-28 Thread Daniel Borkmann
On 06/27/2017 02:56 PM, Edward Cree wrote: Tracks value alignment by means of tracking known & unknown bits. Tightens some min/max value checks and fixes a couple of bugs therein. You mean the one in relation to patch 1/12? Would be good to elaborate here since otherwise this gets forgotten

[PATCH v3 net-next 02/12] bpf/verifier: rework value tracking

2017-06-27 Thread Edward Cree
Tracks value alignment by means of tracking known & unknown bits. Tightens some min/max value checks and fixes a couple of bugs therein. If pointer leaks are allowed, and adjust_ptr_min_max_vals returns -EACCES, treat the pointer as an unknown scalar and try again, because we might be able to