This is a note to let you know that I've just added the patch titled
selftests/bpf: Workaround verification failure for fexit_bpf2bpf/func_replace_return_code
to the 6.1-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
selftests-bpf-workaround-verification-failure-for-fexit_bpf2bpf-func_replace_return_code.patch
and it can be found in the queue-6.1 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From stable-owner@xxxxxxxxxxxxxxx Mon Jul 24 14:42:44 2023
From: Eduard Zingerman <eddyz87@xxxxxxxxx>
Date: Mon, 24 Jul 2023 15:42:22 +0300
Subject: selftests/bpf: Workaround verification failure for fexit_bpf2bpf/func_replace_return_code
To: stable@xxxxxxxxxxxxxxx, ast@xxxxxxxxxx
Cc: andrii@xxxxxxxxxx, daniel@xxxxxxxxxxxxx, martin.lau@xxxxxxxxx, yhs@xxxxxx, mykolal@xxxxxx, luizcap@xxxxxxxxxx, Eduard Zingerman <eddyz87@xxxxxxxxx>
Message-ID: <20230724124223.1176479-6-eddyz87@xxxxxxxxx>
From: Yonghong Song <yhs@xxxxxx>
[ Upstream commit 63d78b7e8ca2d0eb8c687a355fa19d01b6fcc723 ]
With latest llvm17, selftest fexit_bpf2bpf/func_replace_return_code
has the following verification failure:
0: R1=ctx(off=0,imm=0) R10=fp0
; int connect_v4_prog(struct bpf_sock_addr *ctx)
0: (bf) r7 = r1 ; R1=ctx(off=0,imm=0) R7_w=ctx(off=0,imm=0)
1: (b4) w6 = 0 ; R6_w=0
; memset(&tuple.ipv4.saddr, 0, sizeof(tuple.ipv4.saddr));
...
; return do_bind(ctx) ? 1 : 0;
179: (bf) r1 = r7 ; R1=ctx(off=0,imm=0) R7=ctx(off=0,imm=0)
180: (85) call pc+147
Func#3 is global and valid. Skipping.
181: R0_w=scalar()
181: (bc) w6 = w0 ; R0_w=scalar() R6_w=scalar(umax=4294967295,var_off=(0x0; 0xffffffff))
182: (05) goto pc-129
; }
54: (bc) w0 = w6 ; R0_w=scalar(umax=4294967295,var_off=(0x0; 0xffffffff)) R6_w=scalar(umax=4294967295,var_off=(0x0; 0xffffffff))
55: (95) exit
At program exit the register R0 has value (0x0; 0xffffffff) should have been in (0x0; 0x1)
processed 281 insns (limit 1000000) max_states_per_insn 1 total_states 26 peak_states 26 mark_read 13
-- END PROG LOAD LOG --
libbpf: prog 'connect_v4_prog': failed to load: -22
The corresponding source code:
__attribute__ ((noinline))
int do_bind(struct bpf_sock_addr *ctx)
{
struct sockaddr_in sa = {};
sa.sin_family = AF_INET;
sa.sin_port = bpf_htons(0);
sa.sin_addr.s_addr = bpf_htonl(SRC_REWRITE_IP4);
if (bpf_bind(ctx, (struct sockaddr *)&sa, sizeof(sa)) != 0)
return 0;
return 1;
}
...
SEC("cgroup/connect4")
int connect_v4_prog(struct bpf_sock_addr *ctx)
{
...
return do_bind(ctx) ? 1 : 0;
}
Insn 180 is a call to 'do_bind'. The call's return value is also the return value
for the program. Since do_bind() returns 0/1, so it is legitimate for compiler to
optimize 'return do_bind(ctx) ? 1 : 0' to 'return do_bind(ctx)'. However, such
optimization breaks verifier as the return value of 'do_bind()' is marked as any
scalar which violates the requirement of prog return value 0/1.
There are two ways to fix this problem, (1) changing 'return 1' in do_bind() to
e.g. 'return 10' so the compiler has to do 'do_bind(ctx) ? 1 :0', or (2)
suggested by Andrii, marking do_bind() with __weak attribute so the compiler
cannot make any assumption on do_bind() return value.
This patch adopted adding __weak approach which is simpler and more resistant
to potential compiler optimizations.
Suggested-by: Andrii Nakryiko <andrii@xxxxxxxxxx>
Signed-off-by: Yonghong Song <yhs@xxxxxx>
Signed-off-by: Andrii Nakryiko <andrii@xxxxxxxxxx>
Link: https://lore.kernel.org/bpf/20230310012410.2920570-1-yhs@xxxxxx
Signed-off-by: Eduard Zingerman <eddyz87@xxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
tools/testing/selftests/bpf/progs/connect4_prog.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/tools/testing/selftests/bpf/progs/connect4_prog.c
+++ b/tools/testing/selftests/bpf/progs/connect4_prog.c
@@ -32,7 +32,7 @@
#define IFNAMSIZ 16
#endif
-__attribute__ ((noinline))
+__attribute__ ((noinline)) __weak
int do_bind(struct bpf_sock_addr *ctx)
{
struct sockaddr_in sa = {};
Patches currently in stable-queue which might be from stable-owner@xxxxxxxxxxxxxxx are
queue-6.1/bpf-aggressively-forget-precise-markings-during-state-checkpointing.patch
queue-6.1/selftests-bpf-fix-sk_assign-on-s390x.patch
queue-6.1/bpf-stop-setting-precise-in-current-state.patch
queue-6.1/bpf-allow-precision-tracking-for-programs-with-subprogs.patch
queue-6.1/selftests-bpf-make-test_align-selftest-more-robust.patch
queue-6.1/selftests-bpf-workaround-verification-failure-for-fexit_bpf2bpf-func_replace_return_code.patch
