ubpf
ubpf copied to clipboard
Reject BPF program if uninitialized stack or registers are accessed during interpret path
This pull request includes changes to improve the ubpf library. The most important changes include adding a new libfuzzer based fuzzer, modifying the LLVMFuzzerTestOneInput function to compare the results of the interpreter and JIT compiler, adding a bash script to split the fuzzer input into a program and memory, and adding bounds checking for memory accesses.
Improvements to fuzzing:
libfuzzer/README.md: Added instructions for building and running a new libfuzzer based fuzzer.libfuzzer/libfuzz_harness.cc: Modified theLLVMFuzzerTestOneInputfunction to compare the results of the interpreter and JIT compiler, and to ensure the program length is a multiple ofsizeof(ebpf_inst). [1] [2]libfuzzer/split.sh: Added a bash script to split the fuzzer input into a program and memory, and to disassemble the program.
Improvements to disassembler:
ubpf/disassembler.py: Modified thedisassemble_onefunction to append " local" to the opcode name if the source register is 1. [1] [2]
Improvements to JIT compiler:
vm/ubpf_jit_x86_64.c: Added code to truncate the target register to 32 bits for ALU32 instructions.vm/ubpf_jit_x86_64.h: Added theemit_truncate_u32function to emit instructions to truncate a register to 32 bits.
Improvements to VM:
vm/ubpf_vm.c: Added bounds checking for memory accesses, and added checks to ensure registers are initialized before they are read. Also fixed a bug in theEBPF_OP_JEQ32_REGinstruction. [1] [2] [3] [4] [5] [6] [7] [8] [9]