| Message ID | 20200819011244.2027725-1-udippant@fb.com |
|---|---|
| State | Changes Requested |
| Delegated to: | BPF Maintainers |
| Headers | show |
| Series | [bpf] bpf: verifier: check for packet data access based on target prog | expand |
On 8/18/20 6:12 PM, Udip Pant wrote: > While using dynamic program extension (of type BPF_PROG_TYPE_EXT), we > need to check the program type of the target program to grant the read / > write access to the packet data. > > The BPF_PROG_TYPE_EXT type can be used to extend types such as XDP, SKB > and others. Since the BPF_PROG_TYPE_EXT program type on itself is just a > placeholder for those, we need this extended check for those target > programs to actually work while using this option. > > Tested this with a freplace xdp program. Without this patch, the > verifier fails with error 'cannot write into packet'. Could you add a selftest for this? FYI, current selftests/bpf have 4 freplace programs: fexit_bpf2bpf.c:SEC("freplace/get_skb_len") fexit_bpf2bpf.c:SEC("freplace/get_skb_ifindex") fexit_bpf2bpf.c:SEC("freplace/get_constant") freplace_connect4.c:SEC("freplace/do_bind") > > Signed-off-by: Udip Pant <udippant@fb.com> > --- > kernel/bpf/verifier.c | 6 +++++- > 1 file changed, 5 insertions(+), 1 deletion(-) > > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c > index ef938f17b944..4d7604430994 100644 > --- a/kernel/bpf/verifier.c > +++ b/kernel/bpf/verifier.c > @@ -2629,7 +2629,11 @@ static bool may_access_direct_pkt_data(struct bpf_verifier_env *env, > const struct bpf_call_arg_meta *meta, > enum bpf_access_type t) > { > - switch (env->prog->type) { > + struct bpf_prog *prog = env->prog; > + enum bpf_prog_type prog_type = prog->aux->linked_prog ? > + prog->aux->linked_prog->type : prog->type; > + > + switch (prog_type) { > /* Program types only with direct read access go here! */ > case BPF_PROG_TYPE_LWT_IN: > case BPF_PROG_TYPE_LWT_OUT: >
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index ef938f17b944..4d7604430994 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -2629,7 +2629,11 @@ static bool may_access_direct_pkt_data(struct bpf_verifier_env *env, const struct bpf_call_arg_meta *meta, enum bpf_access_type t) { - switch (env->prog->type) { + struct bpf_prog *prog = env->prog; + enum bpf_prog_type prog_type = prog->aux->linked_prog ? + prog->aux->linked_prog->type : prog->type; + + switch (prog_type) { /* Program types only with direct read access go here! */ case BPF_PROG_TYPE_LWT_IN: case BPF_PROG_TYPE_LWT_OUT:
While using dynamic program extension (of type BPF_PROG_TYPE_EXT), we need to check the program type of the target program to grant the read / write access to the packet data. The BPF_PROG_TYPE_EXT type can be used to extend types such as XDP, SKB and others. Since the BPF_PROG_TYPE_EXT program type on itself is just a placeholder for those, we need this extended check for those target programs to actually work while using this option. Tested this with a freplace xdp program. Without this patch, the verifier fails with error 'cannot write into packet'. Signed-off-by: Udip Pant <udippant@fb.com> --- kernel/bpf/verifier.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-)