From patchwork Thu May 17 14:28:10 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mathieu Xhonneux X-Patchwork-Id: 915405 X-Patchwork-Delegate: bpf@iogearbox.net Return-Path: X-Original-To: patchwork-incoming-netdev@ozlabs.org Delivered-To: patchwork-incoming-netdev@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b="Mw7tmpOV"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 40mrFd1vbNz9s0y for ; Thu, 17 May 2018 22:28:53 +1000 (AEST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751914AbeEQM2v (ORCPT ); Thu, 17 May 2018 08:28:51 -0400 Received: from mail-wm0-f68.google.com ([74.125.82.68]:53745 "EHLO mail-wm0-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751468AbeEQM2c (ORCPT ); Thu, 17 May 2018 08:28:32 -0400 Received: by mail-wm0-f68.google.com with SMTP id a67-v6so8030322wmf.3 for ; Thu, 17 May 2018 05:28:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references :in-reply-to:references; bh=FvNLUZTZY0v4WtuZ7F6BQZcRX0QfssaJSPkRxFFX+zE=; b=Mw7tmpOVd8ebPP1H06woDqtm68NVHj5hTjakgp42F2J5D6AJNg7KYqIq2dXiLrJvx/ ObZ4J5gHBBE+Gx0FOJHSXaZqwsDEm931ZjUHNgUUiJf9qGj0HDd999cOMKi+6u1qCaJy lQalAn1H94NI6wbB7gITeOPSXH1td+2G48Iw6Pl33TytK3HdN+laXVBxvLFN86jN4xxc VlY7uex9o/nwee+mlaP34UMWBg4vvEnX62EzRn5JtZ9+t1yoGJa4YpsuZwcPoP3INBlZ 0WX4N9qDHdqEjJ03M0v6tFDwFDnpvs7jlP3WrWHnJQ4doVqd2hKkxWOvwvv6ngvllAhF Df0A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:in-reply-to:references; bh=FvNLUZTZY0v4WtuZ7F6BQZcRX0QfssaJSPkRxFFX+zE=; b=gPrvcMMtPjD8WIWM7k5MZA9NHLe8ImPu1r+QapA9IZMG2Zk8K5irGUm5hIMkLuTsuE MX+fzFwluEVM5Wrd2IDkFkCHItP/ii3qf75Q4p1HJK8QCcfbib1Q3ttWo9SCKC/R2RKJ WrCLOneu6446yfMk0dNhUdH3CqdpSSTcTifRwsopBQ2w82BgWcGlzZDjxvcQvzYKcp7j O4Be441voTLHG1NnTBteSBkGf9140RxmLjbZ/J+POkBw1oYuyJbgrmo+gvUvl5EPuO4k dHLlchcGaN9/u50pDOJH+tdeIKtWUrrQyXQOmtPYZ+IHYCW9pTmODh4GW7rgZXh3B3aE 1oBw== X-Gm-Message-State: ALKqPwc52Xp4Ln/vALI/gKlA5DeqFM/cR/0F4h5UXjE+Gq4Sr701XZGb Jbd+dKeVYymhMFkM4RH1I2xmXQ== X-Google-Smtp-Source: AB8JxZrGwWM1uohCtkdbyQa8lMK4fkDzRdBpkbyCceOnmp4bdOlWtORwtnsbz5djmpP5h7OAGW5NTQ== X-Received: by 2002:a50:d94a:: with SMTP id u10-v6mr6716045edj.241.1526560110472; Thu, 17 May 2018 05:28:30 -0700 (PDT) Received: from trondheim.voo.be ([2a02:2788:7d4:17f1:3322:3b09:5c0a:74bb]) by smtp.googlemail.com with ESMTPSA id y7-v6sm2421934edq.8.2018.05.17.05.28.29 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 17 May 2018 05:28:29 -0700 (PDT) From: Mathieu Xhonneux To: netdev@vger.kernel.org Cc: daniel@iogearbox.net, dlebrun@google.com, alexei.starovoitov@gmail.com Subject: [PATCH bpf-next v6 4/6] bpf: Split lwt inout verifier structures Date: Thu, 17 May 2018 15:28:10 +0100 Message-Id: <3d4e954b4d800cd453ae595182dfdce2368c9edd.1526565671.git.m.xhonneux@gmail.com> X-Mailer: git-send-email 2.16.1 In-Reply-To: References: In-Reply-To: References: Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org The new bpf_lwt_push_encap helper should only be accessible within the LWT BPF IN hook, and not the OUT one, as this may lead to a skb under panic. At the moment, both LWT BPF IN and OUT share the same list of helpers, whose calls are authorized by the verifier. This patch separates the verifier ops for the IN and OUT hooks, and allows the IN hook to call the bpf_lwt_push_encap helper. This patch is also the occasion to put all lwt_*_func_proto functions together for clarity. At the moment, socks_op_func_proto is in the middle of lwt_inout_func_proto and lwt_xmit_func_proto. Signed-off-by: Mathieu Xhonneux Acked-by: David Lebrun --- include/linux/bpf_types.h | 4 +-- net/core/filter.c | 83 +++++++++++++++++++++++++++++------------------ 2 files changed, 54 insertions(+), 33 deletions(-) diff --git a/include/linux/bpf_types.h b/include/linux/bpf_types.h index b67f8793de0d..aa5c8b878474 100644 --- a/include/linux/bpf_types.h +++ b/include/linux/bpf_types.h @@ -9,8 +9,8 @@ BPF_PROG_TYPE(BPF_PROG_TYPE_XDP, xdp) BPF_PROG_TYPE(BPF_PROG_TYPE_CGROUP_SKB, cg_skb) BPF_PROG_TYPE(BPF_PROG_TYPE_CGROUP_SOCK, cg_sock) BPF_PROG_TYPE(BPF_PROG_TYPE_CGROUP_SOCK_ADDR, cg_sock_addr) -BPF_PROG_TYPE(BPF_PROG_TYPE_LWT_IN, lwt_inout) -BPF_PROG_TYPE(BPF_PROG_TYPE_LWT_OUT, lwt_inout) +BPF_PROG_TYPE(BPF_PROG_TYPE_LWT_IN, lwt_in) +BPF_PROG_TYPE(BPF_PROG_TYPE_LWT_OUT, lwt_out) BPF_PROG_TYPE(BPF_PROG_TYPE_LWT_XMIT, lwt_xmit) BPF_PROG_TYPE(BPF_PROG_TYPE_SOCK_OPS, sock_ops) BPF_PROG_TYPE(BPF_PROG_TYPE_SK_SKB, sk_skb) diff --git a/net/core/filter.c b/net/core/filter.c index 2f43d0a6ac5d..39641ea567b4 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -4755,33 +4755,6 @@ xdp_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) } } -static const struct bpf_func_proto * -lwt_inout_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) -{ - switch (func_id) { - case BPF_FUNC_skb_load_bytes: - return &bpf_skb_load_bytes_proto; - case BPF_FUNC_skb_pull_data: - return &bpf_skb_pull_data_proto; - case BPF_FUNC_csum_diff: - return &bpf_csum_diff_proto; - case BPF_FUNC_get_cgroup_classid: - return &bpf_get_cgroup_classid_proto; - case BPF_FUNC_get_route_realm: - return &bpf_get_route_realm_proto; - case BPF_FUNC_get_hash_recalc: - return &bpf_get_hash_recalc_proto; - case BPF_FUNC_perf_event_output: - return &bpf_skb_event_output_proto; - case BPF_FUNC_get_smp_processor_id: - return &bpf_get_smp_processor_id_proto; - case BPF_FUNC_skb_under_cgroup: - return &bpf_skb_under_cgroup_proto; - default: - return bpf_base_func_proto(func_id); - } -} - static const struct bpf_func_proto * sock_ops_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) { @@ -4847,6 +4820,44 @@ sk_skb_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) } } +static const struct bpf_func_proto * +lwt_out_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) +{ + switch (func_id) { + case BPF_FUNC_skb_load_bytes: + return &bpf_skb_load_bytes_proto; + case BPF_FUNC_skb_pull_data: + return &bpf_skb_pull_data_proto; + case BPF_FUNC_csum_diff: + return &bpf_csum_diff_proto; + case BPF_FUNC_get_cgroup_classid: + return &bpf_get_cgroup_classid_proto; + case BPF_FUNC_get_route_realm: + return &bpf_get_route_realm_proto; + case BPF_FUNC_get_hash_recalc: + return &bpf_get_hash_recalc_proto; + case BPF_FUNC_perf_event_output: + return &bpf_skb_event_output_proto; + case BPF_FUNC_get_smp_processor_id: + return &bpf_get_smp_processor_id_proto; + case BPF_FUNC_skb_under_cgroup: + return &bpf_skb_under_cgroup_proto; + default: + return bpf_base_func_proto(func_id); + } +} + +static const struct bpf_func_proto * +lwt_in_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) +{ + switch (func_id) { + case BPF_FUNC_lwt_push_encap: + return &bpf_lwt_push_encap_proto; + default: + return lwt_out_func_proto(func_id, prog); + } +} + static const struct bpf_func_proto * lwt_xmit_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) { @@ -4878,7 +4889,7 @@ lwt_xmit_func_proto(enum bpf_func_id func_id, const struct bpf_prog *prog) case BPF_FUNC_set_hash_invalid: return &bpf_set_hash_invalid_proto; default: - return lwt_inout_func_proto(func_id, prog); + return lwt_out_func_proto(func_id, prog); } } @@ -6451,13 +6462,23 @@ const struct bpf_prog_ops cg_skb_prog_ops = { .test_run = bpf_prog_test_run_skb, }; -const struct bpf_verifier_ops lwt_inout_verifier_ops = { - .get_func_proto = lwt_inout_func_proto, +const struct bpf_verifier_ops lwt_in_verifier_ops = { + .get_func_proto = lwt_in_func_proto, + .is_valid_access = lwt_is_valid_access, + .convert_ctx_access = bpf_convert_ctx_access, +}; + +const struct bpf_prog_ops lwt_in_prog_ops = { + .test_run = bpf_prog_test_run_skb, +}; + +const struct bpf_verifier_ops lwt_out_verifier_ops = { + .get_func_proto = lwt_out_func_proto, .is_valid_access = lwt_is_valid_access, .convert_ctx_access = bpf_convert_ctx_access, }; -const struct bpf_prog_ops lwt_inout_prog_ops = { +const struct bpf_prog_ops lwt_out_prog_ops = { .test_run = bpf_prog_test_run_skb, };