summaryrefslogtreecommitdiff
path: root/net
diff options
context:
space:
mode:
authorYonghong Song <yhs@fb.com>2017-06-13 15:52:13 -0700
committerDavid S. Miller <davem@davemloft.net>2017-06-14 14:56:25 -0400
commit31fd85816dbe3a714bcc3f67c17c3dd87011f79e (patch)
treed8c694e4997605254ea96a76c5d633f60ee091cf /net
parenta88e2676a6cd3352c2f590f872233d83d8db289c (diff)
bpf: permits narrower load from bpf program context fields
Currently, verifier will reject a program if it contains an narrower load from the bpf context structure. For example, __u8 h = __sk_buff->hash, or __u16 p = __sk_buff->protocol __u32 sample_period = bpf_perf_event_data->sample_period which are narrower loads of 4-byte or 8-byte field. This patch solves the issue by: . Introduce a new parameter ctx_field_size to carry the field size of narrower load from prog type specific *__is_valid_access validator back to verifier. . The non-zero ctx_field_size for a memory access indicates (1). underlying prog type specific convert_ctx_accesses supporting non-whole-field access (2). the current insn is a narrower or whole field access. . In verifier, for such loads where load memory size is less than ctx_field_size, verifier transforms it to a full field load followed by proper masking. . Currently, __sk_buff and bpf_perf_event_data->sample_period are supporting narrowing loads. . Narrower stores are still not allowed as typical ctx stores are just normal stores. Because of this change, some tests in verifier will fail and these tests are removed. As a bonus, rename some out of bound __sk_buff->cb access to proper field name and remove two redundant "skb cb oob" tests. Acked-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: Yonghong Song <yhs@fb.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
-rw-r--r--net/core/filter.c56
1 files changed, 42 insertions, 14 deletions
diff --git a/net/core/filter.c b/net/core/filter.c
index a65a3b25e104..60ed6f343a63 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -2856,7 +2856,8 @@ lwt_xmit_func_proto(enum bpf_func_id func_id)
}
}
-static bool __is_valid_access(int off, int size)
+static bool __is_valid_access(int off, int size, enum bpf_access_type type,
+ int *ctx_field_size)
{
if (off < 0 || off >= sizeof(struct __sk_buff))
return false;
@@ -2872,9 +2873,27 @@ static bool __is_valid_access(int off, int size)
offsetof(struct __sk_buff, cb[4]) + sizeof(__u32))
return false;
break;
- default:
+ case offsetof(struct __sk_buff, data) ...
+ offsetof(struct __sk_buff, data) + sizeof(__u32) - 1:
+ case offsetof(struct __sk_buff, data_end) ...
+ offsetof(struct __sk_buff, data_end) + sizeof(__u32) - 1:
if (size != sizeof(__u32))
return false;
+ break;
+ default:
+ /* permit narrower load for not cb/data/data_end fields */
+ *ctx_field_size = 4;
+ if (type == BPF_WRITE) {
+ if (size != sizeof(__u32))
+ return false;
+ } else {
+ if (size != sizeof(__u32))
+#ifdef __LITTLE_ENDIAN
+ return (off & 0x3) == 0 && (size == 1 || size == 2);
+#else
+ return (off & 0x3) + size == 4 && (size == 1 || size == 2);
+#endif
+ }
}
return true;
@@ -2882,12 +2901,16 @@ static bool __is_valid_access(int off, int size)
static bool sk_filter_is_valid_access(int off, int size,
enum bpf_access_type type,
- enum bpf_reg_type *reg_type)
+ enum bpf_reg_type *reg_type,
+ int *ctx_field_size)
{
switch (off) {
- case offsetof(struct __sk_buff, tc_classid):
- case offsetof(struct __sk_buff, data):
- case offsetof(struct __sk_buff, data_end):
+ case offsetof(struct __sk_buff, tc_classid) ...
+ offsetof(struct __sk_buff, tc_classid) + sizeof(__u32) - 1:
+ case offsetof(struct __sk_buff, data) ...
+ offsetof(struct __sk_buff, data) + sizeof(__u32) - 1:
+ case offsetof(struct __sk_buff, data_end) ...
+ offsetof(struct __sk_buff, data_end) + sizeof(__u32) - 1:
return false;
}
@@ -2901,15 +2924,17 @@ static bool sk_filter_is_valid_access(int off, int size,
}
}
- return __is_valid_access(off, size);
+ return __is_valid_access(off, size, type, ctx_field_size);
}
static bool lwt_is_valid_access(int off, int size,
enum bpf_access_type type,
- enum bpf_reg_type *reg_type)
+ enum bpf_reg_type *reg_type,
+ int *ctx_field_size)
{
switch (off) {
- case offsetof(struct __sk_buff, tc_classid):
+ case offsetof(struct __sk_buff, tc_classid) ...
+ offsetof(struct __sk_buff, tc_classid) + sizeof(__u32) - 1:
return false;
}
@@ -2934,12 +2959,13 @@ static bool lwt_is_valid_access(int off, int size,
break;
}
- return __is_valid_access(off, size);
+ return __is_valid_access(off, size, type, ctx_field_size);
}
static bool sock_filter_is_valid_access(int off, int size,
enum bpf_access_type type,
- enum bpf_reg_type *reg_type)
+ enum bpf_reg_type *reg_type,
+ int *ctx_field_size)
{
if (type == BPF_WRITE) {
switch (off) {
@@ -3002,7 +3028,8 @@ static int tc_cls_act_prologue(struct bpf_insn *insn_buf, bool direct_write,
static bool tc_cls_act_is_valid_access(int off, int size,
enum bpf_access_type type,
- enum bpf_reg_type *reg_type)
+ enum bpf_reg_type *reg_type,
+ int *ctx_field_size)
{
if (type == BPF_WRITE) {
switch (off) {
@@ -3027,7 +3054,7 @@ static bool tc_cls_act_is_valid_access(int off, int size,
break;
}
- return __is_valid_access(off, size);
+ return __is_valid_access(off, size, type, ctx_field_size);
}
static bool __is_valid_xdp_access(int off, int size)
@@ -3044,7 +3071,8 @@ static bool __is_valid_xdp_access(int off, int size)
static bool xdp_is_valid_access(int off, int size,
enum bpf_access_type type,
- enum bpf_reg_type *reg_type)
+ enum bpf_reg_type *reg_type,
+ int *ctx_field_size)
{
if (type == BPF_WRITE)
return false;