Commit 81f6d053 authored by Eduard Zingerman's avatar Eduard Zingerman Committed by Alexei Starovoitov
Browse files

bpf: check changes_pkt_data property for extension programs 



When processing calls to global sub-programs, verifier decides whether
to invalidate all packet pointers in current state depending on the
changes_pkt_data property of the global sub-program.

Because of this, an extension program replacing a global sub-program
must be compatible with changes_pkt_data property of the sub-program
being replaced.

This commit:
- adds changes_pkt_data flag to struct bpf_prog_aux:
  - this flag is set in check_cfg() for main sub-program;
  - in jit_subprogs() for other sub-programs;
- modifies bpf_check_attach_btf_id() to check changes_pkt_data flag;
- moves call to check_attach_btf_id() after the call to check_cfg(),
  because it needs changes_pkt_data flag to be set:

    bpf_check:
      ...                             ...
    - check_attach_btf_id             resolve_pseudo_ldimm64
      resolve_pseudo_ldimm64   -->    bpf_prog_is_offloaded
      bpf_prog_is_offloaded           check_cfg
      check_cfg                     + check_attach_btf_id
      ...                             ...

The following fields are set by check_attach_btf_id():
- env->ops
- prog->aux->attach_btf_trace
- prog->aux->attach_func_name
- prog->aux->attach_func_proto
- prog->aux->dst_trampoline
- prog->aux->mod
- prog->aux->saved_dst_attach_type
- prog->aux->saved_dst_prog_type
- prog->expected_attach_type

Neither of these fields are used by resolve_pseudo_ldimm64() or
bpf_prog_offload_verifier_prep() (for netronome and netdevsim
drivers), so the reordering is safe.

Suggested-by: default avatarAlexei Starovoitov <alexei.starovoitov@gmail.com>
Signed-off-by: default avatarEduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20241210041100.1898468-6-eddyz87@gmail.com


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent 3f23ee55

include/linux/bpf.h

+1 −0
Original line number Diff line number Diff line
@@ -1527,6 +1527,7 @@ struct bpf_prog_aux { 
	bool is_extended; /* true if extended by freplace program */

	bool jits_use_priv_stack;

	bool priv_stack_requested;

	bool changes_pkt_data;

	u64 prog_array_member_cnt; /* counts how many times as member of prog_array */

	struct mutex ext_mutex; /* mutex for is_extended and prog_array_member_cnt */

	struct bpf_arena *arena;

kernel/bpf/verifier.c

+12 −4
Original line number Diff line number Diff line
@@ -16872,6 +16872,7 @@ static int check_cfg(struct bpf_verifier_env *env) 
		}

	}

	ret = 0; /* cfg looks good */

	env->prog->aux->changes_pkt_data = env->subprog_info[0].changes_pkt_data;









err_free:









	kvfree(insn_state);








@@ -20361,6 +20362,7 @@ static int jit_subprogs(struct bpf_verifier_env *env)







		func[i]->aux->num_exentries = num_exentries;









		func[i]->aux->tail_call_reachable = env->subprog_info[i].tail_call_reachable;









		func[i]->aux->exception_cb = env->subprog_info[i].is_exception_cb;









		func[i]->aux->changes_pkt_data = env->subprog_info[i].changes_pkt_data;









		if (!i)









			func[i]->aux->exception_boundary = env->seen_exception;









		func[i] = bpf_int_jit_compile(func[i]);








@@ -22225,6 +22227,12 @@ int bpf_check_attach_target(struct bpf_verifier_log *log,







					"Extension programs should be JITed\n");









				return -EINVAL;









			}









			if (prog->aux->changes_pkt_data &&









			    !aux->func[subprog]->aux->changes_pkt_data) {









				bpf_log(log,









					"Extension program changes packet data, while original does not\n");









				return -EINVAL;









			}









		}









		if (!tgt_prog->jited) {









			bpf_log(log, "Can attach to only JITed progs\n");








@@ -22690,10 +22698,6 @@ int bpf_check(struct bpf_prog **prog, union bpf_attr *attr, bpfptr_t uattr, __u3







	if (ret < 0)









		goto skip_full_check;

















	ret = check_attach_btf_id(env);









	if (ret)









		goto skip_full_check;

















	ret = resolve_pseudo_ldimm64(env);









	if (ret < 0)









		goto skip_full_check;








@@ -22708,6 +22712,10 @@ int bpf_check(struct bpf_prog **prog, union bpf_attr *attr, bpfptr_t uattr, __u3







	if (ret < 0)









		goto skip_full_check;

















	ret = check_attach_btf_id(env);









	if (ret)









		goto skip_full_check;

















	ret = mark_fastcall_patterns(env);









	if (ret < 0)









		goto skip_full_check;