From: Brenden Blanco <bblanco@plumgrid•com>
To: davem@davemloft•net, netdev@vger•kernel.org
Cc: Brenden Blanco <bblanco@plumgrid•com>,
Jamal Hadi Salim <jhs@mojatatu•com>,
Saeed Mahameed <saeedm@dev•mellanox.co.il>,
Martin KaFai Lau <kafai@fb•com>,
Jesper Dangaard Brouer <brouer@redhat•com>,
Ari Saha <as754m@att•com>,
Alexei Starovoitov <alexei.starovoitov@gmail•com>,
Or Gerlitz <gerlitz.or@gmail•com>,
john.fastabend@gmail•com, hannes@stressinduktion•org,
Thomas Graf <tgraf@suug•ch>, Tom Herbert <tom@herbertland•com>,
Daniel Borkmann <daniel@iogearbox•net>
Subject: [PATCH v8 10/11] bpf: enable direct packet data write for xdp progs
Date: Tue, 12 Jul 2016 00:51:33 -0700 [thread overview]
Message-ID: <1468309894-26258-11-git-send-email-bblanco@plumgrid.com> (raw)
In-Reply-To: <1468309894-26258-1-git-send-email-bblanco@plumgrid.com>
For forwarding to be effective, XDP programs should be allowed to
rewrite packet data.
This requires that the drivers supporting XDP must all map the packet
memory as TODEVICE or BIDIRECTIONAL before invoking the program.
Signed-off-by: Brenden Blanco <bblanco@plumgrid•com>
---
kernel/bpf/verifier.c | 17 ++++++++++++++++-
1 file changed, 16 insertions(+), 1 deletion(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index a8d67d0..f72f23b 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -653,6 +653,16 @@ static int check_map_access(struct verifier_env *env, u32 regno, int off,
#define MAX_PACKET_OFF 0xffff
+static bool may_write_pkt_data(enum bpf_prog_type type)
+{
+ switch (type) {
+ case BPF_PROG_TYPE_XDP:
+ return true;
+ default:
+ return false;
+ }
+}
+
static int check_packet_access(struct verifier_env *env, u32 regno, int off,
int size)
{
@@ -806,10 +816,15 @@ static int check_mem_access(struct verifier_env *env, u32 regno, int off,
err = check_stack_read(state, off, size, value_regno);
}
} else if (state->regs[regno].type == PTR_TO_PACKET) {
- if (t == BPF_WRITE) {
+ if (t == BPF_WRITE && !may_write_pkt_data(env->prog->type)) {
verbose("cannot write into packet\n");
return -EACCES;
}
+ if (t == BPF_WRITE && value_regno >= 0 &&
+ is_pointer_value(env, value_regno)) {
+ verbose("R%d leaks addr into packet\n", value_regno);
+ return -EACCES;
+ }
err = check_packet_access(env, regno, off, size);
if (!err && t == BPF_READ && value_regno >= 0)
mark_reg_unknown_value(state->regs, value_regno);
--
2.8.2
next prev parent reply other threads:[~2016-07-12 7:52 UTC|newest]
Thread overview: 47+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-07-12 7:51 [PATCH v8 00/11] Add driver bpf hook for early packet drop and forwarding Brenden Blanco
2016-07-12 7:51 ` [PATCH v8 01/11] bpf: add XDP prog type for early driver filter Brenden Blanco
2016-07-12 13:14 ` Jesper Dangaard Brouer
2016-07-12 14:52 ` Tom Herbert
2016-07-12 16:08 ` Jakub Kicinski
2016-07-13 4:14 ` Alexei Starovoitov
2016-07-12 7:51 ` [PATCH v8 02/11] net: add ndo to setup/query xdp prog in adapter rx Brenden Blanco
2016-07-12 7:51 ` [PATCH v8 03/11] rtnl: add option for setting link xdp prog Brenden Blanco
2016-07-12 7:51 ` [PATCH v8 04/11] net/mlx4_en: add support for fast rx drop bpf program Brenden Blanco
2016-07-12 12:02 ` Tariq Toukan
2016-07-13 11:27 ` David Laight
2016-07-13 14:08 ` Brenden Blanco
2016-07-14 7:25 ` Jesper Dangaard Brouer
2016-07-15 3:30 ` Alexei Starovoitov
2016-07-15 8:21 ` Jesper Dangaard Brouer
2016-07-15 16:56 ` Alexei Starovoitov
2016-07-15 16:18 ` Tom Herbert
2016-07-15 16:47 ` Alexei Starovoitov
2016-07-15 17:49 ` Tom Herbert
2016-07-18 9:10 ` Thomas Graf
2016-07-18 11:39 ` Tom Herbert
2016-07-18 12:48 ` Thomas Graf
2016-07-18 13:07 ` Tom Herbert
2016-07-19 2:45 ` Alexei Starovoitov
2016-07-18 19:03 ` Brenden Blanco
2016-07-15 19:09 ` Jesper Dangaard Brouer
2016-07-18 4:01 ` Alexei Starovoitov
2016-07-18 8:35 ` Daniel Borkmann
2016-07-15 18:08 ` Tom Herbert
2016-07-15 18:45 ` Jesper Dangaard Brouer
2016-07-12 7:51 ` [PATCH v8 05/11] Add sample for adding simple drop program to link Brenden Blanco
2016-07-12 7:51 ` [PATCH v8 06/11] net/mlx4_en: add page recycle to prepare rx ring for tx support Brenden Blanco
2016-07-12 12:09 ` Tariq Toukan
2016-07-12 21:18 ` David Miller
2016-07-13 0:54 ` Brenden Blanco
2016-07-13 7:17 ` Tariq Toukan
2016-07-13 15:40 ` Brenden Blanco
2016-07-15 21:52 ` Brenden Blanco
[not found] ` <6d638467-eea6-d3e1-6984-88a1198ef303@gmail.com>
2016-07-19 17:41 ` Brenden Blanco
2016-07-12 7:51 ` [PATCH v8 07/11] bpf: add XDP_TX xdp_action for direct forwarding Brenden Blanco
2016-07-12 7:51 ` [PATCH v8 08/11] net/mlx4_en: break out tx_desc write into separate function Brenden Blanco
2016-07-12 12:16 ` Tariq Toukan
2016-07-12 7:51 ` [PATCH v8 09/11] net/mlx4_en: add xdp forwarding and data write support Brenden Blanco
2016-07-12 7:51 ` Brenden Blanco [this message]
2016-07-12 7:51 ` [PATCH v8 11/11] bpf: add sample for xdp forwarding and rewrite Brenden Blanco
2016-07-12 14:38 ` [PATCH v8 00/11] Add driver bpf hook for early packet drop and forwarding Tariq Toukan
2016-07-13 15:00 ` Tariq Toukan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1468309894-26258-11-git-send-email-bblanco@plumgrid.com \
--to=bblanco@plumgrid$(echo .)com \
--cc=alexei.starovoitov@gmail$(echo .)com \
--cc=as754m@att$(echo .)com \
--cc=brouer@redhat$(echo .)com \
--cc=daniel@iogearbox$(echo .)net \
--cc=davem@davemloft$(echo .)net \
--cc=gerlitz.or@gmail$(echo .)com \
--cc=hannes@stressinduktion$(echo .)org \
--cc=jhs@mojatatu$(echo .)com \
--cc=john.fastabend@gmail$(echo .)com \
--cc=kafai@fb$(echo .)com \
--cc=netdev@vger$(echo .)kernel.org \
--cc=saeedm@dev$(echo .)mellanox.co.il \
--cc=tgraf@suug$(echo .)ch \
--cc=tom@herbertland$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox