* [PATHv3 net-next] bpf: enable verifier to add 0 to packet ptr
@ 2017-02-04 16:37 William Tu
2017-02-05 2:53 ` Alexei Starovoitov
2017-02-07 3:50 ` David Miller
0 siblings, 2 replies; 3+ messages in thread
From: William Tu @ 2017-02-04 16:37 UTC (permalink / raw
To: netdev; +Cc: Mihai Budiu, Daniel Borkmann, Alexei Starovoitov
The patch fixes the case when adding a zero value to the packet
pointer. The zero value could come from src_reg equals type
BPF_K or CONST_IMM. The patch fixes both, otherwise the verifer
reports the following error:
[...]
R0=imm0,min_value=0,max_value=0
R1=pkt(id=0,off=0,r=4)
R2=pkt_end R3=fp-12
R4=imm4,min_value=4,max_value=4
R5=pkt(id=0,off=4,r=4)
269: (bf) r2 = r0 // r2 becomes imm0
270: (77) r2 >>= 3
271: (bf) r4 = r1 // r4 becomes pkt ptr
272: (0f) r4 += r2 // r4 += 0
addition of negative constant to packet pointer is not allowed
Signed-off-by: William Tu <u9012063@gmail.com>
Signed-off-by: Mihai Budiu <mbudiu@vmware.com>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Alexei Starovoitov <ast@kernel.org>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
---
kernel/bpf/verifier.c | 2 +-
tools/testing/selftests/bpf/test_verifier.c | 23 +++++++++++++++++++++++
2 files changed, 24 insertions(+), 1 deletion(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index fb3513b..1a754e5 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -1397,7 +1397,7 @@ static int check_packet_ptr_add(struct bpf_verifier_env *env,
imm = insn->imm;
add_imm:
- if (imm <= 0) {
+ if (imm < 0) {
verbose("addition of negative constant to packet pointer is not allowed\n");
return -EACCES;
}
diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c
index 0d0912c..c841e5f 100644
--- a/tools/testing/selftests/bpf/test_verifier.c
+++ b/tools/testing/selftests/bpf/test_verifier.c
@@ -2404,6 +2404,29 @@ static struct bpf_test tests[] = {
.prog_type = BPF_PROG_TYPE_SCHED_CLS,
},
{
+ "direct packet access: test14 (pkt_ptr += 0, CONST_IMM, good access)",
+ .insns = {
+ BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
+ offsetof(struct __sk_buff, data)),
+ BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
+ offsetof(struct __sk_buff, data_end)),
+ BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
+ BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),
+ BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 7),
+ BPF_MOV64_IMM(BPF_REG_5, 12),
+ BPF_ALU64_IMM(BPF_RSH, BPF_REG_5, 4),
+ BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
+ BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),
+ BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_6, 0),
+ BPF_MOV64_IMM(BPF_REG_0, 1),
+ BPF_EXIT_INSN(),
+ BPF_MOV64_IMM(BPF_REG_0, 0),
+ BPF_EXIT_INSN(),
+ },
+ .result = ACCEPT,
+ .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+ },
+ {
"helper access to packet: test1, valid packet_ptr range",
.insns = {
BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
--
2.7.4
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATHv3 net-next] bpf: enable verifier to add 0 to packet ptr
2017-02-04 16:37 [PATHv3 net-next] bpf: enable verifier to add 0 to packet ptr William Tu
@ 2017-02-05 2:53 ` Alexei Starovoitov
2017-02-07 3:50 ` David Miller
1 sibling, 0 replies; 3+ messages in thread
From: Alexei Starovoitov @ 2017-02-05 2:53 UTC (permalink / raw
To: William Tu; +Cc: netdev, Mihai Budiu, Daniel Borkmann, Alexei Starovoitov
On Sat, Feb 04, 2017 at 08:37:29AM -0800, William Tu wrote:
> The patch fixes the case when adding a zero value to the packet
> pointer. The zero value could come from src_reg equals type
> BPF_K or CONST_IMM. The patch fixes both, otherwise the verifer
> reports the following error:
> [...]
> R0=imm0,min_value=0,max_value=0
> R1=pkt(id=0,off=0,r=4)
> R2=pkt_end R3=fp-12
> R4=imm4,min_value=4,max_value=4
> R5=pkt(id=0,off=4,r=4)
> 269: (bf) r2 = r0 // r2 becomes imm0
> 270: (77) r2 >>= 3
> 271: (bf) r4 = r1 // r4 becomes pkt ptr
> 272: (0f) r4 += r2 // r4 += 0
> addition of negative constant to packet pointer is not allowed
>
> Signed-off-by: William Tu <u9012063@gmail.com>
> Signed-off-by: Mihai Budiu <mbudiu@vmware.com>
> Cc: Daniel Borkmann <daniel@iogearbox.net>
> Cc: Alexei Starovoitov <ast@kernel.org>
> Acked-by: Daniel Borkmann <daniel@iogearbox.net>
...
> + "direct packet access: test14 (pkt_ptr += 0, CONST_IMM, good access)",
> + .insns = {
> + BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1,
> + offsetof(struct __sk_buff, data)),
> + BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1,
> + offsetof(struct __sk_buff, data_end)),
> + BPF_MOV64_REG(BPF_REG_0, BPF_REG_2),
> + BPF_ALU64_IMM(BPF_ADD, BPF_REG_0, 22),
> + BPF_JMP_REG(BPF_JGT, BPF_REG_0, BPF_REG_3, 7),
> + BPF_MOV64_IMM(BPF_REG_5, 12),
> + BPF_ALU64_IMM(BPF_RSH, BPF_REG_5, 4),
> + BPF_MOV64_REG(BPF_REG_6, BPF_REG_2),
> + BPF_ALU64_REG(BPF_ADD, BPF_REG_6, BPF_REG_5),
> + BPF_LDX_MEM(BPF_B, BPF_REG_0, BPF_REG_6, 0),
Now looks great. Thanks!
Acked-by: Alexei Starovoitov <ast@kernel.org>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATHv3 net-next] bpf: enable verifier to add 0 to packet ptr
2017-02-04 16:37 [PATHv3 net-next] bpf: enable verifier to add 0 to packet ptr William Tu
2017-02-05 2:53 ` Alexei Starovoitov
@ 2017-02-07 3:50 ` David Miller
1 sibling, 0 replies; 3+ messages in thread
From: David Miller @ 2017-02-07 3:50 UTC (permalink / raw
To: u9012063; +Cc: netdev, mbudiu, daniel, ast
From: William Tu <u9012063@gmail.com>
Date: Sat, 4 Feb 2017 08:37:29 -0800
> The patch fixes the case when adding a zero value to the packet
> pointer. The zero value could come from src_reg equals type
> BPF_K or CONST_IMM. The patch fixes both, otherwise the verifer
> reports the following error:
> [...]
> R0=imm0,min_value=0,max_value=0
> R1=pkt(id=0,off=0,r=4)
> R2=pkt_end R3=fp-12
> R4=imm4,min_value=4,max_value=4
> R5=pkt(id=0,off=4,r=4)
> 269: (bf) r2 = r0 // r2 becomes imm0
> 270: (77) r2 >>= 3
> 271: (bf) r4 = r1 // r4 becomes pkt ptr
> 272: (0f) r4 += r2 // r4 += 0
> addition of negative constant to packet pointer is not allowed
>
> Signed-off-by: William Tu <u9012063@gmail.com>
> Signed-off-by: Mihai Budiu <mbudiu@vmware.com>
> Cc: Daniel Borkmann <daniel@iogearbox.net>
> Cc: Alexei Starovoitov <ast@kernel.org>
> Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Applied, thanks.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2017-02-07 3:50 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-02-04 16:37 [PATHv3 net-next] bpf: enable verifier to add 0 to packet ptr William Tu
2017-02-05 2:53 ` Alexei Starovoitov
2017-02-07 3:50 ` David Miller
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.