Commit 04514d13 authored Dec 14, 2017 by Daniel Borkmann Committed by Alexei Starovoitov Dec 15, 2017

bpf: guarantee r1 to be ctx in case of bpf_helper_changes_pkt_data



Some JITs don't cache skb context on stack in prologue, so when
LD_ABS/IND is used and helper calls yield bpf_helper_changes_pkt_data()
as true, then they temporarily save/restore skb pointer. However,
the assumption that skb always has to be in r1 is a bit of a
gamble. Right now it turned out to be true for all helpers listed
in bpf_helper_changes_pkt_data(), but lets enforce that from verifier
side, so that we make this a guarantee and bail out if the func
proto is misconfigured in future helpers.

In case of BPF helper calls from cBPF, bpf_helper_changes_pkt_data()
is completely unrelevant here (since cBPF is context read-only) and
therefore always false.

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

parent 87338c8e

kernel/bpf/verifier.c

+6 −0

Original line number	Diff line number	Diff line
		@@ -1674,7 +1674,13 @@ static int check_call(struct bpf_verifier_env *env, int func_id, int insn_idx)
		return -EINVAL;
		}

		/* With LD_ABS/IND some JITs save/restore skb from r1. */
		changes_data = bpf_helper_changes_pkt_data(fn->func);
		if (changes_data && fn->arg1_type != ARG_PTR_TO_CTX) {
		verbose(env, "kernel subsystem misconfigured func %s#%d: r1 != ctx\n",
		func_id_name(func_id), func_id);
		return -EINVAL;
		}

		memset(&meta, 0, sizeof(meta));
		meta.pkt_access = fn->pkt_access;

Admin message