lkml.org 
[lkml]   [2020]   [Jul]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.7 055/166] bpf: Do not allow btf_ctx_access with __int128 types
    Date
    From: John Fastabend <john.fastabend@gmail.com>

    [ Upstream commit a9b59159d338d414acaa8e2f569d129d51c76452 ]

    To ensure btf_ctx_access() is safe the verifier checks that the BTF
    arg type is an int, enum, or pointer. When the function does the
    BTF arg lookup it uses the calculation 'arg = off / 8' using the
    fact that registers are 8B. This requires that the first arg is
    in the first reg, the second in the second, and so on. However,
    for __int128 the arg will consume two registers by default LLVM
    implementation. So this will cause the arg layout assumed by the
    'arg = off / 8' calculation to be incorrect.

    Because __int128 is uncommon this patch applies the easiest fix and
    will force int types to be sizeof(u64) or smaller so that they will
    fit in a single register.

    v2: remove unneeded parens per Andrii's feedback

    Fixes: 9e15db66136a1 ("bpf: Implement accurate raw_tp context access via BTF")
    Signed-off-by: John Fastabend <john.fastabend@gmail.com>
    Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
    Acked-by: Andrii Nakryiko <andriin@fb.com>
    Link: https://lore.kernel.org/bpf/159303723962.11287.13309537171132420717.stgit@john-Precision-5820-Tower
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    include/linux/btf.h | 5 +++++
    kernel/bpf/btf.c | 4 ++--
    2 files changed, 7 insertions(+), 2 deletions(-)

    diff --git a/include/linux/btf.h b/include/linux/btf.h
    index 5c1ea99b480fa..8b81fbb4497cf 100644
    --- a/include/linux/btf.h
    +++ b/include/linux/btf.h
    @@ -82,6 +82,11 @@ static inline bool btf_type_is_int(const struct btf_type *t)
    return BTF_INFO_KIND(t->info) == BTF_KIND_INT;
    }

    +static inline bool btf_type_is_small_int(const struct btf_type *t)
    +{
    + return btf_type_is_int(t) && t->size <= sizeof(u64);
    +}
    +
    static inline bool btf_type_is_enum(const struct btf_type *t)
    {
    return BTF_INFO_KIND(t->info) == BTF_KIND_ENUM;
    diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
    index d65c6912bdaf6..d1f5d428c9fe2 100644
    --- a/kernel/bpf/btf.c
    +++ b/kernel/bpf/btf.c
    @@ -3744,7 +3744,7 @@ bool btf_ctx_access(int off, int size, enum bpf_access_type type,
    return false;

    t = btf_type_skip_modifiers(btf, t->type, NULL);
    - if (!btf_type_is_int(t)) {
    + if (!btf_type_is_small_int(t)) {
    bpf_log(log,
    "ret type %s not allowed for fmod_ret\n",
    btf_kind_str[BTF_INFO_KIND(t->info)]);
    @@ -3766,7 +3766,7 @@ bool btf_ctx_access(int off, int size, enum bpf_access_type type,
    /* skip modifiers */
    while (btf_type_is_modifier(t))
    t = btf_type_by_id(btf, t->type);
    - if (btf_type_is_int(t) || btf_type_is_enum(t))
    + if (btf_type_is_small_int(t) || btf_type_is_enum(t))
    /* accessing a scalar */
    return true;
    if (!btf_type_is_ptr(t)) {
    --
    2.25.1


    \
     
     \ /
      Last update: 2020-07-14 21:05    [W:5.681 / U:0.160 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site