From: Martin KaFai Lau <kafai@fb.com>
To: <bpf@vger.kernel.org>
Cc: Alexei Starovoitov <ast@kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>,
David Miller <davem@davemloft.net>, <kernel-team@fb.com>,
<netdev@vger.kernel.org>
Subject: [PATCH bpf-next v4 04/11] bpf: Support bitfield read access in btf_struct_access
Date: Wed, 8 Jan 2020 16:35:01 -0800 [thread overview]
Message-ID: <20200109003501.3855427-1-kafai@fb.com> (raw)
In-Reply-To: <20200109003453.3854769-1-kafai@fb.com>
This patch allows bitfield access as a scalar.
It checks "off + size > t->size" to avoid accessing bitfield
end up accessing beyond the struct. This check is done
outside of the loop since it is applicable to all access.
It also takes this chance to break early on the "off < moff" case.
Acked-by: Yonghong Song <yhs@fb.com>
Signed-off-by: Martin KaFai Lau <kafai@fb.com>
---
kernel/bpf/btf.c | 44 +++++++++++++++++++++++++++++++++++++++-----
1 file changed, 39 insertions(+), 5 deletions(-)
diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
index 6a5ccb748a72..48bbde2e1c1e 100644
--- a/kernel/bpf/btf.c
+++ b/kernel/bpf/btf.c
@@ -3744,19 +3744,53 @@ int btf_struct_access(struct bpf_verifier_log *log,
return -EINVAL;
}
- for_each_member(i, t, member) {
- if (btf_member_bitfield_size(t, member))
- /* bitfields are not supported yet */
- continue;
+ if (off + size > t->size) {
+ bpf_log(log, "access beyond struct %s at off %u size %u\n",
+ tname, off, size);
+ return -EACCES;
+ }
+ for_each_member(i, t, member) {
/* offset of the field in bytes */
moff = btf_member_bit_offset(t, member) / 8;
if (off + size <= moff)
/* won't find anything, field is already too far */
break;
+
+ if (btf_member_bitfield_size(t, member)) {
+ u32 end_bit = btf_member_bit_offset(t, member) +
+ btf_member_bitfield_size(t, member);
+
+ /* off <= moff instead of off == moff because clang
+ * does not generate a BTF member for anonymous
+ * bitfield like the ":16" here:
+ * struct {
+ * int :16;
+ * int x:8;
+ * };
+ */
+ if (off <= moff &&
+ BITS_ROUNDUP_BYTES(end_bit) <= off + size)
+ return SCALAR_VALUE;
+
+ /* off may be accessing a following member
+ *
+ * or
+ *
+ * Doing partial access at either end of this
+ * bitfield. Continue on this case also to
+ * treat it as not accessing this bitfield
+ * and eventually error out as field not
+ * found to keep it simple.
+ * It could be relaxed if there was a legit
+ * partial access case later.
+ */
+ continue;
+ }
+
/* In case of "off" is pointing to holes of a struct */
if (off < moff)
- continue;
+ break;
/* type of the field */
mtype = btf_type_by_id(btf_vmlinux, member->type);
--
2.17.1
next prev parent reply other threads:[~2020-01-09 0:35 UTC|newest]
Thread overview: 19+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-01-09 0:34 [PATCH bpf-next v4 00/11] Introduce BPF STRUCT_OPS Martin KaFai Lau
2020-01-09 0:34 ` [PATCH bpf-next v4 01/11] bpf: Save PTR_TO_BTF_ID register state when spilling to stack Martin KaFai Lau
2020-01-09 0:34 ` [PATCH bpf-next v4 02/11] bpf: Avoid storing modifier to info->btf_id Martin KaFai Lau
2020-01-09 0:34 ` [PATCH bpf-next v4 03/11] bpf: Add enum support to btf_ctx_access() Martin KaFai Lau
2020-01-09 0:35 ` Martin KaFai Lau [this message]
2020-01-09 0:35 ` [PATCH bpf-next v4 05/11] bpf: Introduce BPF_PROG_TYPE_STRUCT_OPS Martin KaFai Lau
2020-01-09 0:35 ` [PATCH bpf-next v4 06/11] bpf: Introduce BPF_MAP_TYPE_STRUCT_OPS Martin KaFai Lau
2020-01-09 0:35 ` [PATCH bpf-next v4 07/11] bpf: tcp: Support tcp_congestion_ops in bpf Martin KaFai Lau
2020-01-09 0:35 ` [PATCH bpf-next v4 08/11] bpf: Add BPF_FUNC_tcp_send_ack helper Martin KaFai Lau
2020-01-09 0:35 ` [PATCH bpf-next v4 09/11] bpf: Synch uapi bpf.h to tools/ Martin KaFai Lau
2020-01-09 0:35 ` [PATCH bpf-next v4 10/11] bpf: libbpf: Add STRUCT_OPS support Martin KaFai Lau
2020-01-09 0:35 ` [PATCH bpf-next v4 11/11] bpf: Add bpf_dctcp example Martin KaFai Lau
2020-01-09 0:44 ` [PATCH bpf-next v4 01/11] bpf: Save PTR_TO_BTF_ID register state when spilling to stack Martin KaFai Lau
2020-01-09 1:06 ` Arnaldo Carvalho de Melo
2020-01-09 5:47 ` Martin Lau
2020-01-09 13:23 ` Arnaldo Carvalho de Melo
2020-01-09 0:45 ` [PATCH bpf-next v4 08/11] bpf: Add BPF_FUNC_tcp_send_ack helper Martin KaFai Lau
2020-01-09 17:52 ` [PATCH bpf-next v4 00/11] Introduce BPF STRUCT_OPS Alexei Starovoitov
2020-01-09 22:36 ` Andrii Nakryiko
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200109003501.3855427-1-kafai@fb.com \
--to=kafai@fb.com \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=davem@davemloft.net \
--cc=kernel-team@fb.com \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.