XDP invalid memory access

* XDP invalid memory access
@ 2020-01-15 22:11 Vincent Li
  2020-01-15 22:21 ` Toke Høiland-Jørgensen
  2020-01-16  2:24 ` Maciej Fijalkowski
  0 siblings, 2 replies; 16+ messages in thread
From: Vincent Li @ 2020-01-15 22:11 UTC (permalink / raw)
  To: xdp-newbies

Hi,

I am writing a sample XDP program to parse tcp packet options, code
below, compiled ok, when I attach it to a network interface

#clang -O2 -emit-llvm -c tcp_option.c -o - |llc -march=bpf
-filetype=obj -o tcp_option.o

# ip link set dev enp3s0 xdpgeneric object tcp_option.o verbose

Prog section 'prog' rejected: Permission denied (13)!

 - Type:         6

 - Instructions: 42 (0 over limit)

 - License:      GPL

Verifier analysis:

0: (61) r2 = *(u32 *)(r1 +4)

1: (61) r1 = *(u32 *)(r1 +0)

2: (bf) r3 = r1

3: (07) r3 += 54

4: (b7) r0 = 2

5: (2d) if r3 > r2 goto pc+35

 R0_w=inv2 R1_w=pkt(id=0,off=0,r=54,imm=0)
R2_w=pkt_end(id=0,off=0,imm=0) R3_w=pkt(id=0,off=54,r=54,imm=0)
R10=fp0

6: (71) r2 = *(u8 *)(r1 +12)

7: (71) r3 = *(u8 *)(r1 +13)

8: (67) r3 <<= 8

9: (4f) r3 |= r2

10: (b7) r0 = 2

11: (55) if r3 != 0x8 goto pc+29

 R0_w=inv2 R1_w=pkt(id=0,off=0,r=54,imm=0)
R2_w=inv(id=0,umax_value=255,var_off=(0x0; 0xff)) R3_w=inv8 R10=fp0

12: (71) r2 = *(u8 *)(r1 +23)

13: (b7) r0 = 2

14: (55) if r2 != 0x6 goto pc+26

 R0=inv2 R1=pkt(id=0,off=0,r=54,imm=0) R2=inv6 R3=inv8 R10=fp0

15: (69) r1 = *(u16 *)(r1 +46)

16: (bf) r2 = r1

17: (57) r2 &= 7936

18: (b7) r0 = 2

19: (55) if r2 != 0x200 goto pc+21

 R0_w=inv2 R1_w=inv(id=0,umax_value=65535,var_off=(0x0; 0xffff))
R2_w=inv512 R3=inv8 R10=fp0

20: (77) r1 >>= 2

21: (57) r1 &= 60

22: (07) r1 += -20

23: (18) r2 = 0x0

25: (63) *(u32 *)(r2 +0) = r1

R2 invalid mem access 'inv' <----------------

processed 25 insns (limit 1000000) max_states_per_insn 0 total_states
1 peak_states 1 mark_read 1

it appears optlen = tcphdr->doff*4 - sizeof(*tcphdr); is invalid ? if
I comment out lines between 60 and 73, no problem with invalid mem
access

     1 #include <stdint.h>

     2 #include <arpa/inet.h>

     3 #include <asm/byteorder.h>

     4 #include <linux/bpf.h>

     5 #include <linux/if_ether.h>

     6 #include <linux/ip.h>

     7 #include <linux/tcp.h>

     8 #include <linux/pkt_cls.h>

     9

    10 /*

    11 * Sample XDP to parse tcp option.

    12 * compile it with:

    13 *      clang -O2 -emit-llvm -c tcp_option.c -o - |llc
-march=bpf -filetype=obj -o tcp_option.o

    14  * attach it to a device with XDP as:

    15  *  ip link set dev lo xdp object tcp_option.o verbose

    16 */

    17

    18 #define SEC(NAME) __attribute__((section(NAME), used))

    19

    20 #define TCPOPT_EOL        0       /* End of options (1)              */

    21 #define TCPOPT_NOP        1       /* No-op (1)                       */

    22 #define TCPOPT_MAXSEG     2       /* Maximum segment size (4)        */

    23 #define TCPOPT_WSCALE     3       /* Window scaling (3)              */

    24 #define TCPOPT_SACKOK     4       /* Selective ACK permitted (2)     */

    25 #define TCPOPT_SACK       5       /* Actual selective ACK (10-34)    */

    26 #define TCPOPT_TSTAMP     8       /* Timestamp (10)                  */

    27

    28

    29 /* from bpf_helpers.h */

    30

    31 static int (*bpf_trace_printk)(const char *fmt, int fmt_size, ...) =

    32         (void *) BPF_FUNC_trace_printk;

    33

    34 static unsigned long long (*bpf_get_prandom_u32)(void) =

    35 (void *) BPF_FUNC_get_prandom_u32;

    36

    37 const __u8 *op;

    38 int i, optlen;

    39

    40 static int tcp_option(void *data, void *data_end)

    41 {

    42 struct ethhdr *eth = (struct ethhdr *)data;

    43 struct iphdr *iph = (struct iphdr *)(eth + 1);

    44 struct tcphdr *tcphdr = (struct tcphdr *)(iph + 1);

    45 int tcplen;

    46

    47 /* sanity check needed by the eBPF verifier */

    48 if ((void *)(tcphdr + 1) > data_end)

    49 return 0;

    50

    51 /* skip non TCP packets */

    52 if (eth->h_proto != __constant_htons(ETH_P_IP) || iph->protocol
!= IPPROTO_TCP)

    53 return 0;

    54

    55 /* incompatible flags, or PSH already set */

    56 if (tcphdr->ack || tcphdr->fin || tcphdr->rst || tcphdr->psh)

    57 return 0;

    58

    59 if (tcphdr->syn) {

    60 optlen = tcphdr->doff*4 - sizeof(*tcphdr);

    61                 if (!optlen)

    62                       return -1;

    63 /*

    64                 for (i = 0; i < optlen; ) {

    65                         if (op[i] == TCPOPT_EOL) {

    66                  char fmt[] = "XDP: tcp opt eol kind seen %d \n";

    67                  bpf_trace_printk(fmt, sizeof(fmt), op[i]);

    68 }

    69                         if (op[i] < 2)

    70                                 i++;

    71                         else

    72                                 i += op[i+1] ? : 1;

    73                 }

    74 */

    75

    76                char fmt[] = "XDP: tcp syn seen \n";

    77                bpf_trace_printk(fmt, sizeof(fmt));

    78

    79 }

    80

    81 return 0;

    82 }

    83

    84 SEC("prog")

    85 int xdp_main(struct xdp_md *ctx)

    86 {

    87 void *data_end = (void *)(uintptr_t)ctx->data_end;

    88 void *data = (void *)(uintptr_t)ctx->data;

    89

    90 if (tcp_option(data, data_end))

    91 return XDP_DROP;

    92

    93 return XDP_PASS;

    94 }

    95

    96

    97 char _license[] SEC("license") = "GPL";

^ permalink raw reply	[flat|nested] 16+ messages in thread