From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.0 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 70334C43381 for ; Tue, 19 Feb 2019 21:54:01 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 4179D2147A for ; Tue, 19 Feb 2019 21:54:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729632AbfBSVyA (ORCPT ); Tue, 19 Feb 2019 16:54:00 -0500 Received: from www62.your-server.de ([213.133.104.62]:38582 "EHLO www62.your-server.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725994AbfBSVx7 (ORCPT ); Tue, 19 Feb 2019 16:53:59 -0500 Received: from [78.46.172.2] (helo=sslproxy05.your-server.de) by www62.your-server.de with esmtpsa (TLSv1.2:DHE-RSA-AES256-GCM-SHA384:256) (Exim 4.89_1) (envelope-from ) id 1gwDKw-0004Vk-7V; Tue, 19 Feb 2019 22:53:58 +0100 Received: from [178.197.248.36] (helo=linux.home) by sslproxy05.your-server.de with esmtpsa (TLSv1.2:ECDHE-RSA-AES256-GCM-SHA384:256) (Exim 4.89) (envelope-from ) id 1gwDKw-000QYM-0n; Tue, 19 Feb 2019 22:53:58 +0100 Subject: Re: [PATCH bpf-next 3/9] bpf: add bpf helper bpf_skb_set_ecn From: Daniel Borkmann To: brakmo , netdev Cc: Martin Lau , Alexei Starovoitov , Daniel Borkmann --cc=Kernel Team <"daniel@iogearbox.netKernel-team"@fb.com> References: <20190219053832.2086706-1-brakmo@fb.com> Message-ID: Date: Tue, 19 Feb 2019 22:53:57 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.3.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit X-Authenticated-Sender: daniel@iogearbox.net X-Virus-Scanned: Clear (ClamAV 0.100.2/25365/Tue Feb 19 11:36:48 2019) Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org On 02/19/2019 11:52 AM, Daniel Borkmann wrote: [...] > Looking at cg_skb_verifier_ops ... it seems there also a bug in the current > code, namely that if we have a direct packet write, we don't make the skb > writable; at that point skb->data is not private. The cg_skb_is_valid_access() > allows to fetch PTR_TO_PACKET{,_END}, so we need a fix like the below for -bpf: Ah, scratch that thought, I overlooked may_access_direct_pkt_data() prevents writes for this prog type so not an issue. > diff --git a/net/core/filter.c b/net/core/filter.c > index f7d0004fc160..34fe6da0a236 100644 > --- a/net/core/filter.c > +++ b/net/core/filter.c > @@ -5796,6 +5796,12 @@ static bool sk_filter_is_valid_access(int off, int size, > return bpf_skb_is_valid_access(off, size, type, prog, info); > } > > +static int cg_skb_prologue(struct bpf_insn *insn_buf, bool direct_write, > + const struct bpf_prog *prog) > +{ > + return bpf_unclone_prologue(insn_buf, direct_write, prog, 0); > +} > + > static bool cg_skb_is_valid_access(int off, int size, > enum bpf_access_type type, > const struct bpf_prog *prog, > @@ -7595,6 +7601,7 @@ const struct bpf_verifier_ops cg_skb_verifier_ops = { > .get_func_proto = cg_skb_func_proto, > .is_valid_access = cg_skb_is_valid_access, > .convert_ctx_access = bpf_convert_ctx_access, > + .gen_prologue = cg_skb_prologue, > }; > > const struct bpf_prog_ops cg_skb_prog_ops = {