From: Yonghong Song <yhs@fb.com>
To: Andrii Nakryiko <andriin@fb.com>, <bpf@vger.kernel.org>,
Martin KaFai Lau <kafai@fb.com>, <netdev@vger.kernel.org>
Cc: Alexei Starovoitov <ast@fb.com>,
Daniel Borkmann <daniel@iogearbox.net>, <kernel-team@fb.com>
Subject: [PATCH bpf-next v4 15/21] bpf: support variable length array in tracing programs
Date: Sat, 9 May 2020 10:59:16 -0700 [thread overview]
Message-ID: <20200509175916.2476853-1-yhs@fb.com> (raw)
In-Reply-To: <20200509175859.2474608-1-yhs@fb.com>
In /proc/net/ipv6_route, we have
struct fib6_info {
struct fib6_table *fib6_table;
...
struct fib6_nh fib6_nh[0];
}
struct fib6_nh {
struct fib_nh_common nh_common;
struct rt6_info **rt6i_pcpu;
struct rt6_exception_bucket *rt6i_exception_bucket;
};
struct fib_nh_common {
...
u8 nhc_gw_family;
...
}
The access:
struct fib6_nh *fib6_nh = &rt->fib6_nh;
... fib6_nh->nh_common.nhc_gw_family ...
This patch ensures such an access is handled properly.
Acked-by: Andrii Nakryiko <andriin@fb.com>
Signed-off-by: Yonghong Song <yhs@fb.com>
---
kernel/bpf/btf.c | 37 +++++++++++++++++++++++++++++++++++++
1 file changed, 37 insertions(+)
diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
index c490fbde22d4..dcd233139294 100644
--- a/kernel/bpf/btf.c
+++ b/kernel/bpf/btf.c
@@ -3833,6 +3833,7 @@ int btf_struct_access(struct bpf_verifier_log *log,
const struct btf_type *mtype, *elem_type = NULL;
const struct btf_member *member;
const char *tname, *mname;
+ u32 vlen;
again:
tname = __btf_name_by_offset(btf_vmlinux, t->name_off);
@@ -3841,7 +3842,43 @@ int btf_struct_access(struct bpf_verifier_log *log,
return -EINVAL;
}
+ vlen = btf_type_vlen(t);
if (off + size > t->size) {
+ /* If the last element is a variable size array, we may
+ * need to relax the rule.
+ */
+ struct btf_array *array_elem;
+
+ if (vlen == 0)
+ goto error;
+
+ member = btf_type_member(t) + vlen - 1;
+ mtype = btf_type_skip_modifiers(btf_vmlinux, member->type,
+ NULL);
+ if (!btf_type_is_array(mtype))
+ goto error;
+
+ array_elem = (struct btf_array *)(mtype + 1);
+ if (array_elem->nelems != 0)
+ goto error;
+
+ moff = btf_member_bit_offset(t, member) / 8;
+ if (off < moff)
+ goto error;
+
+ /* Only allow structure for now, can be relaxed for
+ * other types later.
+ */
+ elem_type = btf_type_skip_modifiers(btf_vmlinux,
+ array_elem->type, NULL);
+ if (!btf_type_is_struct(elem_type))
+ goto error;
+
+ off = (off - moff) % elem_type->size;
+ return btf_struct_access(log, elem_type, off, size, atype,
+ next_btf_id);
+
+error:
bpf_log(log, "access beyond struct %s at off %u size %u\n",
tname, off, size);
return -EACCES;
--
2.24.1
next prev parent reply other threads:[~2020-05-09 17:59 UTC|newest]
Thread overview: 42+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-05-09 17:58 [PATCH bpf-next v4 00/21] bpf: implement bpf iterator for kernel data Yonghong Song
2020-05-09 17:58 ` [PATCH bpf-next v4 01/21] bpf: implement an interface to register bpf_iter targets Yonghong Song
2020-05-09 17:59 ` [PATCH bpf-next v4 02/21] bpf: allow loading of a bpf_iter program Yonghong Song
2020-05-10 0:41 ` Alexei Starovoitov
2020-05-10 5:07 ` Yonghong Song
2020-05-12 15:41 ` Yonghong Song
2020-05-12 16:25 ` Alexei Starovoitov
2020-05-12 16:29 ` Yonghong Song
2020-05-09 17:59 ` [PATCH bpf-next v4 03/21] bpf: support bpf tracing/iter programs for BPF_LINK_CREATE Yonghong Song
2020-05-09 17:59 ` [PATCH bpf-next v4 04/21] bpf: support bpf tracing/iter programs for BPF_LINK_UPDATE Yonghong Song
2020-05-09 17:59 ` [PATCH bpf-next v4 05/21] bpf: implement bpf_seq_read() for bpf iterator Yonghong Song
2020-05-10 0:30 ` Alexei Starovoitov
2020-05-10 4:51 ` Yonghong Song
2020-05-09 17:59 ` [PATCH bpf-next v4 06/21] bpf: create anonymous " Yonghong Song
2020-05-09 17:59 ` [PATCH bpf-next v4 07/21] bpf: create file " Yonghong Song
2020-05-09 17:59 ` [PATCH bpf-next v4 08/21] bpf: implement common macros/helpers for target iterators Yonghong Song
2020-05-09 17:59 ` [PATCH bpf-next v4 09/21] bpf: add bpf_map iterator Yonghong Song
2020-05-09 17:59 ` [PATCH bpf-next v4 10/21] net: bpf: add netlink and ipv6_route bpf_iter targets Yonghong Song
2020-05-09 17:59 ` [PATCH bpf-next v4 11/21] bpf: add task and task/file iterator targets Yonghong Song
2020-05-09 17:59 ` [PATCH bpf-next v4 12/21] bpf: add PTR_TO_BTF_ID_OR_NULL support Yonghong Song
2020-05-10 0:50 ` Alexei Starovoitov
2020-05-10 5:18 ` Yonghong Song
2020-05-10 16:11 ` Alexei Starovoitov
2020-05-10 17:05 ` Yonghong Song
2020-05-09 17:59 ` [PATCH bpf-next v4 13/21] bpf: add bpf_seq_printf and bpf_seq_write helpers Yonghong Song
2020-05-09 17:59 ` [PATCH bpf-next v4 14/21] bpf: handle spilled PTR_TO_BTF_ID properly when checking stack_boundary Yonghong Song
2020-05-09 17:59 ` Yonghong Song [this message]
2020-05-09 17:59 ` [PATCH bpf-next v4 16/21] tools/libbpf: add bpf_iter support Yonghong Song
2020-05-10 0:35 ` Alexei Starovoitov
2020-05-10 5:06 ` Yonghong Song
2020-05-10 16:09 ` Alexei Starovoitov
2020-05-10 17:04 ` Yonghong Song
2020-05-09 17:59 ` [PATCH bpf-next v4 17/21] tools/libpf: add offsetof/container_of macro in bpf_helpers.h Yonghong Song
2020-05-09 17:59 ` [PATCH bpf-next v4 18/21] tools/bpftool: add bpf_iter support for bptool Yonghong Song
2020-05-09 17:59 ` [PATCH bpf-next v4 19/21] tools/bpf: selftests: add iterator programs for ipv6_route and netlink Yonghong Song
2020-05-09 17:59 ` [PATCH bpf-next v4 20/21] tools/bpf: selftests: add iter progs for bpf_map/task/task_file Yonghong Song
2020-05-09 17:59 ` [PATCH bpf-next v4 21/21] tools/bpf: selftests: add bpf_iter selftests Yonghong Song
2020-05-10 0:34 ` Alexei Starovoitov
2020-05-10 5:01 ` Yonghong Song
2020-05-10 16:14 ` Alexei Starovoitov
2020-05-10 0:27 ` [PATCH bpf-next v4 00/21] bpf: implement bpf iterator for kernel data Alexei Starovoitov
2020-05-10 4:47 ` Yonghong Song
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200509175916.2476853-1-yhs@fb.com \
--to=yhs@fb.com \
--cc=andriin@fb.com \
--cc=ast@fb.com \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=kafai@fb.com \
--cc=kernel-team@fb.com \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).