bpf.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Song Liu <song@kernel.org>
To: John Fastabend <john.fastabend@gmail.com>
Cc: Martin KaFai Lau <kafai@fb.com>,
	Daniel Borkmann <daniel@iogearbox.net>,
	Alexei Starovoitov <ast@kernel.org>,
	Networking <netdev@vger.kernel.org>, bpf <bpf@vger.kernel.org>
Subject: Re: [bpf PATCH v2 2/5] bpf: sock_ops sk access may stomp registers when dst_reg = src_reg
Date: Wed, 29 Jul 2020 14:30:27 -0700	[thread overview]
Message-ID: <CAPhsuW4W8MsyhvxHmh-i50PShO9Gz0HK1G6rRViO-aHwXy4Uyg@mail.gmail.com> (raw)
In-Reply-To: <159603979365.4454.14002555655802904027.stgit@john-Precision-5820-Tower>

On Wed, Jul 29, 2020 at 9:25 AM John Fastabend <john.fastabend@gmail.com> wrote:
>
> Similar to patch ("bpf: sock_ops ctx access may stomp registers") if the
> src_reg = dst_reg when reading the sk field of a sock_ops struct we
> generate xlated code,
>
>   53: (61) r9 = *(u32 *)(r9 +28)
>   54: (15) if r9 == 0x0 goto pc+3
>   56: (79) r9 = *(u64 *)(r9 +0)
>
> This stomps on the r9 reg to do the sk_fullsock check and then when
> reading the skops->sk field instead of the sk pointer we get the
> sk_fullsock. To fix use similar pattern noted in the previous fix
> and use the temp field to save/restore a register used to do
> sk_fullsock check.
>
> After the fix the generated xlated code reads,
>
>   52: (7b) *(u64 *)(r9 +32) = r8
>   53: (61) r8 = *(u32 *)(r9 +28)
>   54: (15) if r9 == 0x0 goto pc+3
>   55: (79) r8 = *(u64 *)(r9 +32)
>   56: (79) r9 = *(u64 *)(r9 +0)
>   57: (05) goto pc+1
>   58: (79) r8 = *(u64 *)(r9 +32)
>
> Here r9 register was in-use so r8 is chosen as the temporary register.
> In line 52 r8 is saved in temp variable and at line 54 restored in case
> fullsock != 0. Finally we handle fullsock == 0 case by restoring at
> line 58.
>
> This adds a new macro SOCK_OPS_GET_SK it is almost possible to merge
> this with SOCK_OPS_GET_FIELD, but I found the extra branch logic a
> bit more confusing than just adding a new macro despite a bit of
> duplicating code.
>
> Fixes: 1314ef561102e ("bpf: export bpf_sock for BPF_PROG_TYPE_SOCK_OPS prog type")
> Signed-off-by: John Fastabend <john.fastabend@gmail.com>

Acked-by: Song Liu <songliubraving@fb.com>
[...]

  reply	other threads:[~2020-07-29 21:30 UTC|newest]

Thread overview: 14+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-07-29 16:22 [bpf PATCH v2 0/5] Fix sock_ops field read splat John Fastabend
2020-07-29 16:22 ` [bpf PATCH v2 1/5] bpf: sock_ops ctx access may stomp registers in corner case John Fastabend
2020-07-29 21:29   ` Song Liu
2020-07-31 12:25   ` Daniel Borkmann
2020-07-31 22:46     ` John Fastabend
2020-07-29 16:23 ` [bpf PATCH v2 2/5] bpf: sock_ops sk access may stomp registers when dst_reg = src_reg John Fastabend
2020-07-29 21:30   ` Song Liu [this message]
2020-07-29 16:23 ` [bpf PATCH v2 3/5] bpf, selftests: Add tests for ctx access in sock_ops with single register John Fastabend
2020-07-29 21:35   ` Song Liu
2020-07-29 16:23 ` [bpf PATCH v2 4/5] bpf, selftests: Add tests for sock_ops load with r9, r8.r7 registers John Fastabend
2020-07-29 21:36   ` Song Liu
2020-07-29 16:24 ` [bpf PATCH v2 5/5] bpf, selftests: Add tests to sock_ops for loading sk John Fastabend
2020-07-29 21:36   ` Song Liu
2020-07-29 21:57 ` [bpf PATCH v2 0/5] Fix sock_ops field read splat Martin KaFai Lau

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=CAPhsuW4W8MsyhvxHmh-i50PShO9Gz0HK1G6rRViO-aHwXy4Uyg@mail.gmail.com \
    --to=song@kernel.org \
    --cc=ast@kernel.org \
    --cc=bpf@vger.kernel.org \
    --cc=daniel@iogearbox.net \
    --cc=john.fastabend@gmail.com \
    --cc=kafai@fb.com \
    --cc=netdev@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).