From: Joanne Koong <joannelkoong@gmail.com>
To: Martin KaFai Lau <martin.lau@linux.dev>
Cc: daniel@iogearbox.net, andrii@kernel.org, martin.lau@kernel.org,
ast@kernel.org, netdev@vger.kernel.org, memxor@gmail.com,
kernel-team@fb.com, bpf@vger.kernel.org
Subject: Re: [PATCH v9 bpf-next 3/5] bpf: Add skb dynptrs
Date: Tue, 31 Jan 2023 10:18:39 -0800 [thread overview]
Message-ID: <CAJnrk1Yc2zyHb+WRtZrtLMnj6kKAQTg0oBmMq5E4P9Byxamf1g@mail.gmail.com> (raw)
In-Reply-To: <5715ea83-c4aa-c884-ab95-3d5e630cad05@linux.dev>
On Mon, Jan 30, 2023 at 2:04 PM Martin KaFai Lau <martin.lau@linux.dev> wrote:
>
> On 1/27/23 11:17 AM, Joanne Koong wrote:
> > @@ -8243,6 +8316,28 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn
> > mark_reg_known_zero(env, regs, BPF_REG_0);
> > regs[BPF_REG_0].type = PTR_TO_MEM | ret_flag;
> > regs[BPF_REG_0].mem_size = meta.mem_size;
> > + if (func_id == BPF_FUNC_dynptr_data &&
> > + dynptr_type == BPF_DYNPTR_TYPE_SKB) {
> > + bool seen_direct_write = env->seen_direct_write;
> > +
> > + regs[BPF_REG_0].type |= DYNPTR_TYPE_SKB;
> > + if (!may_access_direct_pkt_data(env, NULL, BPF_WRITE))
> > + regs[BPF_REG_0].type |= MEM_RDONLY;
> > + else
> > + /*
> > + * Calling may_access_direct_pkt_data() will set
> > + * env->seen_direct_write to true if the skb is
> > + * writable. As an optimization, we can ignore
> > + * setting env->seen_direct_write.
> > + *
> > + * env->seen_direct_write is used by skb
> > + * programs to determine whether the skb's page
> > + * buffers should be cloned. Since data slice
> > + * writes would only be to the head, we can skip
> > + * this.
> > + */
> > + env->seen_direct_write = seen_direct_write;
> > + }
>
> [ ... ]
>
> > @@ -9263,17 +9361,26 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_
> > return ret;
> > break;
> > case KF_ARG_PTR_TO_DYNPTR:
> > + {
> > + enum bpf_arg_type dynptr_arg_type = ARG_PTR_TO_DYNPTR;
> > +
> > if (reg->type != PTR_TO_STACK &&
> > reg->type != CONST_PTR_TO_DYNPTR) {
> > verbose(env, "arg#%d expected pointer to stack or dynptr_ptr\n", i);
> > return -EINVAL;
> > }
> >
> > - ret = process_dynptr_func(env, regno, insn_idx,
> > - ARG_PTR_TO_DYNPTR | MEM_RDONLY);
> > + if (meta->func_id == special_kfunc_list[KF_bpf_dynptr_from_skb])
> > + dynptr_arg_type |= MEM_UNINIT | DYNPTR_TYPE_SKB;
> > + else
> > + dynptr_arg_type |= MEM_RDONLY;
> > +
> > + ret = process_dynptr_func(env, regno, insn_idx, dynptr_arg_type,
> > + meta->func_id);
> > if (ret < 0)
> > return ret;
> > break;
> > + }
> > case KF_ARG_PTR_TO_LIST_HEAD:
> > if (reg->type != PTR_TO_MAP_VALUE &&
> > reg->type != (PTR_TO_BTF_ID | MEM_ALLOC)) {
> > @@ -15857,6 +15964,14 @@ static int fixup_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
> > desc->func_id == special_kfunc_list[KF_bpf_rdonly_cast]) {
> > insn_buf[0] = BPF_MOV64_REG(BPF_REG_0, BPF_REG_1);
> > *cnt = 1;
> > + } else if (desc->func_id == special_kfunc_list[KF_bpf_dynptr_from_skb]) {
> > + bool is_rdonly = !may_access_direct_pkt_data(env, NULL, BPF_WRITE);
>
> Does it need to restore the env->seen_direct_write here also?
>
> It seems this 'seen_direct_write' saving/restoring is needed now because
> 'may_access_direct_pkt_data(BPF_WRITE)' is not only called when it is actually
> writing the packet. Some refactoring can help to avoid issue like this.
Yes! Great catch! I'll submit a patch that refactors this, so that
env->seen_direct_write isn't set implicitly within
may_access_direct_pkt_data()
>
> While at 'seen_direct_write', Alexei has also pointed out that the verifier
> needs to track whether the (packet) 'slice' returned by bpf_dynptr_data() has
> been written. It should be tracked in 'seen_direct_write'. Take a look at how
> reg_is_pkt_pointer() and may_access_direct_pkt_data() are done in
> check_mem_access(). iirc, this reg_is_pkt_pointer() part got loss somewhere in
> v5 (or v4?) when bpf_dynptr_data() was changed to return register typed
> PTR_TO_MEM instead of PTR_TO_PACKET.
>
The verifier right now does track whether the dynptr skb 'slice' is
writable or not and sets seen_direct_write accordingly. However, it
currently does it in check_helper_call() where if the bpf program is
writable, then the env->seen_direct_write is set (regardless of
whether actual writes occur or not), so I like your idea of moving
this to check_mem_access(). The PTR_TO_MEM that gets returned for the
data slice will need to be tagged with DYNPTR_TYPE_SKB.
>
> [ ... ]
>
> > +int bpf_dynptr_from_skb(struct sk_buff *skb, u64 flags,
> > + struct bpf_dynptr_kern *ptr, int is_rdonly)
>
> hmm... this exposed kfunc takes "int is_rdonly".
>
> What if the bpf prog calls it like bpf_dynptr_from_skb(..., false) in some hook
> that is not writable to packet?
If the bpf prog tries to do this, their "false" value will be ignored,
because the "int is_rdonly" arg value gets set by the verifier (in
fixup_kfunc_call() in line 15969)
>
> > +{
> > + if (flags) {
> > + bpf_dynptr_set_null(ptr);
> > + return -EINVAL;
> > + }
> > +
> > + bpf_dynptr_init(ptr, skb, BPF_DYNPTR_TYPE_SKB, 0, skb->len);
> > +
> > + if (is_rdonly)
> > + bpf_dynptr_set_rdonly(ptr);
> > +
> > + return 0;
> > +}
> > +
> > BPF_CALL_1(bpf_sk_fullsock, struct sock *, sk)
> > {
> > return sk_fullsock(sk) ? (unsigned long)sk : (unsigned long)NULL;
> > @@ -11607,3 +11634,28 @@ bpf_sk_base_func_proto(enum bpf_func_id func_id)
> >
> > return func;
> > }
> > +
> > +BTF_SET8_START(bpf_kfunc_check_set_skb)
> > +BTF_ID_FLAGS(func, bpf_dynptr_from_skb)
> > +BTF_SET8_END(bpf_kfunc_check_set_skb)
> > +
> > +static const struct btf_kfunc_id_set bpf_kfunc_set_skb = {
> > + .owner = THIS_MODULE,
> > + .set = &bpf_kfunc_check_set_skb,
> > +};
> > +
> > +static int __init bpf_kfunc_init(void)
> > +{
> > + int ret;
> > +
> > + ret = register_btf_kfunc_id_set(BPF_PROG_TYPE_SCHED_CLS, &bpf_kfunc_set_skb);
> > + ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_SCHED_ACT, &bpf_kfunc_set_skb);
> > + ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_SK_SKB, &bpf_kfunc_set_skb);
> > + ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_SOCKET_FILTER, &bpf_kfunc_set_skb);
> > + ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_CGROUP_SKB, &bpf_kfunc_set_skb);
> > + ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_LWT_OUT, &bpf_kfunc_set_skb);
> > + ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_LWT_IN, &bpf_kfunc_set_skb);
> > + ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_LWT_XMIT, &bpf_kfunc_set_skb);
> > + return ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_LWT_SEG6LOCAL, &bpf_kfunc_set_skb);
> > +}
> > +late_initcall(bpf_kfunc_init);
>
>
next prev parent reply other threads:[~2023-01-31 18:19 UTC|newest]
Thread overview: 44+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-01-27 19:16 [PATCH v9 bpf-next 0/5] Add skb + xdp dynptrs Joanne Koong
2023-01-27 19:16 ` [PATCH v9 bpf-next 1/5] bpf: Allow "sk_buff" and "xdp_buff" as valid kfunc arg types Joanne Koong
2023-01-27 19:17 ` [PATCH v9 bpf-next 2/5] bpf: Allow initializing dynptrs in kfuncs Joanne Koong
2023-01-27 19:17 ` [PATCH v9 bpf-next 3/5] bpf: Add skb dynptrs Joanne Koong
2023-01-29 23:39 ` Alexei Starovoitov
2023-01-31 0:44 ` Joanne Koong
2023-01-31 5:36 ` Alexei Starovoitov
2023-01-31 17:54 ` Joanne Koong
2023-01-31 19:50 ` Alexei Starovoitov
2023-01-31 21:29 ` Joanne Koong
2023-02-08 21:46 ` Joanne Koong
2023-02-08 23:22 ` Alexei Starovoitov
2023-01-30 22:04 ` Martin KaFai Lau
2023-01-30 22:31 ` Alexei Starovoitov
2023-01-30 23:11 ` Martin KaFai Lau
2023-01-31 1:04 ` Andrii Nakryiko
2023-01-31 1:49 ` Martin KaFai Lau
2023-01-31 4:43 ` Andrii Nakryiko
2023-01-31 5:30 ` Alexei Starovoitov
2023-01-31 22:07 ` Martin KaFai Lau
2023-01-31 23:17 ` Joanne Koong
2023-02-01 0:46 ` Alexei Starovoitov
2023-02-01 0:11 ` Andrii Nakryiko
2023-02-01 0:40 ` Alexei Starovoitov
2023-02-02 1:21 ` Andrii Nakryiko
2023-02-02 11:43 ` Alexei Starovoitov
2023-02-03 21:37 ` Andrii Nakryiko
2023-02-08 2:25 ` Alexei Starovoitov
2023-02-08 20:13 ` Joanne Koong
2023-02-09 0:39 ` Andrii Nakryiko
2023-01-31 18:30 ` Joanne Koong
2023-01-31 19:58 ` Alexei Starovoitov
2023-01-31 20:47 ` Joanne Koong
2023-01-31 21:10 ` Alexei Starovoitov
2023-01-31 21:33 ` Joanne Koong
2023-01-31 18:18 ` Joanne Koong [this message]
2023-01-31 0:48 ` Andrii Nakryiko
2023-01-31 0:55 ` Joanne Koong
2023-01-31 1:06 ` Andrii Nakryiko
2023-01-31 1:13 ` Joanne Koong
2023-01-31 1:19 ` Andrii Nakryiko
2023-01-27 19:17 ` [PATCH v9 bpf-next 4/5] bpf: Add xdp dynptrs Joanne Koong
2023-01-27 19:17 ` [PATCH v9 bpf-next 5/5] selftests/bpf: tests for using dynptrs to parse skb and xdp buffers Joanne Koong
2023-01-31 0:49 ` Andrii Nakryiko
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAJnrk1Yc2zyHb+WRtZrtLMnj6kKAQTg0oBmMq5E4P9Byxamf1g@mail.gmail.com \
--to=joannelkoong@gmail.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=kernel-team@fb.com \
--cc=martin.lau@kernel.org \
--cc=martin.lau@linux.dev \
--cc=memxor@gmail.com \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).