]> www.infradead.org Git - users/jedix/linux-maple.git/commit
bpf: consider that tail calls invalidate packet pointers
authorEduard Zingerman <eddyz87@gmail.com>
Tue, 10 Dec 2024 04:10:59 +0000 (20:10 -0800)
committerAlexei Starovoitov <ast@kernel.org>
Tue, 10 Dec 2024 18:24:57 +0000 (10:24 -0800)
commit1a4607ffba35bf2a630aab299e34dd3f6e658d70
tree535a9521c3936f6232e4199d8d6bbc63d928bc29
parent89ff40890d8f12a7d7e93fb602cc27562f3834f0
bpf: consider that tail calls invalidate packet pointers

Tail-called programs could execute any of the helpers that invalidate
packet pointers. Hence, conservatively assume that each tail call
invalidates packet pointers.

Making the change in bpf_helper_changes_pkt_data() automatically makes
use of check_cfg() logic that computes 'changes_pkt_data' effect for
global sub-programs, such that the following program could be
rejected:

    int tail_call(struct __sk_buff *sk)
    {
     bpf_tail_call_static(sk, &jmp_table, 0);
     return 0;
    }

    SEC("tc")
    int not_safe(struct __sk_buff *sk)
    {
     int *p = (void *)(long)sk->data;
     ... make p valid ...
     tail_call(sk);
     *p = 42; /* this is unsafe */
     ...
    }

The tc_bpf2bpf.c:subprog_tc() needs change: mark it as a function that
can invalidate packet pointers. Otherwise, it can't be freplaced with
tailcall_freplace.c:entry_freplace() that does a tail call.

Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20241210041100.1898468-8-eddyz87@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
net/core/filter.c
tools/testing/selftests/bpf/progs/tc_bpf2bpf.c