Commit 2492d3b8 authored by Daniel Borkmann's avatar Daniel Borkmann Committed by David S. Miller

bpf: enable load bytes helper for filter/reuseport progs

BPF_PROG_TYPE_SOCKET_FILTER are used in various facilities such as
for SO_REUSEPORT and packet fanout demuxing, packet filtering, kcm,
etc, and yet the only facility they can use is BPF_LD with {BPF_ABS,
BPF_IND} for single byte/half/word access.

Direct packet access is only restricted to tc programs right now,
but we can still facilitate usage by allowing skb_load_bytes() helper
added back then in 05c74e5e ("bpf: add bpf_skb_load_bytes helper")
that calls skb_header_pointer() similarly to bpf_load_pointer(), but
for stack buffers with larger access size.

Name the previous sk_filter_func_proto() as bpf_base_func_proto()
since this is used everywhere else as well, similarly for the ctx
converter, that is, bpf_convert_ctx_access().
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Acked-by: default avatarAlexei Starovoitov <ast@kernel.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 4faf940d
...@@ -2598,7 +2598,7 @@ static const struct bpf_func_proto bpf_xdp_event_output_proto = { ...@@ -2598,7 +2598,7 @@ static const struct bpf_func_proto bpf_xdp_event_output_proto = {
}; };
static const struct bpf_func_proto * static const struct bpf_func_proto *
sk_filter_func_proto(enum bpf_func_id func_id) bpf_base_func_proto(enum bpf_func_id func_id)
{ {
switch (func_id) { switch (func_id) {
case BPF_FUNC_map_lookup_elem: case BPF_FUNC_map_lookup_elem:
...@@ -2625,6 +2625,17 @@ sk_filter_func_proto(enum bpf_func_id func_id) ...@@ -2625,6 +2625,17 @@ sk_filter_func_proto(enum bpf_func_id func_id)
} }
} }
static const struct bpf_func_proto *
sk_filter_func_proto(enum bpf_func_id func_id)
{
switch (func_id) {
case BPF_FUNC_skb_load_bytes:
return &bpf_skb_load_bytes_proto;
default:
return bpf_base_func_proto(func_id);
}
}
static const struct bpf_func_proto * static const struct bpf_func_proto *
tc_cls_act_func_proto(enum bpf_func_id func_id) tc_cls_act_func_proto(enum bpf_func_id func_id)
{ {
...@@ -2680,7 +2691,7 @@ tc_cls_act_func_proto(enum bpf_func_id func_id) ...@@ -2680,7 +2691,7 @@ tc_cls_act_func_proto(enum bpf_func_id func_id)
case BPF_FUNC_skb_under_cgroup: case BPF_FUNC_skb_under_cgroup:
return &bpf_skb_under_cgroup_proto; return &bpf_skb_under_cgroup_proto;
default: default:
return sk_filter_func_proto(func_id); return bpf_base_func_proto(func_id);
} }
} }
...@@ -2695,7 +2706,7 @@ xdp_func_proto(enum bpf_func_id func_id) ...@@ -2695,7 +2706,7 @@ xdp_func_proto(enum bpf_func_id func_id)
case BPF_FUNC_xdp_adjust_head: case BPF_FUNC_xdp_adjust_head:
return &bpf_xdp_adjust_head_proto; return &bpf_xdp_adjust_head_proto;
default: default:
return sk_filter_func_proto(func_id); return bpf_base_func_proto(func_id);
} }
} }
...@@ -2706,7 +2717,7 @@ cg_skb_func_proto(enum bpf_func_id func_id) ...@@ -2706,7 +2717,7 @@ cg_skb_func_proto(enum bpf_func_id func_id)
case BPF_FUNC_skb_load_bytes: case BPF_FUNC_skb_load_bytes:
return &bpf_skb_load_bytes_proto; return &bpf_skb_load_bytes_proto;
default: default:
return sk_filter_func_proto(func_id); return bpf_base_func_proto(func_id);
} }
} }
...@@ -2733,7 +2744,7 @@ lwt_inout_func_proto(enum bpf_func_id func_id) ...@@ -2733,7 +2744,7 @@ lwt_inout_func_proto(enum bpf_func_id func_id)
case BPF_FUNC_skb_under_cgroup: case BPF_FUNC_skb_under_cgroup:
return &bpf_skb_under_cgroup_proto; return &bpf_skb_under_cgroup_proto;
default: default:
return sk_filter_func_proto(func_id); return bpf_base_func_proto(func_id);
} }
} }
...@@ -2983,7 +2994,7 @@ void bpf_warn_invalid_xdp_action(u32 act) ...@@ -2983,7 +2994,7 @@ void bpf_warn_invalid_xdp_action(u32 act)
} }
EXPORT_SYMBOL_GPL(bpf_warn_invalid_xdp_action); EXPORT_SYMBOL_GPL(bpf_warn_invalid_xdp_action);
static u32 sk_filter_convert_ctx_access(enum bpf_access_type type, static u32 bpf_convert_ctx_access(enum bpf_access_type type,
const struct bpf_insn *si, const struct bpf_insn *si,
struct bpf_insn *insn_buf, struct bpf_insn *insn_buf,
struct bpf_prog *prog) struct bpf_prog *prog)
...@@ -3210,7 +3221,7 @@ static u32 tc_cls_act_convert_ctx_access(enum bpf_access_type type, ...@@ -3210,7 +3221,7 @@ static u32 tc_cls_act_convert_ctx_access(enum bpf_access_type type,
offsetof(struct net_device, ifindex)); offsetof(struct net_device, ifindex));
break; break;
default: default:
return sk_filter_convert_ctx_access(type, si, insn_buf, prog); return bpf_convert_ctx_access(type, si, insn_buf, prog);
} }
return insn - insn_buf; return insn - insn_buf;
...@@ -3242,7 +3253,7 @@ static u32 xdp_convert_ctx_access(enum bpf_access_type type, ...@@ -3242,7 +3253,7 @@ static u32 xdp_convert_ctx_access(enum bpf_access_type type,
static const struct bpf_verifier_ops sk_filter_ops = { static const struct bpf_verifier_ops sk_filter_ops = {
.get_func_proto = sk_filter_func_proto, .get_func_proto = sk_filter_func_proto,
.is_valid_access = sk_filter_is_valid_access, .is_valid_access = sk_filter_is_valid_access,
.convert_ctx_access = sk_filter_convert_ctx_access, .convert_ctx_access = bpf_convert_ctx_access,
}; };
static const struct bpf_verifier_ops tc_cls_act_ops = { static const struct bpf_verifier_ops tc_cls_act_ops = {
...@@ -3261,24 +3272,24 @@ static const struct bpf_verifier_ops xdp_ops = { ...@@ -3261,24 +3272,24 @@ static const struct bpf_verifier_ops xdp_ops = {
static const struct bpf_verifier_ops cg_skb_ops = { static const struct bpf_verifier_ops cg_skb_ops = {
.get_func_proto = cg_skb_func_proto, .get_func_proto = cg_skb_func_proto,
.is_valid_access = sk_filter_is_valid_access, .is_valid_access = sk_filter_is_valid_access,
.convert_ctx_access = sk_filter_convert_ctx_access, .convert_ctx_access = bpf_convert_ctx_access,
}; };
static const struct bpf_verifier_ops lwt_inout_ops = { static const struct bpf_verifier_ops lwt_inout_ops = {
.get_func_proto = lwt_inout_func_proto, .get_func_proto = lwt_inout_func_proto,
.is_valid_access = lwt_is_valid_access, .is_valid_access = lwt_is_valid_access,
.convert_ctx_access = sk_filter_convert_ctx_access, .convert_ctx_access = bpf_convert_ctx_access,
}; };
static const struct bpf_verifier_ops lwt_xmit_ops = { static const struct bpf_verifier_ops lwt_xmit_ops = {
.get_func_proto = lwt_xmit_func_proto, .get_func_proto = lwt_xmit_func_proto,
.is_valid_access = lwt_is_valid_access, .is_valid_access = lwt_is_valid_access,
.convert_ctx_access = sk_filter_convert_ctx_access, .convert_ctx_access = bpf_convert_ctx_access,
.gen_prologue = tc_cls_act_prologue, .gen_prologue = tc_cls_act_prologue,
}; };
static const struct bpf_verifier_ops cg_sock_ops = { static const struct bpf_verifier_ops cg_sock_ops = {
.get_func_proto = sk_filter_func_proto, .get_func_proto = bpf_base_func_proto,
.is_valid_access = sock_filter_is_valid_access, .is_valid_access = sock_filter_is_valid_access,
.convert_ctx_access = sock_filter_convert_ctx_access, .convert_ctx_access = sock_filter_convert_ctx_access,
}; };
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment