| Message ID | 20240905075622.66819-5-lulie@linux.alibaba.com (mailing list archive) |
|---|---|
| State | Superseded |
| Headers | show |
| Series | bpf: Allow skb dynptr for tp_btf | expand |
On 9/5/24 12:56 AM, Philo Lu wrote: > Making tp_btf able to use bpf_dynptr_from_skb(), which is useful for skb > parsing, especially for non-linear paged skb data. This is achieved by > adding KF_TRUSTED_ARGS flag to bpf_dynptr_from_skb and registering it > for TRACING progs. With KF_TRUSTED_ARGS, args from fentry/fexit are > excluded, so that unsafe progs like fexit/__kfree_skb are not allowed. > > We also need the skb dynptr to be read-only in tp_btf. Because > may_access_direct_pkt_data() returns false by default when checking > bpf_dynptr_from_skb, there is no need to add BPF_PROG_TYPE_TRACING to it > explicitly. Acked-by: Martin KaFai Lau <martin.lau@kernel.org>
diff --git a/net/core/filter.c b/net/core/filter.c index 6d4fa9198b652..4c01f4756ddb5 100644 --- a/net/core/filter.c +++ b/net/core/filter.c @@ -12074,7 +12074,7 @@ int bpf_dynptr_from_skb_rdonly(struct __sk_buff *skb, u64 flags, } BTF_KFUNCS_START(bpf_kfunc_check_set_skb) -BTF_ID_FLAGS(func, bpf_dynptr_from_skb) +BTF_ID_FLAGS(func, bpf_dynptr_from_skb, KF_TRUSTED_ARGS) BTF_KFUNCS_END(bpf_kfunc_check_set_skb) BTF_KFUNCS_START(bpf_kfunc_check_set_xdp) @@ -12123,6 +12123,7 @@ static int __init bpf_kfunc_init(void) ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_LWT_XMIT, &bpf_kfunc_set_skb); ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_LWT_SEG6LOCAL, &bpf_kfunc_set_skb); ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_NETFILTER, &bpf_kfunc_set_skb); + ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_TRACING, &bpf_kfunc_set_skb); ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_XDP, &bpf_kfunc_set_xdp); ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_CGROUP_SOCK_ADDR, &bpf_kfunc_set_sock_addr);
Making tp_btf able to use bpf_dynptr_from_skb(), which is useful for skb parsing, especially for non-linear paged skb data. This is achieved by adding KF_TRUSTED_ARGS flag to bpf_dynptr_from_skb and registering it for TRACING progs. With KF_TRUSTED_ARGS, args from fentry/fexit are excluded, so that unsafe progs like fexit/__kfree_skb are not allowed. We also need the skb dynptr to be read-only in tp_btf. Because may_access_direct_pkt_data() returns false by default when checking bpf_dynptr_from_skb, there is no need to add BPF_PROG_TYPE_TRACING to it explicitly. Suggested-by: Martin KaFai Lau <martin.lau@linux.dev> Signed-off-by: Philo Lu <lulie@linux.alibaba.com> --- net/core/filter.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)