bpf: check changes_pkt_data property for extension programs

commit 81f6d0530ba031b5f038a091619bf2ff29568852 upstream.

When processing calls to global sub-programs, verifier decides whether
to invalidate all packet pointers in current state depending on the
changes_pkt_data property of the global sub-program.

Because of this, an extension program replacing a global sub-program
must be compatible with changes_pkt_data property of the sub-program
being replaced.

This commit:
- adds changes_pkt_data flag to struct bpf_prog_aux:
  - this flag is set in check_cfg() for main sub-program;
  - in jit_subprogs() for other sub-programs;
- modifies bpf_check_attach_btf_id() to check changes_pkt_data flag;
- moves call to check_attach_btf_id() after the call to check_cfg(),
  because it needs changes_pkt_data flag to be set:

    bpf_check:
      ...                             ...
    - check_attach_btf_id             resolve_pseudo_ldimm64
      resolve_pseudo_ldimm64   -->    bpf_prog_is_offloaded
      bpf_prog_is_offloaded           check_cfg
      check_cfg                     + check_attach_btf_id
      ...                             ...

The following fields are set by check_attach_btf_id():
- env->ops
- prog->aux->attach_btf_trace
- prog->aux->attach_func_name
- prog->aux->attach_func_proto
- prog->aux->dst_trampoline
- prog->aux->mod
- prog->aux->saved_dst_attach_type
- prog->aux->saved_dst_prog_type
- prog->expected_attach_type

Neither of these fields are used by resolve_pseudo_ldimm64() or
bpf_prog_offload_verifier_prep() (for netronome and netdevsim
drivers), so the reordering is safe.

Suggested-by: Alexei Starovoitov <alexei.starovoitov@gmail.com>
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20241210041100.1898468-6-eddyz87@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
[ shung-hsi.yu: adapt to missing fields in "struct bpf_prog_aux". Context
difference in jit_subprogs() because BPF Exception is not supported. Context
difference in bpf_check() because commit 5b5f51bff1b6 "bpf:
no_caller_saved_registers attribute for helper calls" is not present. ]
Signed-off-by: Shung-Hsi Yu <shung-hsi.yu@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 035e627f94f62d6f10668e297b27d67a8b97c08d..17de12a98f858a95ba722a434e874ce05e038f37 100644 (file)
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -1430,6 +1430,7 @@ struct bpf_prog_aux {
        bool sleepable;
        bool tail_call_reachable;
        bool xdp_has_frags;
+       bool changes_pkt_data;
        /* BTF_KIND_FUNC_PROTO for valid attach_btf_id */
        const struct btf_type *attach_func_proto;
        /* function name for valid attach_btf_id */

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 3ba6c13bb2213a748e443cc4bb9404ec614d8aa3..9fe9f72a6194d9a7880a1b08e9fa2fcdc21186b4 100644 (file)
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -15462,6 +15462,7 @@ static int check_cfg(struct bpf_verifier_env *env)
                }
        }
        ret = 0; /* cfg looks good */
+       env->prog->aux->changes_pkt_data = env->subprog_info[0].changes_pkt_data;
 
 err_free:
        kvfree(insn_state);
@@ -18622,6 +18623,7 @@ static int jit_subprogs(struct bpf_verifier_env *env)
                }
                func[i]->aux->num_exentries = num_exentries;
                func[i]->aux->tail_call_reachable = env->subprog_info[i].tail_call_reachable;
+               func[i]->aux->changes_pkt_data = env->subprog_info[i].changes_pkt_data;
                func[i] = bpf_int_jit_compile(func[i]);
                if (!func[i]->jited) {
                        err = -ENOTSUPP;
@@ -19934,6 +19936,12 @@ int bpf_check_attach_target(struct bpf_verifier_log *log,
                                        "Extension programs should be JITed\n");
                                return -EINVAL;
                        }
+                       if (prog->aux->changes_pkt_data &&
+                           !aux->func[subprog]->aux->changes_pkt_data) {
+                               bpf_log(log,
+                                       "Extension program changes packet data, while original does not\n");
+                               return -EINVAL;
+                       }
                }
                if (!tgt_prog->jited) {
                        bpf_log(log, "Can attach to only JITed progs\n");
@@ -20393,10 +20401,6 @@ int bpf_check(struct bpf_prog **prog, union bpf_attr *attr, bpfptr_t uattr, __u3
        if (ret < 0)
                goto skip_full_check;
 
-       ret = check_attach_btf_id(env);
-       if (ret)
-               goto skip_full_check;
-
        ret = resolve_pseudo_ldimm64(env);
        if (ret < 0)
                goto skip_full_check;
@@ -20411,6 +20415,10 @@ int bpf_check(struct bpf_prog **prog, union bpf_attr *attr, bpfptr_t uattr, __u3
        if (ret < 0)
                goto skip_full_check;
 
+       ret = check_attach_btf_id(env);
+       if (ret)
+               goto skip_full_check;
+
        ret = do_check_subprogs(env);
        ret = ret ?: do_check_main(env);