Commit 058ec4a7 authored Mar 19, 2022 by Jakub Sitnicki Committed by Alexei Starovoitov Mar 20, 2022

bpf: Treat bpf_sk_lookup remote_port as a 2-byte field



In commit 9a69e2b3 ("bpf: Make remote_port field in struct
bpf_sk_lookup 16-bit wide") the remote_port field has been split up and
re-declared from u32 to be16.

However, the accompanying changes to the context access converter have not
been well thought through when it comes big-endian platforms.

Today 2-byte wide loads from offsetof(struct bpf_sk_lookup, remote_port)
are handled as narrow loads from a 4-byte wide field.

This by itself is not enough to create a problem, but when we combine

 1. 32-bit wide access to ->remote_port backed by a 16-wide wide load, with
 2. inherent difference between litte- and big-endian in how narrow loads
    need have to be handled (see bpf_ctx_narrow_access_offset),

we get inconsistent results for a 2-byte loads from &ctx->remote_port on LE
and BE architectures. This in turn makes BPF C code for the common case of
2-byte load from ctx->remote_port not portable.

To rectify it, inform the context access converter that remote_port is
2-byte wide field, and only 1-byte loads need to be treated as narrow
loads.

At the same time, we special-case the 4-byte load from &ctx->remote_port to
continue handling it the same way as do today, in order to keep the
existing BPF programs working.

Fixes: 9a69e2b3 ("bpf: Make remote_port field in struct bpf_sk_lookup 16-bit wide")
Signed-off-by: Jakub Sitnicki <jakub@cloudflare.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Link: https://lore.kernel.org/bpf/20220319183356.233666-2-jakub@cloudflare.com

parent 30630e44

net/core/filter.c

+18 −2

Original line number	Diff line number	Diff line
		@@ -10989,13 +10989,24 @@ static bool sk_lookup_is_valid_access(int off, int size,
		case bpf_ctx_range(struct bpf_sk_lookup, local_ip4):
		case bpf_ctx_range_till(struct bpf_sk_lookup, remote_ip6[0], remote_ip6[3]):
		case bpf_ctx_range_till(struct bpf_sk_lookup, local_ip6[0], local_ip6[3]):
		case offsetof(struct bpf_sk_lookup, remote_port) ...
		offsetof(struct bpf_sk_lookup, local_ip4) - 1:
		case bpf_ctx_range(struct bpf_sk_lookup, local_port):
		case bpf_ctx_range(struct bpf_sk_lookup, ingress_ifindex):
		bpf_ctx_record_field_size(info, sizeof(__u32));
		return bpf_ctx_narrow_access_ok(off, size, sizeof(__u32));

		case bpf_ctx_range(struct bpf_sk_lookup, remote_port):
		/* Allow 4-byte access to 2-byte field for backward compatibility */
		if (size == sizeof(__u32))
		return true;
		bpf_ctx_record_field_size(info, sizeof(__be16));
		return bpf_ctx_narrow_access_ok(off, size, sizeof(__be16));

		case offsetofend(struct bpf_sk_lookup, remote_port) ...
		offsetof(struct bpf_sk_lookup, local_ip4) - 1:
		/* Allow access to zero padding for backward compatibility */
		bpf_ctx_record_field_size(info, sizeof(__u16));
		return bpf_ctx_narrow_access_ok(off, size, sizeof(__u16));

		default:
		return false;
		}
		@@ -11077,6 +11088,11 @@ static u32 sk_lookup_convert_ctx_access(enum bpf_access_type type,
		sport, 2, target_size));
		break;

		case offsetofend(struct bpf_sk_lookup, remote_port):
		*target_size = 2;
		*insn++ = BPF_MOV32_IMM(si->dst_reg, 0);
		break;

		case offsetof(struct bpf_sk_lookup, local_port):
		*insn++ = BPF_LDX_MEM(BPF_H, si->dst_reg, si->src_reg,
		bpf_target_off(struct bpf_sk_lookup_kern,