On Wed, Jan 23, 2019 at 3:55 AM Daniel Borkmann <dan...@iogearbox.net> wrote:
>
> On 01/18/2019 07:42 PM, Martin Lau wrote:
> > On Thu, Jan 17, 2019 at 03:31:57PM -0800, Eric Dumazet wrote:
> >> This adds the ability to read gso_segs from a BPF program.
> >>
> >> v2: refined Eddie Hao patch to address Alexei feedback.
> >>
> >> Signed-off-by: Eric Dumazet <eduma...@google.com>
> >> Cc: Eddie Hao <edd...@google.com>
> >> Cc: Vlad Dumitrescu <vla...@google.com>
> >> Cc: Xiaotian Pei <xiaot...@google.com>
> >> Cc: Yuchung Cheng <ych...@google.com>
> >> ---
> >> include/uapi/linux/bpf.h | 1 +
> >> net/core/filter.c | 21 ++++++++++++
> >> tools/include/uapi/linux/bpf.h | 1 +
> >> tools/testing/selftests/bpf/test_verifier.c | 36 +++++++++++++++++++++
> >> 4 files changed, 59 insertions(+)
> >>
> >> diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
> >> index
> >> 91c43884f295f60a85268ddf0020bf8aa47f8329..2940a9854f6d8e493518ca894e0c9c630ae4ab7a
> >> 100644
> >> --- a/include/uapi/linux/bpf.h
> >> +++ b/include/uapi/linux/bpf.h
> >> @@ -2540,6 +2540,7 @@ struct __sk_buff {
> >> __bpf_md_ptr(struct bpf_flow_keys *, flow_keys);
> >> __u64 tstamp;
> >> __u32 wire_len;
> >> + __u32 gso_segs;
> >> };
> >>
> >> struct bpf_tunnel_key {
> >> diff --git a/net/core/filter.c b/net/core/filter.c
> >> index
> >> 2b3b436ef5457bf44c99780d6dec0b5f403f005c..a6ff5d9a04cf06926ee75cbc523456d12baf25ae
> >> 100644
> >> --- a/net/core/filter.c
> >> +++ b/net/core/filter.c
> >> @@ -6700,6 +6700,27 @@ static u32 bpf_convert_ctx_access(enum
> >> bpf_access_type type,
> >> target_size));
> >> break;
> >>
> >> + case offsetof(struct __sk_buff, gso_segs):
> >> + /* si->dst_reg = skb_shinfo(SKB); */
> >> +#ifdef NET_SKBUFF_DATA_USES_OFFSET
> >> + *insn++ = BPF_LDX_MEM(BPF_FIELD_SIZEOF(struct sk_buff, head),
> >> + si->dst_reg, si->src_reg,
> >> + offsetof(struct sk_buff, head));
> >> + *insn++ = BPF_LDX_MEM(BPF_FIELD_SIZEOF(struct sk_buff, end),
> >> + BPF_REG_TMP, si->src_reg,
> >> + offsetof(struct sk_buff, end));
> > I am not sure BPF_REG_TMP can be used for non-classic BPF.
> > The earlier insn could be using BPF_REG_TMP (which is BPF_REG_2) and
> > R2 would become loss after this BPF_LDX_MEM.
>
> Yes, this will indeed corrupt R2 register. BPF_REG_TMP can only be used for
> reg mapping out of classic BPF.
>
> > Daniel, can BPF_REG_AX be used here as a tmp?
>
> BPF_REG_AX would work in this case, yes. Neither of the above insns are used
> in blinding nor would they collide with current verifier rewrites.
>
OK, I'll send a v3 using REG_AX then, thanks Daniel & Martin !
