• Udip Pant's avatar
    bpf: verifier: Use target program's type for access verifications · 7e40781c
    Udip Pant authored
    This patch adds changes in verifier to make decisions such as granting
    of read / write access or enforcement of return code status based on
    the program type of the target program while using dynamic program
    extension (of type BPF_PROG_TYPE_EXT).
    
    The BPF_PROG_TYPE_EXT type can be used to extend types such as XDP, SKB
    and others. Since the BPF_PROG_TYPE_EXT program type on itself is just a
    placeholder for those, we need this extended check for those extended
    programs to actually work with proper access, while using this option.
    
    Specifically, it introduces following changes:
    - may_access_direct_pkt_data:
        allow access to packet data based on the target prog
    - check_return_code:
        enforce return code based on the target prog
        (currently, this check is skipped for EXT program)
    - check_ld_abs:
        check for 'may_access_skb' based on the target prog
    - check_map_prog_compatibility:
        enforce the map compatibility check based on the target prog
    - may_update_sockmap:
        allow sockmap update based on the target prog
    
    Some other occurrences of prog->type is left as it without replacing
    with the 'resolved' type:
    - do_check_common() and check_attach_btf_id():
        already have specific logic to handle the EXT prog type
    - jit_subprogs() and bpf_check():
        Not changed for jit compilation or while inferring env->ops
    
    Next few patches in this series include selftests for some of these cases.
    Signed-off-by: default avatarUdip Pant <udippant@fb.com>
    Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
    Link: https://lore.kernel.org/bpf/20200825232003.2877030-2-udippant@fb.com
    7e40781c
verifier.c 326 KB