• Alexei Starovoitov's avatar
    bpf: Implement accurate raw_tp context access via BTF · 9e15db66
    Alexei Starovoitov authored
    libbpf analyzes bpf C program, searches in-kernel BTF for given type name
    and stores it into expected_attach_type.
    The kernel verifier expects this btf_id to point to something like:
    typedef void (*btf_trace_kfree_skb)(void *, struct sk_buff *skb, void *loc);
    which represents signature of raw_tracepoint "kfree_skb".
    
    Then btf_ctx_access() matches ctx+0 access in bpf program with 'skb'
    and 'ctx+8' access with 'loc' arguments of "kfree_skb" tracepoint.
    In first case it passes btf_id of 'struct sk_buff *' back to the verifier core
    and 'void *' in second case.
    
    Then the verifier tracks PTR_TO_BTF_ID as any other pointer type.
    Like PTR_TO_SOCKET points to 'struct bpf_sock',
    PTR_TO_TCP_SOCK points to 'struct bpf_tcp_sock', and so on.
    PTR_TO_BTF_ID points to in-kernel structs.
    If 1234 is btf_id of 'struct sk_buff' in vmlinux's BTF
    then PTR_TO_BTF_ID#1234 points to one of in kernel skbs.
    
    When PTR_TO_BTF_ID#1234 is dereferenced (like r2 = *(u64 *)r1 + 32)
    the btf_struct_access() checks which field of 'struct sk_buff' is
    at offset 32. Checks that size of access matches type definition
    of the field and continues to track the dereferenced type.
    If that field was a pointer to 'struct net_device' the r2's type
    will be PTR_TO_BTF_ID#456. Where 456 is btf_id of 'struct net_device'
    in vmlinux's BTF.
    
    Such verifier analysis prevents "cheating" in BPF C program.
    The program cannot cast arbitrary pointer to 'struct sk_buff *'
    and access it. C compiler would allow type cast, of course,
    but the verifier will notice type mismatch based on BPF assembly
    and in-kernel BTF.
    Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
    Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
    Acked-by: default avatarAndrii Nakryiko <andriin@fb.com>
    Acked-by: default avatarMartin KaFai Lau <kafai@fb.com>
    Link: https://lore.kernel.org/bpf/20191016032505.2089704-7-ast@kernel.org
    9e15db66
bpf_trace.c 40.1 KB