mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-27 11:19:37 +00:00
nfp: bpf: reject program on instructions unknown to the JIT compiler
If an eBPF instruction is unknown to the driver JIT compiler, we can reject the program at verification time. Signed-off-by: Quentin Monnet <quentin.monnet@netronome.com> Reviewed-by: Jakub Kicinski <jakub.kicinski@netronome.com> Reviewed-by: Jiong Wang <jiong.wang@netronome.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
This commit is contained in:
parent
7dfa4d87cf
commit
74801e50d5
3 changed files with 12 additions and 0 deletions
|
@ -2907,6 +2907,11 @@ void nfp_bpf_jit_prepare(struct nfp_prog *nfp_prog, unsigned int cnt)
|
|||
}
|
||||
}
|
||||
|
||||
bool nfp_bpf_supported_opcode(u8 code)
|
||||
{
|
||||
return !!instr_cb[code];
|
||||
}
|
||||
|
||||
void *nfp_bpf_relo_for_vnic(struct nfp_prog *nfp_prog, struct nfp_bpf_vnic *bv)
|
||||
{
|
||||
unsigned int i;
|
||||
|
|
|
@ -324,6 +324,7 @@ struct nfp_bpf_vnic {
|
|||
|
||||
void nfp_bpf_jit_prepare(struct nfp_prog *nfp_prog, unsigned int cnt);
|
||||
int nfp_bpf_jit(struct nfp_prog *prog);
|
||||
bool nfp_bpf_supported_opcode(u8 code);
|
||||
|
||||
extern const struct bpf_prog_offload_ops nfp_bpf_analyzer_ops;
|
||||
|
||||
|
|
|
@ -290,6 +290,12 @@ nfp_verify_insn(struct bpf_verifier_env *env, int insn_idx, int prev_insn_idx)
|
|||
meta = nfp_bpf_goto_meta(nfp_prog, meta, insn_idx, env->prog->len);
|
||||
nfp_prog->verifier_meta = meta;
|
||||
|
||||
if (!nfp_bpf_supported_opcode(meta->insn.code)) {
|
||||
pr_vlog(env, "instruction %#02x not supported\n",
|
||||
meta->insn.code);
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
if (meta->insn.src_reg >= MAX_BPF_REG ||
|
||||
meta->insn.dst_reg >= MAX_BPF_REG) {
|
||||
pr_vlog(env, "program uses extended registers - jit hardening?\n");
|
||||
|
|
Loading…
Reference in a new issue