linuxppc-dev.lists.ozlabs.org archive mirror
 help / color / mirror / Atom feed
* [REGRESSION][PATCH V4 0/3] bpf jit drops the ball on negative memory references
@ 2012-03-30 15:00 Jan Seiffert
  2012-03-30 15:08 ` [REGRESSION][PATCH V4 1/3] bpf jit: Make the filter.c::__load_pointer helper non-static for the jits Jan Seiffert
  2012-03-30 15:35 ` [REGRESSION][PATCH V4 3/3] bpf jit: Let the powerpc jit handle negative offsets Jan Seiffert
  0 siblings, 2 replies; 22+ messages in thread
From: Jan Seiffert @ 2012-03-30 15:00 UTC (permalink / raw)
  To: netdev
  Cc: Eric Dumazet, linuxppc-dev, linux-kernel, Matt Evans,
	David S. Miller

Consider the following test program:

#include <stdio.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <netinet/in.h>
#include <pcap-bpf.h>

#define die(x) do {perror(x); return 1;} while (0)
struct bpf_insn udp_filter[] = {
	/*   0 */ BPF_STMT(BPF_LDX|BPF_W|BPF_IMM, -1048576+(0)), /* leax	net[0] */
	/*   1 */ BPF_STMT(BPF_LD|BPF_B|BPF_IND, 0),             /* ldb	[x+0] */
	/*   2 */ BPF_STMT(BPF_RET|BPF_A, 0),                    /* ret	a */
};

int main(int argc, char *argv[])
{
	char buf[512];
	struct sockaddr_in addr;
	struct bpf_program prg;
	socklen_t addr_s;
	ssize_t res;
	int fd;

	addr.sin_family = AF_INET;
	addr.sin_port = htons(5000);
	addr.sin_addr.s_addr = 0;
	addr_s = sizeof(addr);
	prg.bf_len = sizeof(udp_filter)/sizeof(udp_filter[0]);
	prg.bf_insns = udp_filter;
	if(-1 == (fd = socket(AF_INET, SOCK_DGRAM, 0)))
		die("socket");
	if(-1 == bind(fd, (struct sockaddr *)&addr, sizeof(addr)))
		die("bind");
	if(-1 == setsockopt(fd, SOL_SOCKET, SO_ATTACH_FILTER, &prg, sizeof(prg)))
		die("setsockopt");
	res = recvfrom(fd, buf, sizeof(buf), 0, (struct sockaddr *)&addr, &addr_s);
	if(res != -1)
		printf("packet received: %zi bytes\n", res);
	else
		die("recvfrom");
	return 0;
}

when used with the bpf jit disabled works:
console 1 $ ./bpf
console 2 $ echo "hello" | nc -u localhost 5000
console 1: packet received: 6 bytes

When the bpf jit gets enabled (echo 100 >
/proc/sys/net/core/bpf_jit_enable) the same program stops working:
console 1 $ ./bpf
console 2 $ echo "hello" | nc -u localhost 5000
console 1:

The reason is that both jits (x86 and powerpc) do not handle negative
memory references like SKF_NET_OFF or SKF_LL_OFF, only the simple
ancillary data references are supported (by mapping to special
instructions).
In the case of an absolute reference, the jit aborts the translation
if a negative reference is seen, also a negative k on the indirect
load aborts the translation, but if X is negative to begin with, only
the error handler is reached at runtime which drops the whole packet.

Such a setup is useful to say filter bogus source addresses on an UDP
socket.

I propose the following patch series to fix this situation.
Patch 1 exports the helper function the interpreter uses.
Patch 2 incorporates the helper into the x86 jit (so it depends on patch 1).
Patch 3 incorporates the helper into the powerpc jit (so it depends on patch 1).

Lightly tested on x86, but the powerpc asm part is prop. wrong, could
need assistance.


Signed-of-by: Jan Seiffert <kaffeemonster@googlemail.com>

^ permalink raw reply	[flat|nested] 22+ messages in thread
end of thread, other threads:[~2012-04-30 21:57 UTC | newest]

Thread overview: 22+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-03-30 15:00 [REGRESSION][PATCH V4 0/3] bpf jit drops the ball on negative memory references Jan Seiffert
2012-03-30 15:08 ` [REGRESSION][PATCH V4 1/3] bpf jit: Make the filter.c::__load_pointer helper non-static for the jits Jan Seiffert
2012-03-30 18:56   ` Eric Dumazet
2012-04-02  9:18   ` David Laight
2012-04-02 13:02     ` Jan Seiffert
2012-04-03 22:02   ` David Miller
2012-03-30 15:35 ` [REGRESSION][PATCH V4 3/3] bpf jit: Let the powerpc jit handle negative offsets Jan Seiffert
2012-04-03 22:03   ` David Miller
2012-04-03 22:11     ` Benjamin Herrenschmidt
2012-04-30  2:43       ` Benjamin Herrenschmidt
2012-04-30  3:40         ` Benjamin Herrenschmidt
2012-04-30  3:43         ` Jan Seiffert
2012-04-30  4:11         ` Benjamin Herrenschmidt
2012-04-30  4:27           ` Jan Seiffert
2012-04-30  4:29             ` Benjamin Herrenschmidt
2012-04-30  4:43               ` Jan Seiffert
2012-04-30  5:26                 ` Benjamin Herrenschmidt
2012-04-30 17:41                   ` David Miller
2012-04-30 21:55                     ` Benjamin Herrenschmidt
2012-04-30 21:57                       ` Benjamin Herrenschmidt
2012-04-30  5:02           ` [REGRESSION][PATCH V5 " Jan Seiffert
2012-04-30 17:41             ` David Miller

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).