Re: [PATCH net] nfp: bpf: Add an MTU check before offloading BPF

["Niklas Söderlund" <niklas.soderlund@corigine.com>]

On 2021-09-30 07:59:59 -0700, Jakub Kicinski wrote:
> On Thu, 30 Sep 2021 16:46:34 +0200 Niklas Söderlund wrote:
> > When the MTU is changed after the program is offloaded the check in 
> > nfp_bpf_check_mtu() is consulted and as it checks the MTU differently 
> > and fails the change. Maybe we should align this the other way around 
> > and update the check in nfp_bpf_check_mtu() to match the one in 
> > nfp_net_bpf_load()?
> 
> That sounds reasonable. Although I don't remember how reliable the
> max_pkt_offset logic is in practice (whether it's actually capable 
> of finding the max offset for realistic programs or it's mostly going
> to be set to MAX).
> 
> > On a side note the check in nfp_net_bpf_load() allows for BPF programs 
> > to be offloaded that do access data beyond the CMT size limit provided 
> > the MTU is set below the CMT threshold value.
> 
> Right, because of variable length offsets verifier will not be able to
> estimate max_pkt_offset.

Thanks, this made the design click for me.

> 
> > There should be no real harm in this as the verifier forces bounds
> > check so with a MTU small enough it should never happen. But maybe we
> > should add a check for this too to prevent such a program to be
> > loaded in the first place.

-- 
Regards,
Niklas Söderlund