bpf: allow programs to write to certain skb fields

allow programs read/write skb->mark, tc_index fields and
((struct qdisc_skb_cb *)cb)->data.

mark and tc_index are generically useful in TC.
cb[0]-cb[4] are primarily used to pass arguments from one
program to another called via bpf_tail_call() which can
be seen in sockex3_kern.c example.

All fields of 'struct __sk_buff' are readable to socket and tc_cls_act progs.
mark, tc_index are writeable from tc_cls_act only.
cb[0]-cb[4] are writeable by both sockets and tc_cls_act.

Add verifier tests and improve sample code.

Signed-off-by: Alexei Starovoitov <ast@plumgrid.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 82 insertions, 2 deletions

diff --git a/samples/bpf/test_verifier.c b/samples/bpf/test_verifier.c
index 12f3780af73f..693605997abc 100644
--- a/samples/bpf/test_verifier.c
+++ b/samples/bpf/test_verifier.c
@@ -29,6 +29,7 @@ struct bpf_test {
                 ACCEPT,
                 REJECT
         } result;
+        enum bpf_prog_type prog_type;
 };
 
 static struct bpf_test tests[] = {
@@ -743,6 +744,84 @@ static struct bpf_test tests[] = {
                 .errstr = "different pointers",
                 .result = REJECT,
         },
+        {
+                "check skb->mark is not writeable by sockets",
+                .insns = {
+                        BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
+                                    offsetof(struct __sk_buff, mark)),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "invalid bpf_context access",
+                .result = REJECT,
+        },
+        {
+                "check skb->tc_index is not writeable by sockets",
+                .insns = {
+                        BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
+                                    offsetof(struct __sk_buff, tc_index)),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "invalid bpf_context access",
+                .result = REJECT,
+        },
+        {
+                "check non-u32 access to cb",
+                .insns = {
+                        BPF_STX_MEM(BPF_H, BPF_REG_1, BPF_REG_1,
+                                    offsetof(struct __sk_buff, cb[0])),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "invalid bpf_context access",
+                .result = REJECT,
+        },
+        {
+                "check out of range skb->cb access",
+                .insns = {
+                        BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                                    offsetof(struct __sk_buff, cb[60])),
+                        BPF_EXIT_INSN(),
+                },
+                .errstr = "invalid bpf_context access",
+                .result = REJECT,
+                .prog_type = BPF_PROG_TYPE_SCHED_ACT,
+        },
+        {
+                "write skb fields from socket prog",
+                .insns = {
+                        BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                                    offsetof(struct __sk_buff, cb[4])),
+                        BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                                    offsetof(struct __sk_buff, mark)),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                                    offsetof(struct __sk_buff, tc_index)),
+                        BPF_JMP_IMM(BPF_JGE, BPF_REG_0, 0, 1),
+                        BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
+                                    offsetof(struct __sk_buff, cb[0])),
+                        BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_1,
+                                    offsetof(struct __sk_buff, cb[2])),
+                        BPF_EXIT_INSN(),
+                },
+                .result = ACCEPT,
+        },
+        {
+                "write skb fields from tc_cls_act prog",
+                .insns = {
+                        BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                                    offsetof(struct __sk_buff, cb[0])),
+                        BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
+                                    offsetof(struct __sk_buff, mark)),
+                        BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                                    offsetof(struct __sk_buff, tc_index)),
+                        BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
+                                    offsetof(struct __sk_buff, tc_index)),
+                        BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
+                                    offsetof(struct __sk_buff, cb[3])),
+                        BPF_EXIT_INSN(),
+                },
+                .result = ACCEPT,
+                .prog_type = BPF_PROG_TYPE_SCHED_CLS,
+        },
 };
 
 static int probe_filter_length(struct bpf_insn *fp)
@@ -775,6 +854,7 @@ static int test(void)
 
         for (i = 0; i < ARRAY_SIZE(tests); i++) {
                 struct bpf_insn *prog = tests[i].insns;
+                int prog_type = tests[i].prog_type;
                 int prog_len = probe_filter_length(prog);
                 int *fixup = tests[i].fixup;
                 int map_fd = -1;
@@ -789,8 +869,8 @@ static int test(void)
                 }
                 printf("#%d %s ", i, tests[i].descr);
 
-                prog_fd = bpf_prog_load(BPF_PROG_TYPE_SOCKET_FILTER, prog,
-                                        prog_len * sizeof(struct bpf_insn),
+                prog_fd = bpf_prog_load(prog_type ?: BPF_PROG_TYPE_SOCKET_FILTER,
+                                        prog, prog_len * sizeof(struct bpf_insn),
                                         "GPL", 0);
 
                 if (tests[i].result == ACCEPT) {