bpf: remove mark access for SK_SKB program types

The skb->mark field is a union with reserved_tailroom which is used
in the TCP code paths from stream memory allocation. Allowing SK_SKB
programs to set this field creates a conflict with future code
optimizations, such as "gifting" the skb to the egress path instead
of creating a new skb and doing a memcpy.

Because we do not have a released version of SK_SKB yet lets just
remove it for now. A more appropriate scratch pad to use at the
socket layer is dev_scratch, but lets add that in future kernels
when needed.

Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 14 insertions, 2 deletions

diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c
index 3c7d3a45a3c5..50e15cedbb7f 100644
--- a/tools/testing/selftests/bpf/test_verifier.c
+++ b/tools/testing/selftests/bpf/test_verifier.c
@@ -1130,15 +1130,27 @@ static struct bpf_test tests[] = {
                 .errstr = "invalid bpf_context access",
         },
         {
-                "check skb->mark is writeable by SK_SKB",
+                "invalid access of skb->mark for SK_SKB",
+                .insns = {
+                        BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1,
+                                    offsetof(struct __sk_buff, mark)),
+                        BPF_EXIT_INSN(),
+                },
+                .result =  REJECT,
+                .prog_type = BPF_PROG_TYPE_SK_SKB,
+                .errstr = "invalid bpf_context access",
+        },
+        {
+                "check skb->mark is not writeable by SK_SKB",
                 .insns = {
                         BPF_MOV64_IMM(BPF_REG_0, 0),
                         BPF_STX_MEM(BPF_W, BPF_REG_1, BPF_REG_0,
                                     offsetof(struct __sk_buff, mark)),
                         BPF_EXIT_INSN(),
                 },
-                .result = ACCEPT,
+                .result =  REJECT,
                 .prog_type = BPF_PROG_TYPE_SK_SKB,
+                .errstr = "invalid bpf_context access",
         },
         {
                 "check skb->tc_index is writeable by SK_SKB",