devmap: Allow map lookups from eBPF

We don't currently allow lookups into a devmap from eBPF, because the map
lookup returns a pointer directly to the dev->ifindex, which shouldn't be
modifiable from eBPF.

However, being able to do lookups in devmaps is useful to know (e.g.)
whether forwarding to a specific interface is enabled. Currently, programs
work around this by keeping a shadow map of another type which indicates
whether a map index is valid.

Since we now have a flag to make maps read-only from the eBPF side, we can
simply lift the lookup restriction if we make sure this flag is always set.

Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com>
Acked-by: Jonathan Lemon <jonathan.lemon@gmail.com>
Acked-by: Andrii Nakryiko <andriin@fb.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>

diff --git a/kernel/bpf/devmap.c b/kernel/bpf/devmap.c
index a4dddc867cbfbc39d5793783135b5bcacb6b8b9c..d83cf8ccc87298f082a05781147185ddae69a140 100644 (file)
--- a/kernel/bpf/devmap.c
+++ b/kernel/bpf/devmap.c
@@ -89,6 +89,11 @@ static struct bpf_map *dev_map_alloc(union bpf_attr *attr)
            attr->value_size != 4 || attr->map_flags & ~DEV_CREATE_FLAG_MASK)
                return ERR_PTR(-EINVAL);
 
+       /* Lookup returns a pointer straight to dev->ifindex, so make sure the
+        * verifier prevents writes from the BPF side
+        */
+       attr->map_flags |= BPF_F_RDONLY_PROG;
+
        dtab = kzalloc(sizeof(*dtab), GFP_USER);
        if (!dtab)
                return ERR_PTR(-ENOMEM);

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 6b5623d320f98f9cbc531ed1689d88eec7e96f07..9b6ee93d5a85294a0f07914c5b2521adc480a196 100644 (file)
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -3414,12 +3414,9 @@ static int check_map_func_compatibility(struct bpf_verifier_env *env,
                if (func_id != BPF_FUNC_get_local_storage)
                        goto error;
                break;
-       /* devmap returns a pointer to a live net_device ifindex that we cannot
-        * allow to be modified from bpf side. So do not allow lookup elements
-        * for now.
-        */
        case BPF_MAP_TYPE_DEVMAP:
-               if (func_id != BPF_FUNC_redirect_map)
+               if (func_id != BPF_FUNC_redirect_map &&
+                   func_id != BPF_FUNC_map_lookup_elem)
                        goto error;
                break;
        /* Restrict bpf side of cpumap and xskmap, open when use-cases