lkml.org 
[lkml]   [2022]   [Nov]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [PoC][PATCH] bpf: Call return value check function in the JITed code
On Wed, Nov 16, 2022 at 7:48 AM Roberto Sassu
<roberto.sassu@huaweicloud.com> wrote:
> +static bool is_ret_value_allowed(int ret, u32 ret_flags)
> +{
> + if ((ret < 0 && !(ret_flags & LSM_RET_NEG)) ||
> + (ret == 0 && !(ret_flags & LSM_RET_ZERO)) ||
> + (ret == 1 && !(ret_flags & LSM_RET_ONE)) ||
> + (ret > 1 && !(ret_flags & LSM_RET_GT_ONE)))
> + return false;
> +
> + return true;
> +}
> +
> /* For every LSM hook that allows attachment of BPF programs, declare a nop
> * function where a BPF program can be attached.
> */
> @@ -30,6 +41,15 @@ noinline RET bpf_lsm_##NAME(__VA_ARGS__) \
> #include <linux/lsm_hook_defs.h>
> #undef LSM_HOOK
>
> +#define LSM_HOOK(RET, DEFAULT, RET_FLAGS, NAME, ...) \
> +noinline RET bpf_lsm_##NAME##_ret(int ret) \
> +{ \
> + return is_ret_value_allowed(ret, RET_FLAGS) ? ret : DEFAULT; \
> +}
> +
> +#include <linux/lsm_hook_defs.h>
> +#undef LSM_HOOK
> +

because lsm hooks is mess of undocumented return values your
"solution" is to add hundreds of noninline functions
and hack the call into them in JITs ?!
That's an obvious no-go. Not sure why you bothered to implement it.

\
 
 \ /
  Last update: 2022-11-16 17:17    [W:0.325 / U:0.104 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site