Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Cleanup - reject_callx_r10 #598

Merged
merged 1 commit into from
Sep 26, 2024
Merged

Cleanup - reject_callx_r10 #598

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 0 additions & 4 deletions fuzz/fuzz_targets/common.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,6 @@ pub struct ConfigTemplate {
enable_stack_frame_gaps: bool,
enable_symbol_and_section_labels: bool,
sanitize_user_provided_values: bool,
reject_callx_r10: bool,
optimize_rodata: bool,
}

Expand All @@ -26,7 +25,6 @@ impl<'a> Arbitrary<'a> for ConfigTemplate {
enable_stack_frame_gaps: bools & (1 << 0) != 0,
enable_symbol_and_section_labels: bools & (1 << 1) != 0,
sanitize_user_provided_values: bools & (1 << 3) != 0,
reject_callx_r10: bools & (1 << 6) != 0,
optimize_rodata: bools & (1 << 9) != 0,
})
}
Expand All @@ -49,7 +47,6 @@ impl From<ConfigTemplate> for Config {
enable_stack_frame_gaps,
enable_symbol_and_section_labels,
sanitize_user_provided_values,
reject_callx_r10,
optimize_rodata,
} => Config {
max_call_depth,
Expand All @@ -58,7 +55,6 @@ impl From<ConfigTemplate> for Config {
enable_symbol_and_section_labels,
noop_instruction_rate,
sanitize_user_provided_values,
reject_callx_r10,
optimize_rodata,
..Default::default()
},
Expand Down
7 changes: 3 additions & 4 deletions src/verifier.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -201,15 +201,14 @@ fn check_imm_shift(insn: &ebpf::Insn, insn_ptr: usize, imm_bits: u64) -> Result<
fn check_callx_register(
insn: &ebpf::Insn,
insn_ptr: usize,
config: &Config,
sbpf_version: &SBPFVersion,
) -> Result<(), VerifierError> {
let reg = if sbpf_version.callx_uses_src_reg() {
insn.src as i64
} else {
insn.imm
};
if !(0..=10).contains(&reg) || (reg == 10 && config.reject_callx_r10) {
if !(0..10).contains(&reg) {
return Err(VerifierError::InvalidRegister(insn_ptr));
}
Ok(())
Expand All @@ -221,7 +220,7 @@ pub struct RequisiteVerifier {}
impl Verifier for RequisiteVerifier {
/// Check the program against the verifier's rules
#[rustfmt::skip]
fn verify<C: ContextObject>(prog: &[u8], config: &Config, sbpf_version: &SBPFVersion, function_registry: &FunctionRegistry<usize>, syscall_registry: &FunctionRegistry<BuiltinFunction<C>>) -> Result<(), VerifierError> {
fn verify<C: ContextObject>(prog: &[u8], _config: &Config, sbpf_version: &SBPFVersion, function_registry: &FunctionRegistry<usize>, syscall_registry: &FunctionRegistry<BuiltinFunction<C>>) -> Result<(), VerifierError> {
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Perhaps we could remove the unused argument from the trait?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It is likely that there will be more feature flags affecting the verifier in the future. And this would have to be removed / added to the interface on the validator side every time.

check_prog_len(prog)?;

let program_range = 0..prog.len() / ebpf::INSN_SIZE;
Expand Down Expand Up @@ -378,7 +377,7 @@ impl Verifier for RequisiteVerifier {
ebpf::CALL_IMM if sbpf_version.static_syscalls() && insn.src != 0 => { check_call_target(insn.imm as u32, function_registry)?; },
ebpf::CALL_IMM if sbpf_version.static_syscalls() && insn.src == 0 => { check_call_target(insn.imm as u32, syscall_registry)?; },
ebpf::CALL_IMM => {},
ebpf::CALL_REG => { check_callx_register(&insn, insn_ptr, config, sbpf_version)?; },
ebpf::CALL_REG => { check_callx_register(&insn, insn_ptr, sbpf_version)?; },
ebpf::EXIT => {},

_ => {
Expand Down
3 changes: 0 additions & 3 deletions src/vm.rs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,8 +74,6 @@ pub struct Config {
pub sanitize_user_provided_values: bool,
/// Throw ElfError::SymbolHashCollision when a BPF function collides with a registered syscall
pub external_internal_function_hash_collision: bool,
/// Have the verifier reject "callx r10"
pub reject_callx_r10: bool,
/// Avoid copying read only sections when possible
pub optimize_rodata: bool,
/// Use aligned memory mapping
Expand Down Expand Up @@ -106,7 +104,6 @@ impl Default for Config {
noop_instruction_rate: 256,
sanitize_user_provided_values: true,
external_internal_function_hash_collision: true,
reject_callx_r10: true,
optimize_rodata: true,
aligned_memory_mapping: true,
enabled_sbpf_versions: SBPFVersion::V1..=SBPFVersion::V2,
Expand Down