Revision 5a76cf2c5e9648693ec15f59fc73847be3c5a1b6 authored by Aditi Ghag on 10 July 2024, 16:14:44 UTC, committed by André Martins on 12 July 2024, 14:21:48 UTC
Verifier complexity error ``` {"level":"fatal","msg":"failed to start: daemon creation failed: error while initializing daemon: failed while reinitializing datapath: failed loading eBPF collection into the kernel: program cil_sock4_connect: load program: permission denied: 373: (07) r9 += 4: R9 pointer arithmetic on map_value_or_null prohibited, null-check it first (759 line(s) omitted)","subsys":"daemon"} 2024-07-10T08:01:19.145344750Z Verifier error: program cil_sock6_connect: load program: permission denied: 399: (07) r7 += 4: R7 pointer arithmetic on map_value_or_null prohibited, null-check it first (611 line(s) omitted) ``` Dylan reported - ``` We get a map value back here https://github.com/cilium/cilium/blob/main/bpf/bpf_sock.c#L387 Which we then null-check like we are supposed to do. However, for some reason the generated byte code does the backend->port access first so https://github.com/cilium/cilium/blob/main/bpf/bpf_sock.c#L422 or https://github.com/cilium/cilium/blob/main/bpf/bpf_sock.c#L434 We don't have the actual bytecode at the moment, but what I suspect is happening is that the compiler is computing the offset of backend->port without accessing the memory before the null check. ``` Add a barrier call so that compiler doesn't reorder the memory accesses. Signed-off-by: Aditi Ghag <aditi@cilium.io>
1 parent 6e17c40
File | Mode | Size |
---|---|---|
.devcontainer | ||
.github | ||
.nvim | ||
.vscode | ||
Documentation | ||
api | ||
bpf | ||
bugtool | ||
cilium-dbg | ||
cilium-health | ||
clustermesh-apiserver | ||
contrib | ||
daemon | ||
examples | ||
hack | ||
hubble | ||
hubble-relay | ||
images | ||
install | ||
operator | ||
pkg | ||
plugins | ||
test | ||
tools | ||
vendor | ||
.authors.aux | -rw-r--r-- | 416 bytes |
.clang-format | -rw-r--r-- | 7.6 KB |
.clomonitor.yml | -rw-r--r-- | 984 bytes |
.gitattributes | -rw-r--r-- | 887 bytes |
.gitignore | -rw-r--r-- | 1.8 KB |
.golangci.yaml | -rw-r--r-- | 4.4 KB |
.mailmap | -rw-r--r-- | 6.9 KB |
AUTHORS | -rw-r--r-- | 52.1 KB |
CODEOWNERS | -rw-r--r-- | 28.5 KB |
CODE_OF_CONDUCT.md | -rw-r--r-- | 2.2 KB |
CONTRIBUTING.md | -rw-r--r-- | 691 bytes |
FURTHER_READINGS.rst | -rw-r--r-- | 6.4 KB |
LICENSE | -rw-r--r-- | 11.1 KB |
MAINTAINERS.md | -rw-r--r-- | 4.6 KB |
Makefile | -rw-r--r-- | 23.6 KB |
Makefile.defs | -rw-r--r-- | 7.6 KB |
Makefile.docker | -rw-r--r-- | 7.1 KB |
Makefile.kind | -rw-r--r-- | 16.9 KB |
Makefile.quiet | -rw-r--r-- | 818 bytes |
README.rst | -rw-r--r-- | 19.6 KB |
SECURITY-INSIGHTS.yml | -rw-r--r-- | 2.1 KB |
SECURITY.md | -rw-r--r-- | 1.0 KB |
USERS.md | -rw-r--r-- | 35.2 KB |
VERSION | -rw-r--r-- | 11 bytes |
Vagrantfile | -rw-r--r-- | 14.9 KB |
go.mod | -rw-r--r-- | 13.3 KB |
go.sum | -rw-r--r-- | 96.6 KB |
netlify.toml | -rw-r--r-- | 92 bytes |
stable.txt | -rw-r--r-- | 8 bytes |
vagrant_box_defaults.rb | -rw-r--r-- | 334 bytes |
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...