Revision 5a76cf2c5e9648693ec15f59fc73847be3c5a1b6 authored by Aditi Ghag on 10 July 2024, 16:14:44 UTC, committed by André Martins on 12 July 2024, 14:21:48 UTC
Verifier complexity error

```
{"level":"fatal","msg":"failed to start: daemon creation failed: error while initializing daemon: failed while reinitializing datapath: failed loading eBPF collection into the kernel: program cil_sock4_connect: load program: permission denied: 373: (07) r9 += 4: R9 pointer arithmetic on map_value_or_null prohibited, null-check it first (759 line(s) omitted)","subsys":"daemon"}

2024-07-10T08:01:19.145344750Z Verifier error: program cil_sock6_connect: load program: permission denied: 399: (07) r7 += 4: R7 pointer arithmetic on map_value_or_null prohibited, null-check it first (611 line(s) omitted)

```

Dylan reported -

```
We get a map value back here https://github.com/cilium/cilium/blob/main/bpf/bpf_sock.c#L387
Which we then null-check like we are supposed to do. However, for some reason
the generated byte code does the backend->port access first
so https://github.com/cilium/cilium/blob/main/bpf/bpf_sock.c#L422 or https://github.com/cilium/cilium/blob/main/bpf/bpf_sock.c#L434
We don't have the actual bytecode at the moment, but what I suspect
 is happening is that the compiler is computing the offset of backend->port
 without accessing the memory before the null check.
 ```

Add a barrier call so that compiler doesn't reorder the memory accesses.

Signed-off-by: Aditi Ghag <aditi@cilium.io>
1 parent 6e17c40
History
File Mode Size
.devcontainer
.github
.nvim
.vscode
Documentation
api
bpf
bugtool
cilium-dbg
cilium-health
clustermesh-apiserver
contrib
daemon
examples
hack
hubble
hubble-relay
images
install
operator
pkg
plugins
test
tools
vendor
.authors.aux -rw-r--r-- 416 bytes
.clang-format -rw-r--r-- 7.6 KB
.clomonitor.yml -rw-r--r-- 984 bytes
.gitattributes -rw-r--r-- 887 bytes
.gitignore -rw-r--r-- 1.8 KB
.golangci.yaml -rw-r--r-- 4.4 KB
.mailmap -rw-r--r-- 6.9 KB
AUTHORS -rw-r--r-- 52.1 KB
CODEOWNERS -rw-r--r-- 28.5 KB
CODE_OF_CONDUCT.md -rw-r--r-- 2.2 KB
CONTRIBUTING.md -rw-r--r-- 691 bytes
FURTHER_READINGS.rst -rw-r--r-- 6.4 KB
LICENSE -rw-r--r-- 11.1 KB
MAINTAINERS.md -rw-r--r-- 4.6 KB
Makefile -rw-r--r-- 23.6 KB
Makefile.defs -rw-r--r-- 7.6 KB
Makefile.docker -rw-r--r-- 7.1 KB
Makefile.kind -rw-r--r-- 16.9 KB
Makefile.quiet -rw-r--r-- 818 bytes
README.rst -rw-r--r-- 19.6 KB
SECURITY-INSIGHTS.yml -rw-r--r-- 2.1 KB
SECURITY.md -rw-r--r-- 1.0 KB
USERS.md -rw-r--r-- 35.2 KB
VERSION -rw-r--r-- 11 bytes
Vagrantfile -rw-r--r-- 14.9 KB
go.mod -rw-r--r-- 13.3 KB
go.sum -rw-r--r-- 96.6 KB
netlify.toml -rw-r--r-- 92 bytes
stable.txt -rw-r--r-- 8 bytes
vagrant_box_defaults.rb -rw-r--r-- 334 bytes

README.rst

back to top