فهرست منبع

ebpf: Ensure the bounds of log buffer

eBPF verifier rejects programs which are not checking the bounds of the
log buffer before writing any arguments. This change ensures that
written log arguments.

In practice, it means that doing this kind of checks is not going to be
needed in eBPF program code anymore:

https://github.com/alessandrod/aya-echo-tracepoint/blob/33a1aee2eaa7503615a444ffa574dfba2be943f9/echo-ebpf/src/main.rs#L47

Tested on:

https://github.com/vadorovsky/aya-echo-tracepoint/tree/876f8b45511d0818b683de9a2196e8103b92e1a7

Signed-off-by: Michal Rostecki <[email protected]>
Michal Rostecki 2 سال پیش
والد
کامیت
628b473
1فایلهای تغییر یافته به همراه3 افزوده شده و 0 حذف شده
  1. 3 0
      aya-log/ebpf/aya-log-ebpf-macros/src/expand.rs

+ 3 - 0
aya-log/ebpf/aya-log-ebpf-macros/src/expand.rs

@@ -92,6 +92,9 @@ pub(crate) fn log(args: LogArgs, level: Option<TokenStream>) -> Result<TokenStre
             let write_args = quote! {{
                 use ::aya_log_ebpf::WriteToBuf;
                 Ok::<_, ()>(record_len) #( .and_then(|record_len| {
+                    if record_len >= buf.buf.len() {
+                        return Err(());
+                    }
                     { #formatting_exprs }.write(&mut buf.buf[record_len..]).map(|len| record_len + len)
                 }) )*
             }};