iovisor / iovisor/bcc

tcpstates: dereference of modified ctx ptr R6 off=20 disallowed

Open
#3,568 9 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
22.7k
Forks
4.1k
Avg merge
10d 4h
Merged PRs (30d)
3

Description

In my environment, Linux Kernel 5.8.0, the master branch of the BCC lib.

When I run the `tools/tcpstates.py` script. I got some errors like this

```text
50: (85) call bpf_get_current_comm#16
last_idx 50 first_idx 39
regs=4 stack=0 before 49: (b7) r2 = 16
51: (18) r2 = 0xffff8af92da87c00
53: (bf) r4 = r10
54: (07) r4 += -112
55: (bf) r1 = r6
56: (18) r3 = 0xffffffff
58: (b7) r5 = 64
59: (05) goto pc+45
105: (85) call bpf_perf_event_output#25
last_idx 105 first_idx 105
R0_w=inv(id=0) R1_rw=ctx(id=0,off=0,imm=0) R2_rw=map_ptr(id=0,off=0,ks=4,vs=4,imm=0) R3_rw=inv4294967295 R4_rw=fp-112 R5_rw=invP64 R6=ctx(id=0,off=0,imm=0) R7=inv(id=0,umax_value=4294967295,var_off=(0x0; 0xffffffff)) R8=map_value(id=0,off=0,ks=8,vs=8,imm=0) R9=inv(id=0) R10=fp0 fp-8=mmmmmmmm fp-56_r=mmmmmmmm fp-64_r=mmmmmmmm fp-72_r=mmmmmmmm fp-80_r=mmmmmmmm fp-88_r=mmmmmmmm fp-96_r=mmmmmmmm fp-104_r=mmmmmmmm fp-112_rw=mmmmmmmm fp-120=mmmmmmmm
parent didn't have regs=20 stack=0 marks
last_idx 59 first_idx 39
regs=20 stack=0 before 59: (05) goto pc+45
regs=20 stack=0 before 58: (b7) r5 = 64
106: (07) r6 += 20
107: (61) r1 = *(u32 *)(r6 +0)
dereference of modified ctx ptr R6 off=20 disallowed
processed 60 insns (limit 1000000) max_states_per_insn 0 total_states 4 peak_states 4 mark_read 4
```

I figure out the code blow make have some issues when the `sk` is not existed in the `last` map

```c
if (args->newstate == TCP_CLOSE) {
last.delete(&sk);
} else {
u64 ts = bpf_ktime_get_ns();
last.update(&sk, &ts);
}
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with tools/tcpstates.py and reproduce the verifier rejection on Linux kernel 5.8 using the reported output. Inspect the last map delete/update path and the generated BPF instructions around the modified ctx pointer. Done means tcpstates.py loads and runs without the dereference-of-modified-ctx verifier error.

Written by the indexing model from the issue text.

Assessment

Tech stack
linux, python
Domain
networking, operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.