tcpstates: dereference of modified ctx ptr R6 off=20 disallowed
- Dominant language
- C
- Stars
- 22.7k
- Forks
- 4.1k
- Avg merge
- 10d 4h
- Merged PRs (30d)
- 3
Description
In my environment, Linux Kernel 5.8.0, the master branch of the BCC lib.
When I run the `tools/tcpstates.py` script. I got some errors like this
```text
50: (85) call bpf_get_current_comm#16
last_idx 50 first_idx 39
regs=4 stack=0 before 49: (b7) r2 = 16
51: (18) r2 = 0xffff8af92da87c00
53: (bf) r4 = r10
54: (07) r4 += -112
55: (bf) r1 = r6
56: (18) r3 = 0xffffffff
58: (b7) r5 = 64
59: (05) goto pc+45
105: (85) call bpf_perf_event_output#25
last_idx 105 first_idx 105
R0_w=inv(id=0) R1_rw=ctx(id=0,off=0,imm=0) R2_rw=map_ptr(id=0,off=0,ks=4,vs=4,imm=0) R3_rw=inv4294967295 R4_rw=fp-112 R5_rw=invP64 R6=ctx(id=0,off=0,imm=0) R7=inv(id=0,umax_value=4294967295,var_off=(0x0; 0xffffffff)) R8=map_value(id=0,off=0,ks=8,vs=8,imm=0) R9=inv(id=0) R10=fp0 fp-8=mmmmmmmm fp-56_r=mmmmmmmm fp-64_r=mmmmmmmm fp-72_r=mmmmmmmm fp-80_r=mmmmmmmm fp-88_r=mmmmmmmm fp-96_r=mmmmmmmm fp-104_r=mmmmmmmm fp-112_rw=mmmmmmmm fp-120=mmmmmmmm
parent didn't have regs=20 stack=0 marks
last_idx 59 first_idx 39
regs=20 stack=0 before 59: (05) goto pc+45
regs=20 stack=0 before 58: (b7) r5 = 64
106: (07) r6 += 20
107: (61) r1 = *(u32 *)(r6 +0)
dereference of modified ctx ptr R6 off=20 disallowed
processed 60 insns (limit 1000000) max_states_per_insn 0 total_states 4 peak_states 4 mark_read 4
```
I figure out the code blow make have some issues when the `sk` is not existed in the `last` map
```c
if (args->newstate == TCP_CLOSE) {
last.delete(&sk);
} else {
u64 ts = bpf_ktime_get_ns();
last.update(&sk, &ts);
}
```
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with tools/tcpstates.py and reproduce the verifier rejection on Linux kernel 5.8 using the reported output. Inspect the last map delete/update path and the generated BPF instructions around the modified ctx pointer. Done means tcpstates.py loads and runs without the dereference-of-modified-ctx verifier error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- linux, python
- Domain
- networking, operating-systems
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100