* [PATCH bpf-next v2 01/11] btf: make btf_set_contains take a const pointer
2020-09-09 17:11 [PATCH bpf-next v2 00/11] Make check_func_arg type checks table driven Lorenz Bauer
@ 2020-09-09 17:11 ` Lorenz Bauer
2020-09-09 17:11 ` [PATCH bpf-next v2 02/11] bpf: check scalar or invalid register in check_helper_mem_access Lorenz Bauer
` (9 subsequent siblings)
10 siblings, 0 replies; 24+ messages in thread
From: Lorenz Bauer @ 2020-09-09 17:11 UTC (permalink / raw)
To: ast, yhs, daniel, kafai, andriin; +Cc: bpf, kernel-team, Lorenz Bauer
bsearch doesn't modify the contents of the array, so we can take a const pointer.
Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
Acked-by: Andrii Nakryiko <andriin@fb.com>
---
include/linux/bpf.h | 2 +-
kernel/bpf/btf.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index c6d9f2c444f4..6b72cdf52ebc 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -1900,6 +1900,6 @@ int bpf_arch_text_poke(void *ip, enum bpf_text_poke_type t,
void *addr1, void *addr2);
struct btf_id_set;
-bool btf_id_set_contains(struct btf_id_set *set, u32 id);
+bool btf_id_set_contains(const struct btf_id_set *set, u32 id);
#endif /* _LINUX_BPF_H */
diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
index f9ac6935ab3c..a2330f6fe2e6 100644
--- a/kernel/bpf/btf.c
+++ b/kernel/bpf/btf.c
@@ -4772,7 +4772,7 @@ static int btf_id_cmp_func(const void *a, const void *b)
return *pa - *pb;
}
-bool btf_id_set_contains(struct btf_id_set *set, u32 id)
+bool btf_id_set_contains(const struct btf_id_set *set, u32 id)
{
return bsearch(&id, set->ids, set->cnt, sizeof(u32), btf_id_cmp_func) != NULL;
}
--
2.25.1
^ permalink raw reply related [flat|nested] 24+ messages in thread* [PATCH bpf-next v2 02/11] bpf: check scalar or invalid register in check_helper_mem_access
2020-09-09 17:11 [PATCH bpf-next v2 00/11] Make check_func_arg type checks table driven Lorenz Bauer
2020-09-09 17:11 ` [PATCH bpf-next v2 01/11] btf: make btf_set_contains take a const pointer Lorenz Bauer
@ 2020-09-09 17:11 ` Lorenz Bauer
2020-09-09 17:11 ` [PATCH bpf-next v2 03/11] btf: Add BTF_ID_LIST_SINGLE macro Lorenz Bauer
` (8 subsequent siblings)
10 siblings, 0 replies; 24+ messages in thread
From: Lorenz Bauer @ 2020-09-09 17:11 UTC (permalink / raw)
To: ast, yhs, daniel, kafai, andriin; +Cc: bpf, kernel-team, Lorenz Bauer
Move the check for a NULL or zero register to check_helper_mem_access. This
makes check_stack_boundary easier to understand.
Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
Acked-by: Andrii Nakryiko <andriin@fb.com>
---
kernel/bpf/verifier.c | 24 +++++++++++-------------
1 file changed, 11 insertions(+), 13 deletions(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 814bc6c1ad16..c997f81c500b 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -3594,18 +3594,6 @@ static int check_stack_boundary(struct bpf_verifier_env *env, int regno,
struct bpf_func_state *state = func(env, reg);
int err, min_off, max_off, i, j, slot, spi;
- if (reg->type != PTR_TO_STACK) {
- /* Allow zero-byte read from NULL, regardless of pointer type */
- if (zero_size_allowed && access_size == 0 &&
- register_is_null(reg))
- return 0;
-
- verbose(env, "R%d type=%s expected=%s\n", regno,
- reg_type_str[reg->type],
- reg_type_str[PTR_TO_STACK]);
- return -EACCES;
- }
-
if (tnum_is_const(reg->var_off)) {
min_off = max_off = reg->var_off.value + reg->off;
err = __check_stack_boundary(env, regno, min_off, access_size,
@@ -3750,9 +3738,19 @@ static int check_helper_mem_access(struct bpf_verifier_env *env, int regno,
access_size, zero_size_allowed,
"rdwr",
&env->prog->aux->max_rdwr_access);
- default: /* scalar_value|ptr_to_stack or invalid ptr */
+ case PTR_TO_STACK:
return check_stack_boundary(env, regno, access_size,
zero_size_allowed, meta);
+ default: /* scalar_value or invalid ptr */
+ /* Allow zero-byte read from NULL, regardless of pointer type */
+ if (zero_size_allowed && access_size == 0 &&
+ register_is_null(reg))
+ return 0;
+
+ verbose(env, "R%d type=%s expected=%s\n", regno,
+ reg_type_str[reg->type],
+ reg_type_str[PTR_TO_STACK]);
+ return -EACCES;
}
}
--
2.25.1
^ permalink raw reply related [flat|nested] 24+ messages in thread* [PATCH bpf-next v2 03/11] btf: Add BTF_ID_LIST_SINGLE macro
2020-09-09 17:11 [PATCH bpf-next v2 00/11] Make check_func_arg type checks table driven Lorenz Bauer
2020-09-09 17:11 ` [PATCH bpf-next v2 01/11] btf: make btf_set_contains take a const pointer Lorenz Bauer
2020-09-09 17:11 ` [PATCH bpf-next v2 02/11] bpf: check scalar or invalid register in check_helper_mem_access Lorenz Bauer
@ 2020-09-09 17:11 ` Lorenz Bauer
2020-09-09 18:09 ` Martin KaFai Lau
2020-09-10 18:49 ` Andrii Nakryiko
2020-09-09 17:11 ` [PATCH bpf-next v2 04/11] bpf: allow specifying a BTF ID per argument in function protos Lorenz Bauer
` (7 subsequent siblings)
10 siblings, 2 replies; 24+ messages in thread
From: Lorenz Bauer @ 2020-09-09 17:11 UTC (permalink / raw)
To: ast, yhs, daniel, kafai, andriin; +Cc: bpf, kernel-team, Lorenz Bauer
Add a convenience macro that allows defining a BTF ID list with
a single item. This lets us cut down on repetitive macros.
Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
Suggested-by: Andrii Nakryiko <andriin@fb.com>
---
include/linux/btf_ids.h | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/include/linux/btf_ids.h b/include/linux/btf_ids.h
index 210b086188a3..d6a959572175 100644
--- a/include/linux/btf_ids.h
+++ b/include/linux/btf_ids.h
@@ -76,6 +76,13 @@ extern u32 name[];
#define BTF_ID_LIST_GLOBAL(name) \
__BTF_ID_LIST(name, globl)
+/* The BTF_ID_LIST_SINGLE macro defines a BTF_ID_LIST with
+ * a single entry.
+ */
+#define BTF_ID_LIST_SINGLE(name, prefix, typename) \
+ BTF_ID_LIST(name) \
+ BTF_ID(prefix, typename)
+
/*
* The BTF_ID_UNUSED macro defines 4 zero bytes.
* It's used when we want to define 'unused' entry
--
2.25.1
^ permalink raw reply related [flat|nested] 24+ messages in thread* Re: [PATCH bpf-next v2 03/11] btf: Add BTF_ID_LIST_SINGLE macro
2020-09-09 17:11 ` [PATCH bpf-next v2 03/11] btf: Add BTF_ID_LIST_SINGLE macro Lorenz Bauer
@ 2020-09-09 18:09 ` Martin KaFai Lau
2020-09-10 18:49 ` Andrii Nakryiko
1 sibling, 0 replies; 24+ messages in thread
From: Martin KaFai Lau @ 2020-09-09 18:09 UTC (permalink / raw)
To: Lorenz Bauer; +Cc: ast, yhs, daniel, andriin, bpf, kernel-team
On Wed, Sep 09, 2020 at 06:11:47PM +0100, Lorenz Bauer wrote:
> Add a convenience macro that allows defining a BTF ID list with
> a single item. This lets us cut down on repetitive macros.
>
> Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
> Suggested-by: Andrii Nakryiko <andriin@fb.com>
> ---
> include/linux/btf_ids.h | 7 +++++++
> 1 file changed, 7 insertions(+)
>
> diff --git a/include/linux/btf_ids.h b/include/linux/btf_ids.h
> index 210b086188a3..d6a959572175 100644
> --- a/include/linux/btf_ids.h
> +++ b/include/linux/btf_ids.h
> @@ -76,6 +76,13 @@ extern u32 name[];
> #define BTF_ID_LIST_GLOBAL(name) \
> __BTF_ID_LIST(name, globl)
>
> +/* The BTF_ID_LIST_SINGLE macro defines a BTF_ID_LIST with
> + * a single entry.
> + */
> +#define BTF_ID_LIST_SINGLE(name, prefix, typename) \
> + BTF_ID_LIST(name) \
> + BTF_ID(prefix, typename)
> +
The same is needed for the "#else" part when CONFIG_DEBUG_INFO_BTF is
not enabled.
^ permalink raw reply [flat|nested] 24+ messages in thread
* Re: [PATCH bpf-next v2 03/11] btf: Add BTF_ID_LIST_SINGLE macro
2020-09-09 17:11 ` [PATCH bpf-next v2 03/11] btf: Add BTF_ID_LIST_SINGLE macro Lorenz Bauer
2020-09-09 18:09 ` Martin KaFai Lau
@ 2020-09-10 18:49 ` Andrii Nakryiko
1 sibling, 0 replies; 24+ messages in thread
From: Andrii Nakryiko @ 2020-09-10 18:49 UTC (permalink / raw)
To: Lorenz Bauer
Cc: Alexei Starovoitov, Yonghong Song, Daniel Borkmann, Martin Lau,
Andrii Nakryiko, bpf, kernel-team
On Wed, Sep 9, 2020 at 10:13 AM Lorenz Bauer <lmb@cloudflare.com> wrote:
>
> Add a convenience macro that allows defining a BTF ID list with
> a single item. This lets us cut down on repetitive macros.
>
> Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
> Suggested-by: Andrii Nakryiko <andriin@fb.com>
> ---
> include/linux/btf_ids.h | 7 +++++++
> 1 file changed, 7 insertions(+)
>
> diff --git a/include/linux/btf_ids.h b/include/linux/btf_ids.h
> index 210b086188a3..d6a959572175 100644
> --- a/include/linux/btf_ids.h
> +++ b/include/linux/btf_ids.h
> @@ -76,6 +76,13 @@ extern u32 name[];
> #define BTF_ID_LIST_GLOBAL(name) \
> __BTF_ID_LIST(name, globl)
>
> +/* The BTF_ID_LIST_SINGLE macro defines a BTF_ID_LIST with
> + * a single entry.
> + */
> +#define BTF_ID_LIST_SINGLE(name, prefix, typename) \
> + BTF_ID_LIST(name) \
> + BTF_ID(prefix, typename)
> +
This is a very minor improvement over open coded
BTF_ID_LIST(name)
BTF_ID(prefix, typename)
It made way more sense for SET, due to duplication of set name in START/END.
But I don't mind it either.
> /*
> * The BTF_ID_UNUSED macro defines 4 zero bytes.
> * It's used when we want to define 'unused' entry
> --
> 2.25.1
>
^ permalink raw reply [flat|nested] 24+ messages in thread
* [PATCH bpf-next v2 04/11] bpf: allow specifying a BTF ID per argument in function protos
2020-09-09 17:11 [PATCH bpf-next v2 00/11] Make check_func_arg type checks table driven Lorenz Bauer
` (2 preceding siblings ...)
2020-09-09 17:11 ` [PATCH bpf-next v2 03/11] btf: Add BTF_ID_LIST_SINGLE macro Lorenz Bauer
@ 2020-09-09 17:11 ` Lorenz Bauer
2020-09-09 20:03 ` Martin KaFai Lau
2020-09-09 17:11 ` [PATCH bpf-next v2 05/11] bpf: make BTF pointer type checking generic Lorenz Bauer
` (6 subsequent siblings)
10 siblings, 1 reply; 24+ messages in thread
From: Lorenz Bauer @ 2020-09-09 17:11 UTC (permalink / raw)
To: ast, yhs, daniel, kafai, andriin; +Cc: bpf, kernel-team, Lorenz Bauer
Function prototypes using ARG_PTR_TO_BTF_ID currently use two ways to signal
which BTF IDs are acceptable. First, bpf_func_proto.btf_id is an array of
IDs, one for each argument. This array is only accessed up to the highest
numbered argument that uses ARG_PTR_TO_BTF_ID and may therefore be less than
five arguments long. It usually points at a BTF_ID_LIST. Second, check_btf_id
is a function pointer that is called by the verifier if present. It gets the
actual BTF ID of the register, and the argument number we're currently checking.
It turns out that the only user check_arg_btf_id ignores the argument, and is
simply used to check whether the BTF ID has a struct sock_common at it's start.
Replace both of these mechanisms with an explicit BTF ID for each argument
in a function proto. Thanks to btf_struct_ids_match this is very flexible:
check_arg_btf_id can be replaced by requiring struct sock_common.
Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
---
include/linux/bpf.h | 18 ++++++++++--------
kernel/bpf/bpf_inode_storage.c | 8 +++-----
kernel/bpf/btf.c | 13 -------------
kernel/bpf/stackmap.c | 5 ++---
kernel/bpf/verifier.c | 32 ++++++++++----------------------
kernel/trace/bpf_trace.c | 15 ++++++---------
net/core/bpf_sk_storage.c | 10 ++++------
net/core/filter.c | 31 +++++++++----------------------
net/ipv4/bpf_tcp_ca.c | 19 +++++--------------
9 files changed, 49 insertions(+), 102 deletions(-)
diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 6b72cdf52ebc..aabbc8bb52bd 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -326,12 +326,16 @@ struct bpf_func_proto {
};
enum bpf_arg_type arg_type[5];
};
- int *btf_id; /* BTF ids of arguments */
- bool (*check_btf_id)(u32 btf_id, u32 arg); /* if the argument btf_id is
- * valid. Often used if more
- * than one btf id is permitted
- * for this argument.
- */
+ union {
+ struct {
+ u32 *arg1_btf_id;
+ u32 *arg2_btf_id;
+ u32 *arg3_btf_id;
+ u32 *arg4_btf_id;
+ u32 *arg5_btf_id;
+ };
+ u32 *arg_btf_id[5];
+ };
int *ret_btf_id; /* return value btf_id */
bool (*allowed)(const struct bpf_prog *prog);
};
@@ -1380,8 +1384,6 @@ int btf_struct_access(struct bpf_verifier_log *log,
u32 *next_btf_id);
bool btf_struct_ids_match(struct bpf_verifier_log *log,
int off, u32 id, u32 need_type_id);
-int btf_resolve_helper_id(struct bpf_verifier_log *log,
- const struct bpf_func_proto *fn, int);
int btf_distill_func_proto(struct bpf_verifier_log *log,
struct btf *btf,
diff --git a/kernel/bpf/bpf_inode_storage.c b/kernel/bpf/bpf_inode_storage.c
index 75be02799c0f..6edff97ad594 100644
--- a/kernel/bpf/bpf_inode_storage.c
+++ b/kernel/bpf/bpf_inode_storage.c
@@ -249,9 +249,7 @@ const struct bpf_map_ops inode_storage_map_ops = {
.map_owner_storage_ptr = inode_storage_ptr,
};
-BTF_ID_LIST(bpf_inode_storage_btf_ids)
-BTF_ID_UNUSED
-BTF_ID(struct, inode)
+BTF_ID_LIST_SINGLE(bpf_inode_storage_btf_ids, struct, inode)
const struct bpf_func_proto bpf_inode_storage_get_proto = {
.func = bpf_inode_storage_get,
@@ -259,9 +257,9 @@ const struct bpf_func_proto bpf_inode_storage_get_proto = {
.ret_type = RET_PTR_TO_MAP_VALUE_OR_NULL,
.arg1_type = ARG_CONST_MAP_PTR,
.arg2_type = ARG_PTR_TO_BTF_ID,
+ .arg2_btf_id = &bpf_inode_storage_btf_ids[0],
.arg3_type = ARG_PTR_TO_MAP_VALUE_OR_NULL,
.arg4_type = ARG_ANYTHING,
- .btf_id = bpf_inode_storage_btf_ids,
};
const struct bpf_func_proto bpf_inode_storage_delete_proto = {
@@ -270,5 +268,5 @@ const struct bpf_func_proto bpf_inode_storage_delete_proto = {
.ret_type = RET_INTEGER,
.arg1_type = ARG_CONST_MAP_PTR,
.arg2_type = ARG_PTR_TO_BTF_ID,
- .btf_id = bpf_inode_storage_btf_ids,
+ .arg2_btf_id = &bpf_inode_storage_btf_ids[0],
};
diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
index a2330f6fe2e6..5d3c36e13139 100644
--- a/kernel/bpf/btf.c
+++ b/kernel/bpf/btf.c
@@ -4193,19 +4193,6 @@ bool btf_struct_ids_match(struct bpf_verifier_log *log,
return true;
}
-int btf_resolve_helper_id(struct bpf_verifier_log *log,
- const struct bpf_func_proto *fn, int arg)
-{
- int id;
-
- if (fn->arg_type[arg] != ARG_PTR_TO_BTF_ID || !btf_vmlinux)
- return -EINVAL;
- id = fn->btf_id[arg];
- if (!id || id > btf_vmlinux->nr_types)
- return -EINVAL;
- return id;
-}
-
static int __get_type_size(struct btf *btf, u32 btf_id,
const struct btf_type **bad_type)
{
diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c
index a2fa006f430e..06065fa27124 100644
--- a/kernel/bpf/stackmap.c
+++ b/kernel/bpf/stackmap.c
@@ -665,18 +665,17 @@ BPF_CALL_4(bpf_get_task_stack, struct task_struct *, task, void *, buf,
return __bpf_get_stack(regs, task, NULL, buf, size, flags);
}
-BTF_ID_LIST(bpf_get_task_stack_btf_ids)
-BTF_ID(struct, task_struct)
+BTF_ID_LIST_SINGLE(bpf_get_task_stack_btf_ids, struct, task_struct)
const struct bpf_func_proto bpf_get_task_stack_proto = {
.func = bpf_get_task_stack,
.gpl_only = false,
.ret_type = RET_INTEGER,
.arg1_type = ARG_PTR_TO_BTF_ID,
+ .arg1_btf_id = &bpf_get_task_stack_btf_ids[0],
.arg2_type = ARG_PTR_TO_UNINIT_MEM,
.arg3_type = ARG_CONST_SIZE_OR_ZERO,
.arg4_type = ARG_ANYTHING,
- .btf_id = bpf_get_task_stack_btf_ids,
};
BPF_CALL_4(bpf_get_stack_pe, struct bpf_perf_event_data_kern *, ctx,
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index c997f81c500b..7182c6e3eada 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -238,7 +238,6 @@ struct bpf_call_arg_meta {
u64 msize_max_value;
int ref_obj_id;
int func_id;
- u32 btf_id;
};
struct btf *btf_vmlinux;
@@ -4002,29 +4001,23 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
goto err_type;
}
} else if (arg_type == ARG_PTR_TO_BTF_ID) {
- bool ids_match = false;
+ const u32 *btf_id = fn->arg_btf_id[arg];
expected_type = PTR_TO_BTF_ID;
if (type != expected_type)
goto err_type;
- if (!fn->check_btf_id) {
- if (reg->btf_id != meta->btf_id) {
- ids_match = btf_struct_ids_match(&env->log, reg->off, reg->btf_id,
- meta->btf_id);
- if (!ids_match) {
- verbose(env, "Helper has type %s got %s in R%d\n",
- kernel_type_name(meta->btf_id),
- kernel_type_name(reg->btf_id), regno);
- return -EACCES;
- }
- }
- } else if (!fn->check_btf_id(reg->btf_id, arg)) {
- verbose(env, "Helper does not support %s in R%d\n",
- kernel_type_name(reg->btf_id), regno);
+ if (!btf_id) {
+ verbose(env, "verifier internal error: missing BTF ID\n");
+ return -EFAULT;
+ }
+
+ if (!btf_struct_ids_match(&env->log, reg->off, reg->btf_id, *btf_id)) {
+ verbose(env, "R%d has incompatible type %s\n", regno,
+ kernel_type_name(reg->btf_id));
return -EACCES;
}
- if ((reg->off && !ids_match) || !tnum_is_const(reg->var_off) || reg->var_off.value) {
+ if (!tnum_is_const(reg->var_off) || reg->var_off.value) {
verbose(env, "R%d is a pointer to in-kernel struct with non-zero offset\n",
regno);
return -EACCES;
@@ -4892,11 +4885,6 @@ static int check_helper_call(struct bpf_verifier_env *env, int func_id, int insn
meta.func_id = func_id;
/* check args */
for (i = 0; i < 5; i++) {
- if (!fn->check_btf_id) {
- err = btf_resolve_helper_id(&env->log, fn, i);
- if (err > 0)
- meta.btf_id = err;
- }
err = check_func_arg(env, i, &meta, fn);
if (err)
return err;
diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index b2a5380eb187..586add103fc4 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -743,19 +743,18 @@ BPF_CALL_5(bpf_seq_printf, struct seq_file *, m, char *, fmt, u32, fmt_size,
return err;
}
-BTF_ID_LIST(bpf_seq_printf_btf_ids)
-BTF_ID(struct, seq_file)
+BTF_ID_LIST_SINGLE(bpf_seq_printf_btf_ids, struct, seq_file)
static const struct bpf_func_proto bpf_seq_printf_proto = {
.func = bpf_seq_printf,
.gpl_only = true,
.ret_type = RET_INTEGER,
.arg1_type = ARG_PTR_TO_BTF_ID,
+ .arg1_btf_id = &bpf_seq_printf_btf_ids[0],
.arg2_type = ARG_PTR_TO_MEM,
.arg3_type = ARG_CONST_SIZE,
.arg4_type = ARG_PTR_TO_MEM_OR_NULL,
.arg5_type = ARG_CONST_SIZE_OR_ZERO,
- .btf_id = bpf_seq_printf_btf_ids,
};
BPF_CALL_3(bpf_seq_write, struct seq_file *, m, const void *, data, u32, len)
@@ -763,17 +762,16 @@ BPF_CALL_3(bpf_seq_write, struct seq_file *, m, const void *, data, u32, len)
return seq_write(m, data, len) ? -EOVERFLOW : 0;
}
-BTF_ID_LIST(bpf_seq_write_btf_ids)
-BTF_ID(struct, seq_file)
+BTF_ID_LIST_SINGLE(bpf_seq_write_btf_ids, struct, seq_file)
static const struct bpf_func_proto bpf_seq_write_proto = {
.func = bpf_seq_write,
.gpl_only = true,
.ret_type = RET_INTEGER,
.arg1_type = ARG_PTR_TO_BTF_ID,
+ .arg1_btf_id = &bpf_seq_write_btf_ids[0],
.arg2_type = ARG_PTR_TO_MEM,
.arg3_type = ARG_CONST_SIZE_OR_ZERO,
- .btf_id = bpf_seq_write_btf_ids,
};
static __always_inline int
@@ -1130,17 +1128,16 @@ static bool bpf_d_path_allowed(const struct bpf_prog *prog)
return btf_id_set_contains(&btf_allowlist_d_path, prog->aux->attach_btf_id);
}
-BTF_ID_LIST(bpf_d_path_btf_ids)
-BTF_ID(struct, path)
+BTF_ID_LIST_SINGLE(bpf_d_path_btf_ids, struct, path)
static const struct bpf_func_proto bpf_d_path_proto = {
.func = bpf_d_path,
.gpl_only = false,
.ret_type = RET_INTEGER,
.arg1_type = ARG_PTR_TO_BTF_ID,
+ .arg1_btf_id = &bpf_d_path_btf_ids[0],
.arg2_type = ARG_PTR_TO_MEM,
.arg3_type = ARG_CONST_SIZE_OR_ZERO,
- .btf_id = bpf_d_path_btf_ids,
.allowed = bpf_d_path_allowed,
};
diff --git a/net/core/bpf_sk_storage.c b/net/core/bpf_sk_storage.c
index a0d1a3265b71..442a34a7ee2b 100644
--- a/net/core/bpf_sk_storage.c
+++ b/net/core/bpf_sk_storage.c
@@ -357,6 +357,7 @@ const struct bpf_func_proto bpf_sk_storage_get_proto = {
.ret_type = RET_PTR_TO_MAP_VALUE_OR_NULL,
.arg1_type = ARG_CONST_MAP_PTR,
.arg2_type = ARG_PTR_TO_SOCKET,
+ .arg2_btf_id = &btf_sock_ids[BTF_SOCK_TYPE_SOCK_COMMON],
.arg3_type = ARG_PTR_TO_MAP_VALUE_OR_NULL,
.arg4_type = ARG_ANYTHING,
};
@@ -377,21 +378,18 @@ const struct bpf_func_proto bpf_sk_storage_delete_proto = {
.ret_type = RET_INTEGER,
.arg1_type = ARG_CONST_MAP_PTR,
.arg2_type = ARG_PTR_TO_SOCKET,
+ .arg2_btf_id = &btf_sock_ids[BTF_SOCK_TYPE_SOCK_COMMON],
};
-BTF_ID_LIST(sk_storage_btf_ids)
-BTF_ID_UNUSED
-BTF_ID(struct, sock)
-
const struct bpf_func_proto sk_storage_get_btf_proto = {
.func = bpf_sk_storage_get,
.gpl_only = false,
.ret_type = RET_PTR_TO_MAP_VALUE_OR_NULL,
.arg1_type = ARG_CONST_MAP_PTR,
.arg2_type = ARG_PTR_TO_BTF_ID,
+ .arg2_btf_id = &btf_sock_ids[BTF_SOCK_TYPE_SOCK],
.arg3_type = ARG_PTR_TO_MAP_VALUE_OR_NULL,
.arg4_type = ARG_ANYTHING,
- .btf_id = sk_storage_btf_ids,
};
const struct bpf_func_proto sk_storage_delete_btf_proto = {
@@ -400,7 +398,7 @@ const struct bpf_func_proto sk_storage_delete_btf_proto = {
.ret_type = RET_INTEGER,
.arg1_type = ARG_CONST_MAP_PTR,
.arg2_type = ARG_PTR_TO_BTF_ID,
- .btf_id = sk_storage_btf_ids,
+ .arg2_btf_id = &btf_sock_ids[BTF_SOCK_TYPE_SOCK],
};
struct bpf_sk_storage_diag {
diff --git a/net/core/filter.c b/net/core/filter.c
index 47eef9a0be6a..fb4f890b6ef6 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -3803,19 +3803,18 @@ static const struct bpf_func_proto bpf_skb_event_output_proto = {
.arg5_type = ARG_CONST_SIZE_OR_ZERO,
};
-BTF_ID_LIST(bpf_skb_output_btf_ids)
-BTF_ID(struct, sk_buff)
+BTF_ID_LIST_SINGLE(bpf_skb_output_btf_ids, struct, sk_buff)
const struct bpf_func_proto bpf_skb_output_proto = {
.func = bpf_skb_event_output,
.gpl_only = true,
.ret_type = RET_INTEGER,
.arg1_type = ARG_PTR_TO_BTF_ID,
+ .arg1_btf_id = &bpf_skb_output_btf_ids[0],
.arg2_type = ARG_CONST_MAP_PTR,
.arg3_type = ARG_ANYTHING,
.arg4_type = ARG_PTR_TO_MEM,
.arg5_type = ARG_CONST_SIZE_OR_ZERO,
- .btf_id = bpf_skb_output_btf_ids,
};
static unsigned short bpf_tunnel_key_af(u64 flags)
@@ -4199,19 +4198,18 @@ static const struct bpf_func_proto bpf_xdp_event_output_proto = {
.arg5_type = ARG_CONST_SIZE_OR_ZERO,
};
-BTF_ID_LIST(bpf_xdp_output_btf_ids)
-BTF_ID(struct, xdp_buff)
+BTF_ID_LIST_SINGLE(bpf_xdp_output_btf_ids, struct, xdp_buff)
const struct bpf_func_proto bpf_xdp_output_proto = {
.func = bpf_xdp_event_output,
.gpl_only = true,
.ret_type = RET_INTEGER,
.arg1_type = ARG_PTR_TO_BTF_ID,
+ .arg1_btf_id = &bpf_xdp_output_btf_ids[0],
.arg2_type = ARG_CONST_MAP_PTR,
.arg3_type = ARG_ANYTHING,
.arg4_type = ARG_PTR_TO_MEM,
.arg5_type = ARG_CONST_SIZE_OR_ZERO,
- .btf_id = bpf_xdp_output_btf_ids,
};
BPF_CALL_1(bpf_get_socket_cookie, struct sk_buff *, skb)
@@ -9907,17 +9905,6 @@ BTF_SOCK_TYPE_xxx
u32 btf_sock_ids[MAX_BTF_SOCK_TYPE];
#endif
-static bool check_arg_btf_id(u32 btf_id, u32 arg)
-{
- int i;
-
- /* only one argument, no need to check arg */
- for (i = 0; i < MAX_BTF_SOCK_TYPE; i++)
- if (btf_sock_ids[i] == btf_id)
- return true;
- return false;
-}
-
BPF_CALL_1(bpf_skc_to_tcp6_sock, struct sock *, sk)
{
/* tcp6_sock type is not generated in dwarf and hence btf,
@@ -9936,7 +9923,7 @@ const struct bpf_func_proto bpf_skc_to_tcp6_sock_proto = {
.gpl_only = false,
.ret_type = RET_PTR_TO_BTF_ID_OR_NULL,
.arg1_type = ARG_PTR_TO_BTF_ID,
- .check_btf_id = check_arg_btf_id,
+ .arg1_btf_id = &btf_sock_ids[BTF_SOCK_TYPE_SOCK_COMMON],
.ret_btf_id = &btf_sock_ids[BTF_SOCK_TYPE_TCP6],
};
@@ -9953,7 +9940,7 @@ const struct bpf_func_proto bpf_skc_to_tcp_sock_proto = {
.gpl_only = false,
.ret_type = RET_PTR_TO_BTF_ID_OR_NULL,
.arg1_type = ARG_PTR_TO_BTF_ID,
- .check_btf_id = check_arg_btf_id,
+ .arg1_btf_id = &btf_sock_ids[BTF_SOCK_TYPE_SOCK_COMMON],
.ret_btf_id = &btf_sock_ids[BTF_SOCK_TYPE_TCP],
};
@@ -9977,7 +9964,7 @@ const struct bpf_func_proto bpf_skc_to_tcp_timewait_sock_proto = {
.gpl_only = false,
.ret_type = RET_PTR_TO_BTF_ID_OR_NULL,
.arg1_type = ARG_PTR_TO_BTF_ID,
- .check_btf_id = check_arg_btf_id,
+ .arg1_btf_id = &btf_sock_ids[BTF_SOCK_TYPE_SOCK_COMMON],
.ret_btf_id = &btf_sock_ids[BTF_SOCK_TYPE_TCP_TW],
};
@@ -10001,7 +9988,7 @@ const struct bpf_func_proto bpf_skc_to_tcp_request_sock_proto = {
.gpl_only = false,
.ret_type = RET_PTR_TO_BTF_ID_OR_NULL,
.arg1_type = ARG_PTR_TO_BTF_ID,
- .check_btf_id = check_arg_btf_id,
+ .arg1_btf_id = &btf_sock_ids[BTF_SOCK_TYPE_SOCK_COMMON],
.ret_btf_id = &btf_sock_ids[BTF_SOCK_TYPE_TCP_REQ],
};
@@ -10023,6 +10010,6 @@ const struct bpf_func_proto bpf_skc_to_udp6_sock_proto = {
.gpl_only = false,
.ret_type = RET_PTR_TO_BTF_ID_OR_NULL,
.arg1_type = ARG_PTR_TO_BTF_ID,
- .check_btf_id = check_arg_btf_id,
+ .arg1_btf_id = &btf_sock_ids[BTF_SOCK_TYPE_SOCK_COMMON],
.ret_btf_id = &btf_sock_ids[BTF_SOCK_TYPE_UDP6],
};
diff --git a/net/ipv4/bpf_tcp_ca.c b/net/ipv4/bpf_tcp_ca.c
index e3939f76b024..74a2ef598c31 100644
--- a/net/ipv4/bpf_tcp_ca.c
+++ b/net/ipv4/bpf_tcp_ca.c
@@ -28,23 +28,18 @@ static u32 unsupported_ops[] = {
static const struct btf_type *tcp_sock_type;
static u32 tcp_sock_id, sock_id;
-static int btf_sk_storage_get_ids[5];
static struct bpf_func_proto btf_sk_storage_get_proto __read_mostly;
-
-static int btf_sk_storage_delete_ids[5];
static struct bpf_func_proto btf_sk_storage_delete_proto __read_mostly;
-static void convert_sk_func_proto(struct bpf_func_proto *to, int *to_btf_ids,
- const struct bpf_func_proto *from)
+static void convert_sk_func_proto(struct bpf_func_proto *to, const struct bpf_func_proto *from)
{
int i;
*to = *from;
- to->btf_id = to_btf_ids;
for (i = 0; i < ARRAY_SIZE(to->arg_type); i++) {
if (to->arg_type[i] == ARG_PTR_TO_SOCKET) {
to->arg_type[i] = ARG_PTR_TO_BTF_ID;
- to->btf_id[i] = tcp_sock_id;
+ to->arg_btf_id[i] = &tcp_sock_id;
}
}
}
@@ -64,12 +59,8 @@ static int bpf_tcp_ca_init(struct btf *btf)
tcp_sock_id = type_id;
tcp_sock_type = btf_type_by_id(btf, tcp_sock_id);
- convert_sk_func_proto(&btf_sk_storage_get_proto,
- btf_sk_storage_get_ids,
- &bpf_sk_storage_get_proto);
- convert_sk_func_proto(&btf_sk_storage_delete_proto,
- btf_sk_storage_delete_ids,
- &bpf_sk_storage_delete_proto);
+ convert_sk_func_proto(&btf_sk_storage_get_proto, &bpf_sk_storage_get_proto);
+ convert_sk_func_proto(&btf_sk_storage_delete_proto, &bpf_sk_storage_delete_proto);
return 0;
}
@@ -185,8 +176,8 @@ static const struct bpf_func_proto bpf_tcp_send_ack_proto = {
/* In case we want to report error later */
.ret_type = RET_INTEGER,
.arg1_type = ARG_PTR_TO_BTF_ID,
+ .arg1_btf_id = &tcp_sock_id,
.arg2_type = ARG_ANYTHING,
- .btf_id = &tcp_sock_id,
};
static const struct bpf_func_proto *
--
2.25.1
^ permalink raw reply related [flat|nested] 24+ messages in thread* Re: [PATCH bpf-next v2 04/11] bpf: allow specifying a BTF ID per argument in function protos
2020-09-09 17:11 ` [PATCH bpf-next v2 04/11] bpf: allow specifying a BTF ID per argument in function protos Lorenz Bauer
@ 2020-09-09 20:03 ` Martin KaFai Lau
2020-09-10 11:36 ` Lorenz Bauer
2020-09-10 18:51 ` Andrii Nakryiko
0 siblings, 2 replies; 24+ messages in thread
From: Martin KaFai Lau @ 2020-09-09 20:03 UTC (permalink / raw)
To: Lorenz Bauer; +Cc: ast, yhs, daniel, andriin, bpf, kernel-team
On Wed, Sep 09, 2020 at 06:11:48PM +0100, Lorenz Bauer wrote:
> Function prototypes using ARG_PTR_TO_BTF_ID currently use two ways to signal
> which BTF IDs are acceptable. First, bpf_func_proto.btf_id is an array of
> IDs, one for each argument. This array is only accessed up to the highest
> numbered argument that uses ARG_PTR_TO_BTF_ID and may therefore be less than
> five arguments long. It usually points at a BTF_ID_LIST. Second, check_btf_id
> is a function pointer that is called by the verifier if present. It gets the
> actual BTF ID of the register, and the argument number we're currently checking.
> It turns out that the only user check_arg_btf_id ignores the argument, and is
> simply used to check whether the BTF ID has a struct sock_common at it's start.
>
> Replace both of these mechanisms with an explicit BTF ID for each argument
> in a function proto. Thanks to btf_struct_ids_match this is very flexible:
> check_arg_btf_id can be replaced by requiring struct sock_common.
[ ... ]
> BPF_CALL_4(bpf_get_stack_pe, struct bpf_perf_event_data_kern *, ctx,
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index c997f81c500b..7182c6e3eada 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -238,7 +238,6 @@ struct bpf_call_arg_meta {
> u64 msize_max_value;
> int ref_obj_id;
> int func_id;
> - u32 btf_id;
> };
>
> struct btf *btf_vmlinux;
> @@ -4002,29 +4001,23 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
> goto err_type;
> }
> } else if (arg_type == ARG_PTR_TO_BTF_ID) {
> - bool ids_match = false;
> + const u32 *btf_id = fn->arg_btf_id[arg];
>
> expected_type = PTR_TO_BTF_ID;
> if (type != expected_type)
> goto err_type;
> - if (!fn->check_btf_id) {
> - if (reg->btf_id != meta->btf_id) {
> - ids_match = btf_struct_ids_match(&env->log, reg->off, reg->btf_id,
> - meta->btf_id);
> - if (!ids_match) {
> - verbose(env, "Helper has type %s got %s in R%d\n",
> - kernel_type_name(meta->btf_id),
> - kernel_type_name(reg->btf_id), regno);
> - return -EACCES;
> - }
> - }
> - } else if (!fn->check_btf_id(reg->btf_id, arg)) {
> - verbose(env, "Helper does not support %s in R%d\n",
> - kernel_type_name(reg->btf_id), regno);
>
> + if (!btf_id) {
> + verbose(env, "verifier internal error: missing BTF ID\n");
check_func_proto() could be a better place for this check.
> + return -EFAULT;
> + }
> +
> + if (!btf_struct_ids_match(&env->log, reg->off, reg->btf_id, *btf_id)) {
> + verbose(env, "R%d has incompatible type %s\n", regno,
> + kernel_type_name(reg->btf_id));
> return -EACCES;
> }
> - if ((reg->off && !ids_match) || !tnum_is_const(reg->var_off) || reg->var_off.value) {
> + if (!tnum_is_const(reg->var_off) || reg->var_off.value) {
Removing "(reg->off && !ids_match)" looks fine to me since it is
checked in btf_struct_ids_match(). Just want to highlight here
to get more attention.
> verbose(env, "R%d is a pointer to in-kernel struct with non-zero offset\n",
> regno);
> return -EACCES;
> @@ -4892,11 +4885,6 @@ static int check_helper_call(struct bpf_verifier_env *env, int func_id, int insn
> meta.func_id = func_id;
> /* check args */
> for (i = 0; i < 5; i++) {
> - if (!fn->check_btf_id) {
> - err = btf_resolve_helper_id(&env->log, fn, i);
> - if (err > 0)
> - meta.btf_id = err;
> - }
> err = check_func_arg(env, i, &meta, fn);
> if (err)
> return err;
[ ... ]
> diff --git a/net/core/bpf_sk_storage.c b/net/core/bpf_sk_storage.c
> index a0d1a3265b71..442a34a7ee2b 100644
> --- a/net/core/bpf_sk_storage.c
> +++ b/net/core/bpf_sk_storage.c
> @@ -357,6 +357,7 @@ const struct bpf_func_proto bpf_sk_storage_get_proto = {
> .ret_type = RET_PTR_TO_MAP_VALUE_OR_NULL,
> .arg1_type = ARG_CONST_MAP_PTR,
> .arg2_type = ARG_PTR_TO_SOCKET,
> + .arg2_btf_id = &btf_sock_ids[BTF_SOCK_TYPE_SOCK_COMMON],
This change is not needed. It is not taking ARG_PTR_TO_BTF_ID.
> .arg3_type = ARG_PTR_TO_MAP_VALUE_OR_NULL,
> .arg4_type = ARG_ANYTHING,
> };
> @@ -377,21 +378,18 @@ const struct bpf_func_proto bpf_sk_storage_delete_proto = {
> .ret_type = RET_INTEGER,
> .arg1_type = ARG_CONST_MAP_PTR,
> .arg2_type = ARG_PTR_TO_SOCKET,
> + .arg2_btf_id = &btf_sock_ids[BTF_SOCK_TYPE_SOCK_COMMON],
Same here.
> };
>
> -BTF_ID_LIST(sk_storage_btf_ids)
> -BTF_ID_UNUSED
> -BTF_ID(struct, sock)
> -
> const struct bpf_func_proto sk_storage_get_btf_proto = {
> .func = bpf_sk_storage_get,
> .gpl_only = false,
> .ret_type = RET_PTR_TO_MAP_VALUE_OR_NULL,
> .arg1_type = ARG_CONST_MAP_PTR,
> .arg2_type = ARG_PTR_TO_BTF_ID,
> + .arg2_btf_id = &btf_sock_ids[BTF_SOCK_TYPE_SOCK],
+1 in reusing btf_sock_ids.
Others lgtm.
^ permalink raw reply [flat|nested] 24+ messages in thread* Re: [PATCH bpf-next v2 04/11] bpf: allow specifying a BTF ID per argument in function protos
2020-09-09 20:03 ` Martin KaFai Lau
@ 2020-09-10 11:36 ` Lorenz Bauer
2020-09-10 18:51 ` Andrii Nakryiko
1 sibling, 0 replies; 24+ messages in thread
From: Lorenz Bauer @ 2020-09-10 11:36 UTC (permalink / raw)
To: Martin KaFai Lau
Cc: Alexei Starovoitov, Yonghong Song, Daniel Borkmann,
Andrii Nakryiko, bpf, kernel-team
On Wed, 9 Sep 2020 at 21:03, Martin KaFai Lau <kafai@fb.com> wrote:
>
[...]
> > @@ -4002,29 +4001,23 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
> > goto err_type;
> > }
> > } else if (arg_type == ARG_PTR_TO_BTF_ID) {
> > - bool ids_match = false;
> > + const u32 *btf_id = fn->arg_btf_id[arg];
> >
> > expected_type = PTR_TO_BTF_ID;
> > if (type != expected_type)
> > goto err_type;
> > - if (!fn->check_btf_id) {
> > - if (reg->btf_id != meta->btf_id) {
> > - ids_match = btf_struct_ids_match(&env->log, reg->off, reg->btf_id,
> > - meta->btf_id);
> > - if (!ids_match) {
> > - verbose(env, "Helper has type %s got %s in R%d\n",
> > - kernel_type_name(meta->btf_id),
> > - kernel_type_name(reg->btf_id), regno);
> > - return -EACCES;
> > - }
> > - }
> > - } else if (!fn->check_btf_id(reg->btf_id, arg)) {
> > - verbose(env, "Helper does not support %s in R%d\n",
> > - kernel_type_name(reg->btf_id), regno);
> >
> > + if (!btf_id) {
> > + verbose(env, "verifier internal error: missing BTF ID\n");
> check_func_proto() could be a better place for this check.
The wrinkle here is that this also protects from someone adding PTR_TO_BTF_ID to
compatible_reg_types without specifying a btf_id. I want to do that for
ARG_PTR_TO_SOCK_COMMON_OR_NULL in a follow up, so I think the test here makes
sense.
However, I think ensuring btf_id in check_func_proto in addition to
this is a good idea.
[...]
> > diff --git a/net/core/bpf_sk_storage.c b/net/core/bpf_sk_storage.c
> > index a0d1a3265b71..442a34a7ee2b 100644
> > --- a/net/core/bpf_sk_storage.c
> > +++ b/net/core/bpf_sk_storage.c
> > @@ -357,6 +357,7 @@ const struct bpf_func_proto bpf_sk_storage_get_proto = {
> > .ret_type = RET_PTR_TO_MAP_VALUE_OR_NULL,
> > .arg1_type = ARG_CONST_MAP_PTR,
> > .arg2_type = ARG_PTR_TO_SOCKET,
> > + .arg2_btf_id = &btf_sock_ids[BTF_SOCK_TYPE_SOCK_COMMON],
> This change is not needed. It is not taking ARG_PTR_TO_BTF_ID.
>
> > .arg3_type = ARG_PTR_TO_MAP_VALUE_OR_NULL,
> > .arg4_type = ARG_ANYTHING,
> > };
> > @@ -377,21 +378,18 @@ const struct bpf_func_proto bpf_sk_storage_delete_proto = {
> > .ret_type = RET_INTEGER,
> > .arg1_type = ARG_CONST_MAP_PTR,
> > .arg2_type = ARG_PTR_TO_SOCKET,
> > + .arg2_btf_id = &btf_sock_ids[BTF_SOCK_TYPE_SOCK_COMMON],
> Same here.
Don't know where these came from, sorry.
--
Lorenz Bauer | Systems Engineer
6th Floor, County Hall/The Riverside Building, SE1 7PB, UK
www.cloudflare.com
^ permalink raw reply [flat|nested] 24+ messages in thread* Re: [PATCH bpf-next v2 04/11] bpf: allow specifying a BTF ID per argument in function protos
2020-09-09 20:03 ` Martin KaFai Lau
2020-09-10 11:36 ` Lorenz Bauer
@ 2020-09-10 18:51 ` Andrii Nakryiko
1 sibling, 0 replies; 24+ messages in thread
From: Andrii Nakryiko @ 2020-09-10 18:51 UTC (permalink / raw)
To: Martin KaFai Lau
Cc: Lorenz Bauer, Alexei Starovoitov, Yonghong Song, Daniel Borkmann,
Andrii Nakryiko, bpf, kernel-team
On Wed, Sep 9, 2020 at 1:05 PM Martin KaFai Lau <kafai@fb.com> wrote:
>
> On Wed, Sep 09, 2020 at 06:11:48PM +0100, Lorenz Bauer wrote:
> > Function prototypes using ARG_PTR_TO_BTF_ID currently use two ways to signal
> > which BTF IDs are acceptable. First, bpf_func_proto.btf_id is an array of
> > IDs, one for each argument. This array is only accessed up to the highest
> > numbered argument that uses ARG_PTR_TO_BTF_ID and may therefore be less than
> > five arguments long. It usually points at a BTF_ID_LIST. Second, check_btf_id
> > is a function pointer that is called by the verifier if present. It gets the
> > actual BTF ID of the register, and the argument number we're currently checking.
> > It turns out that the only user check_arg_btf_id ignores the argument, and is
> > simply used to check whether the BTF ID has a struct sock_common at it's start.
> >
> > Replace both of these mechanisms with an explicit BTF ID for each argument
> > in a function proto. Thanks to btf_struct_ids_match this is very flexible:
> > check_arg_btf_id can be replaced by requiring struct sock_common.
>
> [ ... ]
>
> > BPF_CALL_4(bpf_get_stack_pe, struct bpf_perf_event_data_kern *, ctx,
> > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> > index c997f81c500b..7182c6e3eada 100644
> > --- a/kernel/bpf/verifier.c
> > +++ b/kernel/bpf/verifier.c
> > @@ -238,7 +238,6 @@ struct bpf_call_arg_meta {
> > u64 msize_max_value;
> > int ref_obj_id;
> > int func_id;
> > - u32 btf_id;
> > };
> >
> > struct btf *btf_vmlinux;
> > @@ -4002,29 +4001,23 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
> > goto err_type;
> > }
> > } else if (arg_type == ARG_PTR_TO_BTF_ID) {
> > - bool ids_match = false;
> > + const u32 *btf_id = fn->arg_btf_id[arg];
> >
> > expected_type = PTR_TO_BTF_ID;
> > if (type != expected_type)
> > goto err_type;
> > - if (!fn->check_btf_id) {
> > - if (reg->btf_id != meta->btf_id) {
> > - ids_match = btf_struct_ids_match(&env->log, reg->off, reg->btf_id,
> > - meta->btf_id);
> > - if (!ids_match) {
> > - verbose(env, "Helper has type %s got %s in R%d\n",
> > - kernel_type_name(meta->btf_id),
> > - kernel_type_name(reg->btf_id), regno);
> > - return -EACCES;
> > - }
> > - }
> > - } else if (!fn->check_btf_id(reg->btf_id, arg)) {
> > - verbose(env, "Helper does not support %s in R%d\n",
> > - kernel_type_name(reg->btf_id), regno);
> >
> > + if (!btf_id) {
> > + verbose(env, "verifier internal error: missing BTF ID\n");
> check_func_proto() could be a better place for this check.
>
> > + return -EFAULT;
> > + }
> > +
> > + if (!btf_struct_ids_match(&env->log, reg->off, reg->btf_id, *btf_id)) {
> > + verbose(env, "R%d has incompatible type %s\n", regno,
> > + kernel_type_name(reg->btf_id));
> > return -EACCES;
> > }
> > - if ((reg->off && !ids_match) || !tnum_is_const(reg->var_off) || reg->var_off.value) {
> > + if (!tnum_is_const(reg->var_off) || reg->var_off.value) {
> Removing "(reg->off && !ids_match)" looks fine to me since it is
> checked in btf_struct_ids_match(). Just want to highlight here
> to get more attention.
Yeah, I looked at this previously and this seems correct. Now
btf_struct_ids_match() is called unconditionally, so reg->var_off != 0
that doesn't match the desired BTF ID will cause failure above.
>
>
> > verbose(env, "R%d is a pointer to in-kernel struct with non-zero offset\n",
> > regno);
> > return -EACCES;
> > @@ -4892,11 +4885,6 @@ static int check_helper_call(struct bpf_verifier_env *env, int func_id, int insn
> > meta.func_id = func_id;
> > /* check args */
> > for (i = 0; i < 5; i++) {
> > - if (!fn->check_btf_id) {
> > - err = btf_resolve_helper_id(&env->log, fn, i);
> > - if (err > 0)
> > - meta.btf_id = err;
> > - }
> > err = check_func_arg(env, i, &meta, fn);
> > if (err)
> > return err;
>
> [ ... ]
>
> > diff --git a/net/core/bpf_sk_storage.c b/net/core/bpf_sk_storage.c
> > index a0d1a3265b71..442a34a7ee2b 100644
> > --- a/net/core/bpf_sk_storage.c
> > +++ b/net/core/bpf_sk_storage.c
> > @@ -357,6 +357,7 @@ const struct bpf_func_proto bpf_sk_storage_get_proto = {
> > .ret_type = RET_PTR_TO_MAP_VALUE_OR_NULL,
> > .arg1_type = ARG_CONST_MAP_PTR,
> > .arg2_type = ARG_PTR_TO_SOCKET,
> > + .arg2_btf_id = &btf_sock_ids[BTF_SOCK_TYPE_SOCK_COMMON],
> This change is not needed. It is not taking ARG_PTR_TO_BTF_ID.
>
> > .arg3_type = ARG_PTR_TO_MAP_VALUE_OR_NULL,
> > .arg4_type = ARG_ANYTHING,
> > };
> > @@ -377,21 +378,18 @@ const struct bpf_func_proto bpf_sk_storage_delete_proto = {
> > .ret_type = RET_INTEGER,
> > .arg1_type = ARG_CONST_MAP_PTR,
> > .arg2_type = ARG_PTR_TO_SOCKET,
> > + .arg2_btf_id = &btf_sock_ids[BTF_SOCK_TYPE_SOCK_COMMON],
> Same here.
>
> > };
> >
> > -BTF_ID_LIST(sk_storage_btf_ids)
> > -BTF_ID_UNUSED
> > -BTF_ID(struct, sock)
> > -
> > const struct bpf_func_proto sk_storage_get_btf_proto = {
> > .func = bpf_sk_storage_get,
> > .gpl_only = false,
> > .ret_type = RET_PTR_TO_MAP_VALUE_OR_NULL,
> > .arg1_type = ARG_CONST_MAP_PTR,
> > .arg2_type = ARG_PTR_TO_BTF_ID,
> > + .arg2_btf_id = &btf_sock_ids[BTF_SOCK_TYPE_SOCK],
> +1 in reusing btf_sock_ids.
>
> Others lgtm.
^ permalink raw reply [flat|nested] 24+ messages in thread
* [PATCH bpf-next v2 05/11] bpf: make BTF pointer type checking generic
2020-09-09 17:11 [PATCH bpf-next v2 00/11] Make check_func_arg type checks table driven Lorenz Bauer
` (3 preceding siblings ...)
2020-09-09 17:11 ` [PATCH bpf-next v2 04/11] bpf: allow specifying a BTF ID per argument in function protos Lorenz Bauer
@ 2020-09-09 17:11 ` Lorenz Bauer
2020-09-09 20:15 ` Martin KaFai Lau
2020-09-09 17:11 ` [PATCH bpf-next v2 06/11] bpf: make reference tracking generic Lorenz Bauer
` (5 subsequent siblings)
10 siblings, 1 reply; 24+ messages in thread
From: Lorenz Bauer @ 2020-09-09 17:11 UTC (permalink / raw)
To: ast, yhs, daniel, kafai, andriin; +Cc: bpf, kernel-team, Lorenz Bauer
Perform BTF type checks if the register we're working on contains a BTF
pointer, rather than if the argument is for a BTF pointer. This is easier
to understand, and allows removing the code from the arg_type checking
section of the function.
Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
---
kernel/bpf/verifier.c | 38 ++++++++++++++++++++------------------
1 file changed, 20 insertions(+), 18 deletions(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 7182c6e3eada..b949e0afef8a 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -4001,27 +4001,9 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
goto err_type;
}
} else if (arg_type == ARG_PTR_TO_BTF_ID) {
- const u32 *btf_id = fn->arg_btf_id[arg];
-
expected_type = PTR_TO_BTF_ID;
if (type != expected_type)
goto err_type;
-
- if (!btf_id) {
- verbose(env, "verifier internal error: missing BTF ID\n");
- return -EFAULT;
- }
-
- if (!btf_struct_ids_match(&env->log, reg->off, reg->btf_id, *btf_id)) {
- verbose(env, "R%d has incompatible type %s\n", regno,
- kernel_type_name(reg->btf_id));
- return -EACCES;
- }
- if (!tnum_is_const(reg->var_off) || reg->var_off.value) {
- verbose(env, "R%d is a pointer to in-kernel struct with non-zero offset\n",
- regno);
- return -EACCES;
- }
} else if (arg_type == ARG_PTR_TO_SPIN_LOCK) {
if (meta->func_id == BPF_FUNC_spin_lock) {
if (process_spin_lock(env, regno, true))
@@ -4076,6 +4058,26 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
return -EFAULT;
}
+ if (type == PTR_TO_BTF_ID) {
+ const u32 *btf_id = fn->arg_btf_id[arg];
+
+ if (!btf_id) {
+ verbose(env, "verifier internal error: missing BTF ID\n");
+ return -EFAULT;
+ }
+
+ if (!btf_struct_ids_match(&env->log, reg->off, reg->btf_id, *btf_id)) {
+ verbose(env, "R%d has incompatible type %s\n", regno,
+ kernel_type_name(reg->btf_id));
+ return -EACCES;
+ }
+ if (!tnum_is_const(reg->var_off) || reg->var_off.value) {
+ verbose(env, "R%d is a pointer to in-kernel struct with non-zero offset\n",
+ regno);
+ return -EACCES;
+ }
+ }
+
if (arg_type == ARG_CONST_MAP_PTR) {
/* bpf_map_xxx(map_ptr) call: remember that map_ptr */
meta->map_ptr = reg->map_ptr;
--
2.25.1
^ permalink raw reply related [flat|nested] 24+ messages in thread* Re: [PATCH bpf-next v2 05/11] bpf: make BTF pointer type checking generic
2020-09-09 17:11 ` [PATCH bpf-next v2 05/11] bpf: make BTF pointer type checking generic Lorenz Bauer
@ 2020-09-09 20:15 ` Martin KaFai Lau
0 siblings, 0 replies; 24+ messages in thread
From: Martin KaFai Lau @ 2020-09-09 20:15 UTC (permalink / raw)
To: Lorenz Bauer; +Cc: ast, yhs, daniel, andriin, bpf, kernel-team
On Wed, Sep 09, 2020 at 06:11:49PM +0100, Lorenz Bauer wrote:
> Perform BTF type checks if the register we're working on contains a BTF
> pointer, rather than if the argument is for a BTF pointer. This is easier
> to understand, and allows removing the code from the arg_type checking
> section of the function.
Acked-by: Martin KaFai Lau <kafai@fb.com>
^ permalink raw reply [flat|nested] 24+ messages in thread
* [PATCH bpf-next v2 06/11] bpf: make reference tracking generic
2020-09-09 17:11 [PATCH bpf-next v2 00/11] Make check_func_arg type checks table driven Lorenz Bauer
` (4 preceding siblings ...)
2020-09-09 17:11 ` [PATCH bpf-next v2 05/11] bpf: make BTF pointer type checking generic Lorenz Bauer
@ 2020-09-09 17:11 ` Lorenz Bauer
2020-09-09 20:21 ` Martin KaFai Lau
2020-09-09 17:11 ` [PATCH bpf-next v2 07/11] bpf: make context access check generic Lorenz Bauer
` (4 subsequent siblings)
10 siblings, 1 reply; 24+ messages in thread
From: Lorenz Bauer @ 2020-09-09 17:11 UTC (permalink / raw)
To: ast, yhs, daniel, kafai, andriin; +Cc: bpf, kernel-team, Lorenz Bauer
Instead of dealing with reg->ref_obj_id individually for every arg type that
needs it, rely on the fact that ref_obj_id is zero if the register is not
reference tracked.
Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
Acked-by: Andrii Nakryiko <andriin@fb.com>
---
kernel/bpf/verifier.c | 26 ++++++++++----------------
1 file changed, 10 insertions(+), 16 deletions(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index b949e0afef8a..43df3bae93aa 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -3983,15 +3983,6 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
/* Any sk pointer can be ARG_PTR_TO_SOCK_COMMON */
if (!type_is_sk_pointer(type))
goto err_type;
- if (reg->ref_obj_id) {
- if (meta->ref_obj_id) {
- verbose(env, "verifier internal error: more than one arg with ref_obj_id R%d %u %u\n",
- regno, reg->ref_obj_id,
- meta->ref_obj_id);
- return -EFAULT;
- }
- meta->ref_obj_id = reg->ref_obj_id;
- }
} else if (arg_type == ARG_PTR_TO_SOCKET ||
arg_type == ARG_PTR_TO_SOCKET_OR_NULL) {
expected_type = PTR_TO_SOCKET;
@@ -4040,13 +4031,6 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
/* final test in check_stack_boundary() */;
else if (type != expected_type)
goto err_type;
- if (meta->ref_obj_id) {
- verbose(env, "verifier internal error: more than one arg with ref_obj_id R%d %u %u\n",
- regno, reg->ref_obj_id,
- meta->ref_obj_id);
- return -EFAULT;
- }
- meta->ref_obj_id = reg->ref_obj_id;
} else if (arg_type_is_int_ptr(arg_type)) {
expected_type = PTR_TO_STACK;
if (!type_is_pkt_pointer(type) &&
@@ -4078,6 +4062,16 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
}
}
+ if (reg->ref_obj_id) {
+ if (meta->ref_obj_id) {
+ verbose(env, "verifier internal error: more than one arg with ref_obj_id R%d %u %u\n",
+ regno, reg->ref_obj_id,
+ meta->ref_obj_id);
+ return -EFAULT;
+ }
+ meta->ref_obj_id = reg->ref_obj_id;
+ }
+
if (arg_type == ARG_CONST_MAP_PTR) {
/* bpf_map_xxx(map_ptr) call: remember that map_ptr */
meta->map_ptr = reg->map_ptr;
--
2.25.1
^ permalink raw reply related [flat|nested] 24+ messages in thread* Re: [PATCH bpf-next v2 06/11] bpf: make reference tracking generic
2020-09-09 17:11 ` [PATCH bpf-next v2 06/11] bpf: make reference tracking generic Lorenz Bauer
@ 2020-09-09 20:21 ` Martin KaFai Lau
0 siblings, 0 replies; 24+ messages in thread
From: Martin KaFai Lau @ 2020-09-09 20:21 UTC (permalink / raw)
To: Lorenz Bauer; +Cc: ast, yhs, daniel, andriin, bpf, kernel-team
On Wed, Sep 09, 2020 at 06:11:50PM +0100, Lorenz Bauer wrote:
> Instead of dealing with reg->ref_obj_id individually for every arg type that
> needs it, rely on the fact that ref_obj_id is zero if the register is not
> reference tracked.
Acked-by: Martin KaFai Lau <kafai@fb.com>
^ permalink raw reply [flat|nested] 24+ messages in thread
* [PATCH bpf-next v2 07/11] bpf: make context access check generic
2020-09-09 17:11 [PATCH bpf-next v2 00/11] Make check_func_arg type checks table driven Lorenz Bauer
` (5 preceding siblings ...)
2020-09-09 17:11 ` [PATCH bpf-next v2 06/11] bpf: make reference tracking generic Lorenz Bauer
@ 2020-09-09 17:11 ` Lorenz Bauer
2020-09-09 20:42 ` Martin KaFai Lau
2020-09-09 17:11 ` [PATCH bpf-next v2 08/11] bpf: set meta->raw_mode for pointers close to use Lorenz Bauer
` (3 subsequent siblings)
10 siblings, 1 reply; 24+ messages in thread
From: Lorenz Bauer @ 2020-09-09 17:11 UTC (permalink / raw)
To: ast, yhs, daniel, kafai, andriin; +Cc: bpf, kernel-team, Lorenz Bauer
Always check context access if the register we're operating on is
PTR_TO_CTX, rather than relying on ARG_PTR_TO_CTX. This allows
simplifying the arg_type checking section of the function.
Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
---
kernel/bpf/verifier.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 43df3bae93aa..41643e179e14 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -3974,9 +3974,6 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
arg_type == ARG_PTR_TO_CTX_OR_NULL)) {
if (type != expected_type)
goto err_type;
- err = check_ctx_reg(env, reg, regno);
- if (err < 0)
- return err;
}
} else if (arg_type == ARG_PTR_TO_SOCK_COMMON) {
expected_type = PTR_TO_SOCK_COMMON;
@@ -4060,6 +4057,10 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
regno);
return -EACCES;
}
+ } else if (type == PTR_TO_CTX) {
+ err = check_ctx_reg(env, reg, regno);
+ if (err < 0)
+ return err;
}
if (reg->ref_obj_id) {
--
2.25.1
^ permalink raw reply related [flat|nested] 24+ messages in thread* Re: [PATCH bpf-next v2 07/11] bpf: make context access check generic
2020-09-09 17:11 ` [PATCH bpf-next v2 07/11] bpf: make context access check generic Lorenz Bauer
@ 2020-09-09 20:42 ` Martin KaFai Lau
0 siblings, 0 replies; 24+ messages in thread
From: Martin KaFai Lau @ 2020-09-09 20:42 UTC (permalink / raw)
To: Lorenz Bauer; +Cc: ast, yhs, daniel, andriin, bpf, kernel-team
On Wed, Sep 09, 2020 at 06:11:51PM +0100, Lorenz Bauer wrote:
> Always check context access if the register we're operating on is
> PTR_TO_CTX, rather than relying on ARG_PTR_TO_CTX. This allows
> simplifying the arg_type checking section of the function.
Acked-by: Martin KaFai Lau <kafai@fb.com>
^ permalink raw reply [flat|nested] 24+ messages in thread
* [PATCH bpf-next v2 08/11] bpf: set meta->raw_mode for pointers close to use
2020-09-09 17:11 [PATCH bpf-next v2 00/11] Make check_func_arg type checks table driven Lorenz Bauer
` (6 preceding siblings ...)
2020-09-09 17:11 ` [PATCH bpf-next v2 07/11] bpf: make context access check generic Lorenz Bauer
@ 2020-09-09 17:11 ` Lorenz Bauer
2020-09-09 21:04 ` Martin KaFai Lau
2020-09-09 17:11 ` [PATCH bpf-next v2 09/11] bpf: check ARG_PTR_TO_SPINLOCK register type in check_func_arg Lorenz Bauer
` (2 subsequent siblings)
10 siblings, 1 reply; 24+ messages in thread
From: Lorenz Bauer @ 2020-09-09 17:11 UTC (permalink / raw)
To: ast, yhs, daniel, kafai, andriin; +Cc: bpf, kernel-team, Lorenz Bauer
If we encounter a pointer to memory, we set meta->raw_mode depending
on the type of memory we point at. What isn't obvious is that this
information is only used when the next memory size argument is
encountered.
Move the assignment closer to where it's used, and add a comment that
explains what is going on.
Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
---
kernel/bpf/verifier.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 41643e179e14..e0ab3b8c489d 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -4020,7 +4020,6 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
type != PTR_TO_RDWR_BUF &&
type != expected_type)
goto err_type;
- meta->raw_mode = arg_type == ARG_PTR_TO_UNINIT_MEM;
} else if (arg_type_is_alloc_mem_ptr(arg_type)) {
expected_type = PTR_TO_MEM;
if (register_is_null(reg) &&
@@ -4109,6 +4108,11 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
err = check_helper_mem_access(env, regno,
meta->map_ptr->value_size, false,
meta);
+ } else if (arg_type_is_mem_ptr(arg_type)) {
+ /* The access to this pointer is only checked when we hit the
+ * next is_mem_size argument below.
+ */
+ meta->raw_mode = (arg_type == ARG_PTR_TO_UNINIT_MEM);
} else if (arg_type_is_mem_size(arg_type)) {
bool zero_size_allowed = (arg_type == ARG_CONST_SIZE_OR_ZERO);
--
2.25.1
^ permalink raw reply related [flat|nested] 24+ messages in thread* Re: [PATCH bpf-next v2 08/11] bpf: set meta->raw_mode for pointers close to use
2020-09-09 17:11 ` [PATCH bpf-next v2 08/11] bpf: set meta->raw_mode for pointers close to use Lorenz Bauer
@ 2020-09-09 21:04 ` Martin KaFai Lau
0 siblings, 0 replies; 24+ messages in thread
From: Martin KaFai Lau @ 2020-09-09 21:04 UTC (permalink / raw)
To: Lorenz Bauer; +Cc: ast, yhs, daniel, andriin, bpf, kernel-team
On Wed, Sep 09, 2020 at 06:11:52PM +0100, Lorenz Bauer wrote:
> If we encounter a pointer to memory, we set meta->raw_mode depending
> on the type of memory we point at. What isn't obvious is that this
> information is only used when the next memory size argument is
> encountered.
>
> Move the assignment closer to where it's used, and add a comment that
> explains what is going on.
Acked-by: Martin KaFai Lau <kafai@fb.com>
^ permalink raw reply [flat|nested] 24+ messages in thread
* [PATCH bpf-next v2 09/11] bpf: check ARG_PTR_TO_SPINLOCK register type in check_func_arg
2020-09-09 17:11 [PATCH bpf-next v2 00/11] Make check_func_arg type checks table driven Lorenz Bauer
` (7 preceding siblings ...)
2020-09-09 17:11 ` [PATCH bpf-next v2 08/11] bpf: set meta->raw_mode for pointers close to use Lorenz Bauer
@ 2020-09-09 17:11 ` Lorenz Bauer
2020-09-09 21:14 ` Martin KaFai Lau
2020-09-09 17:11 ` [PATCH bpf-next v2 10/11] bpf: hoist type checking for nullable arg types Lorenz Bauer
2020-09-09 17:11 ` [PATCH bpf-next v2 11/11] bpf: use a table to drive helper arg type checks Lorenz Bauer
10 siblings, 1 reply; 24+ messages in thread
From: Lorenz Bauer @ 2020-09-09 17:11 UTC (permalink / raw)
To: ast, yhs, daniel, kafai, andriin; +Cc: bpf, kernel-team, Lorenz Bauer
Move the check for PTR_TO_MAP_VALUE to check_func_arg, where all other
checking is done as well. Move the invocation of process_spin_lock away
from the register type checking, to allow a future refactoring.
Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
---
kernel/bpf/verifier.c | 28 ++++++++++++++--------------
1 file changed, 14 insertions(+), 14 deletions(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index e0ab3b8c489d..42f68ffa2b52 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -3781,10 +3781,6 @@ static int process_spin_lock(struct bpf_verifier_env *env, int regno,
struct bpf_map *map = reg->map_ptr;
u64 val = reg->var_off.value;
- if (reg->type != PTR_TO_MAP_VALUE) {
- verbose(env, "R%d is not a pointer to map_value\n", regno);
- return -EINVAL;
- }
if (!is_const) {
verbose(env,
"R%d doesn't have constant offset. bpf_spin_lock has to be at the constant offset\n",
@@ -3993,16 +3989,9 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
if (type != expected_type)
goto err_type;
} else if (arg_type == ARG_PTR_TO_SPIN_LOCK) {
- if (meta->func_id == BPF_FUNC_spin_lock) {
- if (process_spin_lock(env, regno, true))
- return -EACCES;
- } else if (meta->func_id == BPF_FUNC_spin_unlock) {
- if (process_spin_lock(env, regno, false))
- return -EACCES;
- } else {
- verbose(env, "verifier internal error\n");
- return -EFAULT;
- }
+ expected_type = PTR_TO_MAP_VALUE;
+ if (type != expected_type)
+ goto err_type;
} else if (arg_type_is_mem_ptr(arg_type)) {
expected_type = PTR_TO_STACK;
/* One exception here. In case function allows for NULL to be
@@ -4108,6 +4097,17 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
err = check_helper_mem_access(env, regno,
meta->map_ptr->value_size, false,
meta);
+ } else if (arg_type == ARG_PTR_TO_SPIN_LOCK) {
+ if (meta->func_id == BPF_FUNC_spin_lock) {
+ if (process_spin_lock(env, regno, true))
+ return -EACCES;
+ } else if (meta->func_id == BPF_FUNC_spin_unlock) {
+ if (process_spin_lock(env, regno, false))
+ return -EACCES;
+ } else {
+ verbose(env, "verifier internal error\n");
+ return -EFAULT;
+ }
} else if (arg_type_is_mem_ptr(arg_type)) {
/* The access to this pointer is only checked when we hit the
* next is_mem_size argument below.
--
2.25.1
^ permalink raw reply related [flat|nested] 24+ messages in thread* Re: [PATCH bpf-next v2 09/11] bpf: check ARG_PTR_TO_SPINLOCK register type in check_func_arg
2020-09-09 17:11 ` [PATCH bpf-next v2 09/11] bpf: check ARG_PTR_TO_SPINLOCK register type in check_func_arg Lorenz Bauer
@ 2020-09-09 21:14 ` Martin KaFai Lau
0 siblings, 0 replies; 24+ messages in thread
From: Martin KaFai Lau @ 2020-09-09 21:14 UTC (permalink / raw)
To: Lorenz Bauer; +Cc: ast, yhs, daniel, andriin, bpf, kernel-team
On Wed, Sep 09, 2020 at 06:11:53PM +0100, Lorenz Bauer wrote:
> Move the check for PTR_TO_MAP_VALUE to check_func_arg, where all other
> checking is done as well. Move the invocation of process_spin_lock away
> from the register type checking, to allow a future refactoring.
Acked-by: Martin KaFai Lau <kafai@fb.com>
^ permalink raw reply [flat|nested] 24+ messages in thread
* [PATCH bpf-next v2 10/11] bpf: hoist type checking for nullable arg types
2020-09-09 17:11 [PATCH bpf-next v2 00/11] Make check_func_arg type checks table driven Lorenz Bauer
` (8 preceding siblings ...)
2020-09-09 17:11 ` [PATCH bpf-next v2 09/11] bpf: check ARG_PTR_TO_SPINLOCK register type in check_func_arg Lorenz Bauer
@ 2020-09-09 17:11 ` Lorenz Bauer
2020-09-09 21:28 ` Martin KaFai Lau
2020-09-09 17:11 ` [PATCH bpf-next v2 11/11] bpf: use a table to drive helper arg type checks Lorenz Bauer
10 siblings, 1 reply; 24+ messages in thread
From: Lorenz Bauer @ 2020-09-09 17:11 UTC (permalink / raw)
To: ast, yhs, daniel, kafai, andriin; +Cc: bpf, kernel-team, Lorenz Bauer
check_func_arg has a plethora of weird if statements with empty branches.
They work around the fact that *_OR_NULL argument types should accept a
SCALAR_VALUE register, as long as it's value is 0. These statements make
it difficult to reason about the type checking logic.
Instead, skip more detailed type checking logic iff the register is 0,
and the function expects a nullable type. This allows simplifying the type
checking itself.
Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
Acked-by: Andrii Nakryiko <andriin@fb.com>
---
kernel/bpf/verifier.c | 64 ++++++++++++++++++++-----------------------
1 file changed, 30 insertions(+), 34 deletions(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 42f68ffa2b52..ebf900fceaf0 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -435,6 +435,15 @@ static bool arg_type_may_be_refcounted(enum bpf_arg_type type)
return type == ARG_PTR_TO_SOCK_COMMON;
}
+static bool arg_type_may_be_null(enum bpf_arg_type type)
+{
+ return type == ARG_PTR_TO_MAP_VALUE_OR_NULL ||
+ type == ARG_PTR_TO_MEM_OR_NULL ||
+ type == ARG_PTR_TO_CTX_OR_NULL ||
+ type == ARG_PTR_TO_SOCKET_OR_NULL ||
+ type == ARG_PTR_TO_ALLOC_MEM_OR_NULL;
+}
+
/* Determine whether the function releases some resources allocated by another
* function call. The first reference type argument will be assumed to be
* released by release_reference().
@@ -3941,17 +3950,20 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
return err;
}
+ if (register_is_null(reg) && arg_type_may_be_null(arg_type))
+ /* A NULL register has a SCALAR_VALUE type, so skip
+ * type checking.
+ */
+ goto skip_type_check;
+
if (arg_type == ARG_PTR_TO_MAP_KEY ||
arg_type == ARG_PTR_TO_MAP_VALUE ||
arg_type == ARG_PTR_TO_UNINIT_MAP_VALUE ||
arg_type == ARG_PTR_TO_MAP_VALUE_OR_NULL) {
expected_type = PTR_TO_STACK;
- if (register_is_null(reg) &&
- arg_type == ARG_PTR_TO_MAP_VALUE_OR_NULL)
- /* final test in check_stack_boundary() */;
- else if (!type_is_pkt_pointer(type) &&
- type != PTR_TO_MAP_VALUE &&
- type != expected_type)
+ if (!type_is_pkt_pointer(type) &&
+ type != PTR_TO_MAP_VALUE &&
+ type != expected_type)
goto err_type;
} else if (arg_type == ARG_CONST_SIZE ||
arg_type == ARG_CONST_SIZE_OR_ZERO ||
@@ -3966,11 +3978,8 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
} else if (arg_type == ARG_PTR_TO_CTX ||
arg_type == ARG_PTR_TO_CTX_OR_NULL) {
expected_type = PTR_TO_CTX;
- if (!(register_is_null(reg) &&
- arg_type == ARG_PTR_TO_CTX_OR_NULL)) {
- if (type != expected_type)
- goto err_type;
- }
+ if (type != expected_type)
+ goto err_type;
} else if (arg_type == ARG_PTR_TO_SOCK_COMMON) {
expected_type = PTR_TO_SOCK_COMMON;
/* Any sk pointer can be ARG_PTR_TO_SOCK_COMMON */
@@ -3979,11 +3988,8 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
} else if (arg_type == ARG_PTR_TO_SOCKET ||
arg_type == ARG_PTR_TO_SOCKET_OR_NULL) {
expected_type = PTR_TO_SOCKET;
- if (!(register_is_null(reg) &&
- arg_type == ARG_PTR_TO_SOCKET_OR_NULL)) {
- if (type != expected_type)
- goto err_type;
- }
+ if (type != expected_type)
+ goto err_type;
} else if (arg_type == ARG_PTR_TO_BTF_ID) {
expected_type = PTR_TO_BTF_ID;
if (type != expected_type)
@@ -3994,27 +4000,16 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
goto err_type;
} else if (arg_type_is_mem_ptr(arg_type)) {
expected_type = PTR_TO_STACK;
- /* One exception here. In case function allows for NULL to be
- * passed in as argument, it's a SCALAR_VALUE type. Final test
- * happens during stack boundary checking.
- */
- if (register_is_null(reg) &&
- (arg_type == ARG_PTR_TO_MEM_OR_NULL ||
- arg_type == ARG_PTR_TO_ALLOC_MEM_OR_NULL))
- /* final test in check_stack_boundary() */;
- else if (!type_is_pkt_pointer(type) &&
- type != PTR_TO_MAP_VALUE &&
- type != PTR_TO_MEM &&
- type != PTR_TO_RDONLY_BUF &&
- type != PTR_TO_RDWR_BUF &&
- type != expected_type)
+ if (!type_is_pkt_pointer(type) &&
+ type != PTR_TO_MAP_VALUE &&
+ type != PTR_TO_MEM &&
+ type != PTR_TO_RDONLY_BUF &&
+ type != PTR_TO_RDWR_BUF &&
+ type != expected_type)
goto err_type;
} else if (arg_type_is_alloc_mem_ptr(arg_type)) {
expected_type = PTR_TO_MEM;
- if (register_is_null(reg) &&
- arg_type == ARG_PTR_TO_ALLOC_MEM_OR_NULL)
- /* final test in check_stack_boundary() */;
- else if (type != expected_type)
+ if (type != expected_type)
goto err_type;
} else if (arg_type_is_int_ptr(arg_type)) {
expected_type = PTR_TO_STACK;
@@ -4051,6 +4046,7 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
return err;
}
+skip_type_check:
if (reg->ref_obj_id) {
if (meta->ref_obj_id) {
verbose(env, "verifier internal error: more than one arg with ref_obj_id R%d %u %u\n",
--
2.25.1
^ permalink raw reply related [flat|nested] 24+ messages in thread* Re: [PATCH bpf-next v2 10/11] bpf: hoist type checking for nullable arg types
2020-09-09 17:11 ` [PATCH bpf-next v2 10/11] bpf: hoist type checking for nullable arg types Lorenz Bauer
@ 2020-09-09 21:28 ` Martin KaFai Lau
0 siblings, 0 replies; 24+ messages in thread
From: Martin KaFai Lau @ 2020-09-09 21:28 UTC (permalink / raw)
To: Lorenz Bauer; +Cc: ast, yhs, daniel, andriin, bpf, kernel-team
On Wed, Sep 09, 2020 at 06:11:54PM +0100, Lorenz Bauer wrote:
> check_func_arg has a plethora of weird if statements with empty branches.
> They work around the fact that *_OR_NULL argument types should accept a
> SCALAR_VALUE register, as long as it's value is 0. These statements make
> it difficult to reason about the type checking logic.
>
> Instead, skip more detailed type checking logic iff the register is 0,
> and the function expects a nullable type. This allows simplifying the type
> checking itself.
Acked-by: Martin KaFai Lau <kafai@fb.com>
^ permalink raw reply [flat|nested] 24+ messages in thread
* [PATCH bpf-next v2 11/11] bpf: use a table to drive helper arg type checks
2020-09-09 17:11 [PATCH bpf-next v2 00/11] Make check_func_arg type checks table driven Lorenz Bauer
` (9 preceding siblings ...)
2020-09-09 17:11 ` [PATCH bpf-next v2 10/11] bpf: hoist type checking for nullable arg types Lorenz Bauer
@ 2020-09-09 17:11 ` Lorenz Bauer
2020-09-09 22:22 ` Martin KaFai Lau
10 siblings, 1 reply; 24+ messages in thread
From: Lorenz Bauer @ 2020-09-09 17:11 UTC (permalink / raw)
To: ast, yhs, daniel, kafai, andriin; +Cc: bpf, kernel-team, Lorenz Bauer
The mapping between bpf_arg_type and bpf_reg_type is encoded in a big
hairy if statement that is hard to follow. The debug output also leaves
to be desired: if a reg_type doesn't match we only print one of the
options, instead printing all the valid ones.
Convert the if statement into a table which is then used to drive type
checking. If none of the reg_types match we print all options, e.g.:
R2 type=rdonly_buf expected=fp, pkt, pkt_meta, map_value
Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
---
include/linux/bpf.h | 1 +
kernel/bpf/verifier.c | 189 +++++++++++++++++++++++++-----------------
2 files changed, 116 insertions(+), 74 deletions(-)
diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index aabbc8bb52bd..7cf7e90f55bb 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -292,6 +292,7 @@ enum bpf_arg_type {
ARG_PTR_TO_ALLOC_MEM, /* pointer to dynamically allocated memory */
ARG_PTR_TO_ALLOC_MEM_OR_NULL, /* pointer to dynamically allocated memory or NULL */
ARG_CONST_ALLOC_SIZE_OR_ZERO, /* number of allocated bytes requested */
+ __BPF_ARG_TYPE_MAX,
};
/* type of values returned from helper functions */
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index ebf900fceaf0..9c9728c81d4c 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -3856,12 +3856,6 @@ static bool arg_type_is_mem_size(enum bpf_arg_type type)
type == ARG_CONST_SIZE_OR_ZERO;
}
-static bool arg_type_is_alloc_mem_ptr(enum bpf_arg_type type)
-{
- return type == ARG_PTR_TO_ALLOC_MEM ||
- type == ARG_PTR_TO_ALLOC_MEM_OR_NULL;
-}
-
static bool arg_type_is_alloc_size(enum bpf_arg_type type)
{
return type == ARG_CONST_ALLOC_SIZE_OR_ZERO;
@@ -3910,14 +3904,121 @@ static int resolve_map_arg_type(struct bpf_verifier_env *env,
return 0;
}
+struct bpf_reg_types {
+ const enum bpf_reg_type types[10];
+};
+
+static const struct bpf_reg_types map_key_value_types = {
+ .types = {
+ PTR_TO_STACK,
+ PTR_TO_PACKET,
+ PTR_TO_PACKET_META,
+ PTR_TO_MAP_VALUE,
+ },
+};
+
+static const struct bpf_reg_types sock_types = {
+ .types = {
+ PTR_TO_SOCK_COMMON,
+ PTR_TO_SOCKET,
+ PTR_TO_TCP_SOCK,
+ PTR_TO_XDP_SOCK,
+ },
+};
+
+static const struct bpf_reg_types mem_types = {
+ .types = {
+ PTR_TO_STACK,
+ PTR_TO_PACKET,
+ PTR_TO_PACKET_META,
+ PTR_TO_MAP_VALUE,
+ PTR_TO_MEM,
+ PTR_TO_RDONLY_BUF,
+ PTR_TO_RDWR_BUF,
+ },
+};
+
+static const struct bpf_reg_types int_ptr_types = {
+ .types = {
+ PTR_TO_STACK,
+ PTR_TO_PACKET,
+ PTR_TO_PACKET_META,
+ PTR_TO_MAP_VALUE,
+ },
+};
+
+static const struct bpf_reg_types fullsock_types = {
+ .types = {
+ PTR_TO_SOCKET,
+ PTR_TO_BTF_ID,
+ },
+};
+
+static const struct bpf_reg_types scalar_types = { .types = { SCALAR_VALUE } };
+static const struct bpf_reg_types context_types = { .types = { PTR_TO_CTX } };
+static const struct bpf_reg_types alloc_mem_types = { .types = { PTR_TO_MEM } };
+static const struct bpf_reg_types const_map_ptr_types = { .types = {CONST_PTR_TO_MAP } };
+static const struct bpf_reg_types btf_ptr_types = { .types = { PTR_TO_BTF_ID } };
+static const struct bpf_reg_types spin_lock_types = { .types = { PTR_TO_MAP_VALUE } };
+
+static const struct bpf_reg_types *compatible_reg_types[] = {
+ [ARG_PTR_TO_MAP_KEY] = &map_key_value_types,
+ [ARG_PTR_TO_MAP_VALUE] = &map_key_value_types,
+ [ARG_PTR_TO_UNINIT_MAP_VALUE] = &map_key_value_types,
+ [ARG_PTR_TO_MAP_VALUE_OR_NULL] = &map_key_value_types,
+ [ARG_CONST_SIZE] = &scalar_types,
+ [ARG_CONST_SIZE_OR_ZERO] = &scalar_types,
+ [ARG_CONST_ALLOC_SIZE_OR_ZERO] = &scalar_types,
+ [ARG_CONST_MAP_PTR] = &const_map_ptr_types,
+ [ARG_PTR_TO_CTX] = &context_types,
+ [ARG_PTR_TO_CTX_OR_NULL] = &context_types,
+ [ARG_PTR_TO_SOCK_COMMON] = &sock_types,
+ [ARG_PTR_TO_SOCKET] = &fullsock_types,
+ [ARG_PTR_TO_SOCKET_OR_NULL] = &fullsock_types,
+ [ARG_PTR_TO_BTF_ID] = &btf_ptr_types,
+ [ARG_PTR_TO_SPIN_LOCK] = &spin_lock_types,
+ [ARG_PTR_TO_MEM] = &mem_types,
+ [ARG_PTR_TO_MEM_OR_NULL] = &mem_types,
+ [ARG_PTR_TO_UNINIT_MEM] = &mem_types,
+ [ARG_PTR_TO_ALLOC_MEM] = &alloc_mem_types,
+ [ARG_PTR_TO_ALLOC_MEM_OR_NULL] = &alloc_mem_types,
+ [ARG_PTR_TO_INT] = &int_ptr_types,
+ [ARG_PTR_TO_LONG] = &int_ptr_types,
+ [__BPF_ARG_TYPE_MAX] = NULL,
+};
+
+static int check_reg_type(struct bpf_verifier_env *env, u32 regno,
+ const struct bpf_reg_types *compatible)
+{
+ struct bpf_reg_state *regs = cur_regs(env), *reg = ®s[regno];
+ enum bpf_reg_type expected, type = reg->type;
+ int i, j;
+
+ for (i = 0; i < ARRAY_SIZE(compatible->types); i++) {
+ expected = compatible->types[i];
+ if (expected == NOT_INIT)
+ break;
+
+ if (type == expected)
+ return 0;
+ }
+
+ verbose(env, "R%d type=%s expected=", regno, reg_type_str[type]);
+ for (j = 0; j + 1 < i; j++)
+ verbose(env, "%s, ", reg_type_str[compatible->types[j]]);
+ verbose(env, "%s\n", reg_type_str[compatible->types[j]]);
+ return -EACCES;
+}
+
static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
struct bpf_call_arg_meta *meta,
const struct bpf_func_proto *fn)
{
u32 regno = BPF_REG_1 + arg;
struct bpf_reg_state *regs = cur_regs(env), *reg = ®s[regno];
- enum bpf_reg_type expected_type, type = reg->type;
enum bpf_arg_type arg_type = fn->arg_type[arg];
+ const struct bpf_reg_types *compatible;
+ enum bpf_reg_type type = reg->type;
int err = 0;
if (arg_type == ARG_DONTCARE)
@@ -3956,72 +4057,16 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
*/
goto skip_type_check;
- if (arg_type == ARG_PTR_TO_MAP_KEY ||
- arg_type == ARG_PTR_TO_MAP_VALUE ||
- arg_type == ARG_PTR_TO_UNINIT_MAP_VALUE ||
- arg_type == ARG_PTR_TO_MAP_VALUE_OR_NULL) {
- expected_type = PTR_TO_STACK;
- if (!type_is_pkt_pointer(type) &&
- type != PTR_TO_MAP_VALUE &&
- type != expected_type)
- goto err_type;
- } else if (arg_type == ARG_CONST_SIZE ||
- arg_type == ARG_CONST_SIZE_OR_ZERO ||
- arg_type == ARG_CONST_ALLOC_SIZE_OR_ZERO) {
- expected_type = SCALAR_VALUE;
- if (type != expected_type)
- goto err_type;
- } else if (arg_type == ARG_CONST_MAP_PTR) {
- expected_type = CONST_PTR_TO_MAP;
- if (type != expected_type)
- goto err_type;
- } else if (arg_type == ARG_PTR_TO_CTX ||
- arg_type == ARG_PTR_TO_CTX_OR_NULL) {
- expected_type = PTR_TO_CTX;
- if (type != expected_type)
- goto err_type;
- } else if (arg_type == ARG_PTR_TO_SOCK_COMMON) {
- expected_type = PTR_TO_SOCK_COMMON;
- /* Any sk pointer can be ARG_PTR_TO_SOCK_COMMON */
- if (!type_is_sk_pointer(type))
- goto err_type;
- } else if (arg_type == ARG_PTR_TO_SOCKET ||
- arg_type == ARG_PTR_TO_SOCKET_OR_NULL) {
- expected_type = PTR_TO_SOCKET;
- if (type != expected_type)
- goto err_type;
- } else if (arg_type == ARG_PTR_TO_BTF_ID) {
- expected_type = PTR_TO_BTF_ID;
- if (type != expected_type)
- goto err_type;
- } else if (arg_type == ARG_PTR_TO_SPIN_LOCK) {
- expected_type = PTR_TO_MAP_VALUE;
- if (type != expected_type)
- goto err_type;
- } else if (arg_type_is_mem_ptr(arg_type)) {
- expected_type = PTR_TO_STACK;
- if (!type_is_pkt_pointer(type) &&
- type != PTR_TO_MAP_VALUE &&
- type != PTR_TO_MEM &&
- type != PTR_TO_RDONLY_BUF &&
- type != PTR_TO_RDWR_BUF &&
- type != expected_type)
- goto err_type;
- } else if (arg_type_is_alloc_mem_ptr(arg_type)) {
- expected_type = PTR_TO_MEM;
- if (type != expected_type)
- goto err_type;
- } else if (arg_type_is_int_ptr(arg_type)) {
- expected_type = PTR_TO_STACK;
- if (!type_is_pkt_pointer(type) &&
- type != PTR_TO_MAP_VALUE &&
- type != expected_type)
- goto err_type;
- } else {
- verbose(env, "unsupported arg_type %d\n", arg_type);
+ compatible = compatible_reg_types[arg_type];
+ if (!compatible) {
+ verbose(env, "verifier internal error: unsupported arg type %d\n", arg_type);
return -EFAULT;
}
+ err = check_reg_type(env, regno, compatible);
+ if (err)
+ return err;
+
if (type == PTR_TO_BTF_ID) {
const u32 *btf_id = fn->arg_btf_id[arg];
@@ -4174,10 +4219,6 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
}
return err;
-err_type:
- verbose(env, "R%d type=%s expected=%s\n", regno,
- reg_type_str[type], reg_type_str[expected_type]);
- return -EACCES;
}
static bool may_update_sockmap(struct bpf_verifier_env *env, int func_id)
--
2.25.1
^ permalink raw reply related [flat|nested] 24+ messages in thread* Re: [PATCH bpf-next v2 11/11] bpf: use a table to drive helper arg type checks
2020-09-09 17:11 ` [PATCH bpf-next v2 11/11] bpf: use a table to drive helper arg type checks Lorenz Bauer
@ 2020-09-09 22:22 ` Martin KaFai Lau
0 siblings, 0 replies; 24+ messages in thread
From: Martin KaFai Lau @ 2020-09-09 22:22 UTC (permalink / raw)
To: Lorenz Bauer; +Cc: ast, yhs, daniel, andriin, bpf, kernel-team
On Wed, Sep 09, 2020 at 06:11:55PM +0100, Lorenz Bauer wrote:
> The mapping between bpf_arg_type and bpf_reg_type is encoded in a big
> hairy if statement that is hard to follow. The debug output also leaves
> to be desired: if a reg_type doesn't match we only print one of the
> options, instead printing all the valid ones.
>
> Convert the if statement into a table which is then used to drive type
> checking. If none of the reg_types match we print all options, e.g.:
>
> R2 type=rdonly_buf expected=fp, pkt, pkt_meta, map_value
>
> Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
> ---
> include/linux/bpf.h | 1 +
> kernel/bpf/verifier.c | 189 +++++++++++++++++++++++++-----------------
> 2 files changed, 116 insertions(+), 74 deletions(-)
>
> diff --git a/include/linux/bpf.h b/include/linux/bpf.h
> index aabbc8bb52bd..7cf7e90f55bb 100644
> --- a/include/linux/bpf.h
> +++ b/include/linux/bpf.h
> @@ -292,6 +292,7 @@ enum bpf_arg_type {
> ARG_PTR_TO_ALLOC_MEM, /* pointer to dynamically allocated memory */
> ARG_PTR_TO_ALLOC_MEM_OR_NULL, /* pointer to dynamically allocated memory or NULL */
> ARG_CONST_ALLOC_SIZE_OR_ZERO, /* number of allocated bytes requested */
> + __BPF_ARG_TYPE_MAX,
> };
>
> /* type of values returned from helper functions */
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index ebf900fceaf0..9c9728c81d4c 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -3856,12 +3856,6 @@ static bool arg_type_is_mem_size(enum bpf_arg_type type)
> type == ARG_CONST_SIZE_OR_ZERO;
> }
>
> -static bool arg_type_is_alloc_mem_ptr(enum bpf_arg_type type)
> -{
> - return type == ARG_PTR_TO_ALLOC_MEM ||
> - type == ARG_PTR_TO_ALLOC_MEM_OR_NULL;
> -}
> -
> static bool arg_type_is_alloc_size(enum bpf_arg_type type)
> {
> return type == ARG_CONST_ALLOC_SIZE_OR_ZERO;
> @@ -3910,14 +3904,121 @@ static int resolve_map_arg_type(struct bpf_verifier_env *env,
> return 0;
> }
>
> +struct bpf_reg_types {
> + const enum bpf_reg_type types[10];
> +};
> +
> +static const struct bpf_reg_types map_key_value_types = {
> + .types = {
> + PTR_TO_STACK,
> + PTR_TO_PACKET,
> + PTR_TO_PACKET_META,
> + PTR_TO_MAP_VALUE,
> + },
> +};
> +
> +static const struct bpf_reg_types sock_types = {
> + .types = {
> + PTR_TO_SOCK_COMMON,
> + PTR_TO_SOCKET,
> + PTR_TO_TCP_SOCK,
> + PTR_TO_XDP_SOCK,
> + },
> +};
> +
> +static const struct bpf_reg_types mem_types = {
> + .types = {
> + PTR_TO_STACK,
> + PTR_TO_PACKET,
> + PTR_TO_PACKET_META,
> + PTR_TO_MAP_VALUE,
> + PTR_TO_MEM,
> + PTR_TO_RDONLY_BUF,
> + PTR_TO_RDWR_BUF,
> + },
> +};
> +
> +static const struct bpf_reg_types int_ptr_types = {
> + .types = {
> + PTR_TO_STACK,
> + PTR_TO_PACKET,
> + PTR_TO_PACKET_META,
> + PTR_TO_MAP_VALUE,
> + },
> +};
> +
> +static const struct bpf_reg_types fullsock_types = {
> + .types = {
> + PTR_TO_SOCKET,
> + PTR_TO_BTF_ID,
PTR_TO_BTF_ID should be added at the sockmap-iter-update patch instead.
Others lgtm.
^ permalink raw reply [flat|nested] 24+ messages in thread