All of lore.kernel.org
 help / color / mirror / Atom feed
From: Lorenz Bauer <lmb@cloudflare.com>
To: ast@kernel.org, yhs@fb.com, daniel@iogearbox.net, kafai@fb.com,
	andriin@fb.com
Cc: bpf@vger.kernel.org, kernel-team@cloudflare.com,
	Lorenz Bauer <lmb@cloudflare.com>
Subject: [PATCH bpf-next v4 09/11] bpf: check ARG_PTR_TO_SPINLOCK register type in check_func_arg
Date: Wed, 16 Sep 2020 18:52:53 +0100	[thread overview]
Message-ID: <20200916175255.192040-10-lmb@cloudflare.com> (raw)
In-Reply-To: <20200916175255.192040-1-lmb@cloudflare.com>

Move the check for PTR_TO_MAP_VALUE to check_func_arg, where all other
checking is done as well. Move the invocation of process_spin_lock away
from the register type checking, to allow a future refactoring.

Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
Acked-by: Martin KaFai Lau <kafai@fb.com>
---
 kernel/bpf/verifier.c | 28 ++++++++++++++--------------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index e09eedb30117..eefc8256df1c 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -3781,10 +3781,6 @@ static int process_spin_lock(struct bpf_verifier_env *env, int regno,
 	struct bpf_map *map = reg->map_ptr;
 	u64 val = reg->var_off.value;
 
-	if (reg->type != PTR_TO_MAP_VALUE) {
-		verbose(env, "R%d is not a pointer to map_value\n", regno);
-		return -EINVAL;
-	}
 	if (!is_const) {
 		verbose(env,
 			"R%d doesn't have constant offset. bpf_spin_lock has to be at the constant offset\n",
@@ -3993,16 +3989,9 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
 		if (type != expected_type)
 			goto err_type;
 	} else if (arg_type == ARG_PTR_TO_SPIN_LOCK) {
-		if (meta->func_id == BPF_FUNC_spin_lock) {
-			if (process_spin_lock(env, regno, true))
-				return -EACCES;
-		} else if (meta->func_id == BPF_FUNC_spin_unlock) {
-			if (process_spin_lock(env, regno, false))
-				return -EACCES;
-		} else {
-			verbose(env, "verifier internal error\n");
-			return -EFAULT;
-		}
+		expected_type = PTR_TO_MAP_VALUE;
+		if (type != expected_type)
+			goto err_type;
 	} else if (arg_type_is_mem_ptr(arg_type)) {
 		expected_type = PTR_TO_STACK;
 		/* One exception here. In case function allows for NULL to be
@@ -4108,6 +4097,17 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
 		err = check_helper_mem_access(env, regno,
 					      meta->map_ptr->value_size, false,
 					      meta);
+	} else if (arg_type == ARG_PTR_TO_SPIN_LOCK) {
+		if (meta->func_id == BPF_FUNC_spin_lock) {
+			if (process_spin_lock(env, regno, true))
+				return -EACCES;
+		} else if (meta->func_id == BPF_FUNC_spin_unlock) {
+			if (process_spin_lock(env, regno, false))
+				return -EACCES;
+		} else {
+			verbose(env, "verifier internal error\n");
+			return -EFAULT;
+		}
 	} else if (arg_type_is_mem_ptr(arg_type)) {
 		/* The access to this pointer is only checked when we hit the
 		 * next is_mem_size argument below.
-- 
2.25.1


  parent reply	other threads:[~2020-09-16 17:55 UTC|newest]

Thread overview: 13+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-09-16 17:52 [PATCH bpf-next v4 00/11] Make check_func_arg type checks table driven Lorenz Bauer
2020-09-16 17:52 ` [PATCH bpf-next v4 01/11] btf: make btf_set_contains take a const pointer Lorenz Bauer
2020-09-16 17:52 ` [PATCH bpf-next v4 02/11] bpf: check scalar or invalid register in check_helper_mem_access Lorenz Bauer
2020-09-16 17:52 ` [PATCH bpf-next v4 03/11] btf: Add BTF_ID_LIST_SINGLE macro Lorenz Bauer
2020-09-16 17:52 ` [PATCH bpf-next v4 04/11] bpf: allow specifying a BTF ID per argument in function protos Lorenz Bauer
2020-09-16 17:52 ` [PATCH bpf-next v4 05/11] bpf: make BTF pointer type checking generic Lorenz Bauer
2020-09-16 17:52 ` [PATCH bpf-next v4 06/11] bpf: make reference tracking generic Lorenz Bauer
2020-09-16 17:52 ` [PATCH bpf-next v4 07/11] bpf: make context access check generic Lorenz Bauer
2020-09-16 17:52 ` [PATCH bpf-next v4 08/11] bpf: set meta->raw_mode for pointers close to use Lorenz Bauer
2020-09-16 17:52 ` Lorenz Bauer [this message]
2020-09-16 17:52 ` [PATCH bpf-next v4 10/11] bpf: hoist type checking for nullable arg types Lorenz Bauer
2020-09-16 17:52 ` [PATCH bpf-next v4 11/11] bpf: use a table to drive helper arg type checks Lorenz Bauer
2020-09-21 12:12 [PATCH RESEND bpf-next v4 00/11] Make check_func_arg type checks table driven Lorenz Bauer
2020-09-21 12:12 ` [PATCH bpf-next v4 09/11] bpf: check ARG_PTR_TO_SPINLOCK register type in check_func_arg Lorenz Bauer

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200916175255.192040-10-lmb@cloudflare.com \
    --to=lmb@cloudflare.com \
    --cc=andriin@fb.com \
    --cc=ast@kernel.org \
    --cc=bpf@vger.kernel.org \
    --cc=daniel@iogearbox.net \
    --cc=kafai@fb.com \
    --cc=kernel-team@cloudflare.com \
    --cc=yhs@fb.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.