* [PATCH bpf-next v4 01/11] btf: make btf_set_contains take a const pointer
2020-09-21 12:12 [PATCH RESEND bpf-next v4 00/11] Make check_func_arg type checks table driven Lorenz Bauer
@ 2020-09-21 12:12 ` Lorenz Bauer
2020-09-21 12:12 ` [PATCH bpf-next v4 02/11] bpf: check scalar or invalid register in check_helper_mem_access Lorenz Bauer
` (9 subsequent siblings)
10 siblings, 0 replies; 18+ messages in thread
From: Lorenz Bauer @ 2020-09-21 12:12 UTC (permalink / raw)
To: ast, daniel; +Cc: bpf, netdev, Lorenz Bauer, Andrii Nakryiko
bsearch doesn't modify the contents of the array, so we can take a const pointer.
Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
Acked-by: Andrii Nakryiko <andriin@fb.com>
---
include/linux/bpf.h | 2 +-
kernel/bpf/btf.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 5dcce0364634..4cbf92f5ecdb 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -1901,6 +1901,6 @@ int bpf_arch_text_poke(void *ip, enum bpf_text_poke_type t,
void *addr1, void *addr2);
struct btf_id_set;
-bool btf_id_set_contains(struct btf_id_set *set, u32 id);
+bool btf_id_set_contains(const struct btf_id_set *set, u32 id);
#endif /* _LINUX_BPF_H */
diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
index f9ac6935ab3c..a2330f6fe2e6 100644
--- a/kernel/bpf/btf.c
+++ b/kernel/bpf/btf.c
@@ -4772,7 +4772,7 @@ static int btf_id_cmp_func(const void *a, const void *b)
return *pa - *pb;
}
-bool btf_id_set_contains(struct btf_id_set *set, u32 id)
+bool btf_id_set_contains(const struct btf_id_set *set, u32 id)
{
return bsearch(&id, set->ids, set->cnt, sizeof(u32), btf_id_cmp_func) != NULL;
}
--
2.25.1
^ permalink raw reply related [flat|nested] 18+ messages in thread* [PATCH bpf-next v4 02/11] bpf: check scalar or invalid register in check_helper_mem_access
2020-09-21 12:12 [PATCH RESEND bpf-next v4 00/11] Make check_func_arg type checks table driven Lorenz Bauer
2020-09-21 12:12 ` [PATCH bpf-next v4 01/11] btf: make btf_set_contains take a const pointer Lorenz Bauer
@ 2020-09-21 12:12 ` Lorenz Bauer
2020-09-21 12:12 ` [PATCH bpf-next v4 03/11] btf: Add BTF_ID_LIST_SINGLE macro Lorenz Bauer
` (8 subsequent siblings)
10 siblings, 0 replies; 18+ messages in thread
From: Lorenz Bauer @ 2020-09-21 12:12 UTC (permalink / raw)
To: ast, daniel; +Cc: bpf, netdev, Lorenz Bauer, Andrii Nakryiko
Move the check for a NULL or zero register to check_helper_mem_access. This
makes check_stack_boundary easier to understand.
Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
Acked-by: Andrii Nakryiko <andriin@fb.com>
---
kernel/bpf/verifier.c | 24 +++++++++++-------------
1 file changed, 11 insertions(+), 13 deletions(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 814bc6c1ad16..c997f81c500b 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -3594,18 +3594,6 @@ static int check_stack_boundary(struct bpf_verifier_env *env, int regno,
struct bpf_func_state *state = func(env, reg);
int err, min_off, max_off, i, j, slot, spi;
- if (reg->type != PTR_TO_STACK) {
- /* Allow zero-byte read from NULL, regardless of pointer type */
- if (zero_size_allowed && access_size == 0 &&
- register_is_null(reg))
- return 0;
-
- verbose(env, "R%d type=%s expected=%s\n", regno,
- reg_type_str[reg->type],
- reg_type_str[PTR_TO_STACK]);
- return -EACCES;
- }
-
if (tnum_is_const(reg->var_off)) {
min_off = max_off = reg->var_off.value + reg->off;
err = __check_stack_boundary(env, regno, min_off, access_size,
@@ -3750,9 +3738,19 @@ static int check_helper_mem_access(struct bpf_verifier_env *env, int regno,
access_size, zero_size_allowed,
"rdwr",
&env->prog->aux->max_rdwr_access);
- default: /* scalar_value|ptr_to_stack or invalid ptr */
+ case PTR_TO_STACK:
return check_stack_boundary(env, regno, access_size,
zero_size_allowed, meta);
+ default: /* scalar_value or invalid ptr */
+ /* Allow zero-byte read from NULL, regardless of pointer type */
+ if (zero_size_allowed && access_size == 0 &&
+ register_is_null(reg))
+ return 0;
+
+ verbose(env, "R%d type=%s expected=%s\n", regno,
+ reg_type_str[reg->type],
+ reg_type_str[PTR_TO_STACK]);
+ return -EACCES;
}
}
--
2.25.1
^ permalink raw reply related [flat|nested] 18+ messages in thread* [PATCH bpf-next v4 03/11] btf: Add BTF_ID_LIST_SINGLE macro
2020-09-21 12:12 [PATCH RESEND bpf-next v4 00/11] Make check_func_arg type checks table driven Lorenz Bauer
2020-09-21 12:12 ` [PATCH bpf-next v4 01/11] btf: make btf_set_contains take a const pointer Lorenz Bauer
2020-09-21 12:12 ` [PATCH bpf-next v4 02/11] bpf: check scalar or invalid register in check_helper_mem_access Lorenz Bauer
@ 2020-09-21 12:12 ` Lorenz Bauer
2020-09-21 12:12 ` [PATCH bpf-next v4 04/11] bpf: allow specifying a BTF ID per argument in function protos Lorenz Bauer
` (7 subsequent siblings)
10 siblings, 0 replies; 18+ messages in thread
From: Lorenz Bauer @ 2020-09-21 12:12 UTC (permalink / raw)
To: ast, daniel; +Cc: bpf, netdev, Lorenz Bauer, Andrii Nakryiko, Martin KaFai Lau
Add a convenience macro that allows defining a BTF ID list with
a single item. This lets us cut down on repetitive macros.
Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
Suggested-by: Andrii Nakryiko <andriin@fb.com>
Acked-by: Martin KaFai Lau <kafai@fb.com>
---
include/linux/btf_ids.h | 8 ++++++++
tools/include/linux/btf_ids.h | 8 ++++++++
2 files changed, 16 insertions(+)
diff --git a/include/linux/btf_ids.h b/include/linux/btf_ids.h
index 210b086188a3..57890b357f85 100644
--- a/include/linux/btf_ids.h
+++ b/include/linux/btf_ids.h
@@ -76,6 +76,13 @@ extern u32 name[];
#define BTF_ID_LIST_GLOBAL(name) \
__BTF_ID_LIST(name, globl)
+/* The BTF_ID_LIST_SINGLE macro defines a BTF_ID_LIST with
+ * a single entry.
+ */
+#define BTF_ID_LIST_SINGLE(name, prefix, typename) \
+ BTF_ID_LIST(name) \
+ BTF_ID(prefix, typename)
+
/*
* The BTF_ID_UNUSED macro defines 4 zero bytes.
* It's used when we want to define 'unused' entry
@@ -140,6 +147,7 @@ extern struct btf_id_set name;
#define BTF_ID(prefix, name)
#define BTF_ID_UNUSED
#define BTF_ID_LIST_GLOBAL(name) u32 name[1];
+#define BTF_ID_LIST_SINGLE(name, prefix, typename) static u32 name[1];
#define BTF_SET_START(name) static struct btf_id_set name = { 0 };
#define BTF_SET_START_GLOBAL(name) static struct btf_id_set name = { 0 };
#define BTF_SET_END(name)
diff --git a/tools/include/linux/btf_ids.h b/tools/include/linux/btf_ids.h
index 210b086188a3..57890b357f85 100644
--- a/tools/include/linux/btf_ids.h
+++ b/tools/include/linux/btf_ids.h
@@ -76,6 +76,13 @@ extern u32 name[];
#define BTF_ID_LIST_GLOBAL(name) \
__BTF_ID_LIST(name, globl)
+/* The BTF_ID_LIST_SINGLE macro defines a BTF_ID_LIST with
+ * a single entry.
+ */
+#define BTF_ID_LIST_SINGLE(name, prefix, typename) \
+ BTF_ID_LIST(name) \
+ BTF_ID(prefix, typename)
+
/*
* The BTF_ID_UNUSED macro defines 4 zero bytes.
* It's used when we want to define 'unused' entry
@@ -140,6 +147,7 @@ extern struct btf_id_set name;
#define BTF_ID(prefix, name)
#define BTF_ID_UNUSED
#define BTF_ID_LIST_GLOBAL(name) u32 name[1];
+#define BTF_ID_LIST_SINGLE(name, prefix, typename) static u32 name[1];
#define BTF_SET_START(name) static struct btf_id_set name = { 0 };
#define BTF_SET_START_GLOBAL(name) static struct btf_id_set name = { 0 };
#define BTF_SET_END(name)
--
2.25.1
^ permalink raw reply related [flat|nested] 18+ messages in thread* [PATCH bpf-next v4 04/11] bpf: allow specifying a BTF ID per argument in function protos
2020-09-21 12:12 [PATCH RESEND bpf-next v4 00/11] Make check_func_arg type checks table driven Lorenz Bauer
` (2 preceding siblings ...)
2020-09-21 12:12 ` [PATCH bpf-next v4 03/11] btf: Add BTF_ID_LIST_SINGLE macro Lorenz Bauer
@ 2020-09-21 12:12 ` Lorenz Bauer
2020-09-21 12:12 ` [PATCH bpf-next v4 05/11] bpf: make BTF pointer type checking generic Lorenz Bauer
` (6 subsequent siblings)
10 siblings, 0 replies; 18+ messages in thread
From: Lorenz Bauer @ 2020-09-21 12:12 UTC (permalink / raw)
To: ast, daniel; +Cc: bpf, netdev, Lorenz Bauer, Martin KaFai Lau
Function prototypes using ARG_PTR_TO_BTF_ID currently use two ways to signal
which BTF IDs are acceptable. First, bpf_func_proto.btf_id is an array of
IDs, one for each argument. This array is only accessed up to the highest
numbered argument that uses ARG_PTR_TO_BTF_ID and may therefore be less than
five arguments long. It usually points at a BTF_ID_LIST. Second, check_btf_id
is a function pointer that is called by the verifier if present. It gets the
actual BTF ID of the register, and the argument number we're currently checking.
It turns out that the only user check_arg_btf_id ignores the argument, and is
simply used to check whether the BTF ID has a struct sock_common at it's start.
Replace both of these mechanisms with an explicit BTF ID for each argument
in a function proto. Thanks to btf_struct_ids_match this is very flexible:
check_arg_btf_id can be replaced by requiring struct sock_common.
Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
Acked-by: Martin KaFai Lau <kafai@fb.com>
---
include/linux/bpf.h | 18 +++++++-------
kernel/bpf/bpf_inode_storage.c | 8 +++----
kernel/bpf/btf.c | 13 ----------
kernel/bpf/stackmap.c | 5 ++--
kernel/bpf/verifier.c | 44 +++++++++++++++++-----------------
kernel/trace/bpf_trace.c | 15 ++++--------
net/core/bpf_sk_storage.c | 8 ++-----
net/core/filter.c | 31 +++++++-----------------
net/ipv4/bpf_tcp_ca.c | 19 ++++-----------
9 files changed, 58 insertions(+), 103 deletions(-)
diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 4cbf92f5ecdb..732e2f144b6d 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -326,12 +326,16 @@ struct bpf_func_proto {
};
enum bpf_arg_type arg_type[5];
};
- int *btf_id; /* BTF ids of arguments */
- bool (*check_btf_id)(u32 btf_id, u32 arg); /* if the argument btf_id is
- * valid. Often used if more
- * than one btf id is permitted
- * for this argument.
- */
+ union {
+ struct {
+ u32 *arg1_btf_id;
+ u32 *arg2_btf_id;
+ u32 *arg3_btf_id;
+ u32 *arg4_btf_id;
+ u32 *arg5_btf_id;
+ };
+ u32 *arg_btf_id[5];
+ };
int *ret_btf_id; /* return value btf_id */
bool (*allowed)(const struct bpf_prog *prog);
};
@@ -1381,8 +1385,6 @@ int btf_struct_access(struct bpf_verifier_log *log,
u32 *next_btf_id);
bool btf_struct_ids_match(struct bpf_verifier_log *log,
int off, u32 id, u32 need_type_id);
-int btf_resolve_helper_id(struct bpf_verifier_log *log,
- const struct bpf_func_proto *fn, int);
int btf_distill_func_proto(struct bpf_verifier_log *log,
struct btf *btf,
diff --git a/kernel/bpf/bpf_inode_storage.c b/kernel/bpf/bpf_inode_storage.c
index 75be02799c0f..6edff97ad594 100644
--- a/kernel/bpf/bpf_inode_storage.c
+++ b/kernel/bpf/bpf_inode_storage.c
@@ -249,9 +249,7 @@ const struct bpf_map_ops inode_storage_map_ops = {
.map_owner_storage_ptr = inode_storage_ptr,
};
-BTF_ID_LIST(bpf_inode_storage_btf_ids)
-BTF_ID_UNUSED
-BTF_ID(struct, inode)
+BTF_ID_LIST_SINGLE(bpf_inode_storage_btf_ids, struct, inode)
const struct bpf_func_proto bpf_inode_storage_get_proto = {
.func = bpf_inode_storage_get,
@@ -259,9 +257,9 @@ const struct bpf_func_proto bpf_inode_storage_get_proto = {
.ret_type = RET_PTR_TO_MAP_VALUE_OR_NULL,
.arg1_type = ARG_CONST_MAP_PTR,
.arg2_type = ARG_PTR_TO_BTF_ID,
+ .arg2_btf_id = &bpf_inode_storage_btf_ids[0],
.arg3_type = ARG_PTR_TO_MAP_VALUE_OR_NULL,
.arg4_type = ARG_ANYTHING,
- .btf_id = bpf_inode_storage_btf_ids,
};
const struct bpf_func_proto bpf_inode_storage_delete_proto = {
@@ -270,5 +268,5 @@ const struct bpf_func_proto bpf_inode_storage_delete_proto = {
.ret_type = RET_INTEGER,
.arg1_type = ARG_CONST_MAP_PTR,
.arg2_type = ARG_PTR_TO_BTF_ID,
- .btf_id = bpf_inode_storage_btf_ids,
+ .arg2_btf_id = &bpf_inode_storage_btf_ids[0],
};
diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
index a2330f6fe2e6..5d3c36e13139 100644
--- a/kernel/bpf/btf.c
+++ b/kernel/bpf/btf.c
@@ -4193,19 +4193,6 @@ bool btf_struct_ids_match(struct bpf_verifier_log *log,
return true;
}
-int btf_resolve_helper_id(struct bpf_verifier_log *log,
- const struct bpf_func_proto *fn, int arg)
-{
- int id;
-
- if (fn->arg_type[arg] != ARG_PTR_TO_BTF_ID || !btf_vmlinux)
- return -EINVAL;
- id = fn->btf_id[arg];
- if (!id || id > btf_vmlinux->nr_types)
- return -EINVAL;
- return id;
-}
-
static int __get_type_size(struct btf *btf, u32 btf_id,
const struct btf_type **bad_type)
{
diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c
index a2fa006f430e..06065fa27124 100644
--- a/kernel/bpf/stackmap.c
+++ b/kernel/bpf/stackmap.c
@@ -665,18 +665,17 @@ BPF_CALL_4(bpf_get_task_stack, struct task_struct *, task, void *, buf,
return __bpf_get_stack(regs, task, NULL, buf, size, flags);
}
-BTF_ID_LIST(bpf_get_task_stack_btf_ids)
-BTF_ID(struct, task_struct)
+BTF_ID_LIST_SINGLE(bpf_get_task_stack_btf_ids, struct, task_struct)
const struct bpf_func_proto bpf_get_task_stack_proto = {
.func = bpf_get_task_stack,
.gpl_only = false,
.ret_type = RET_INTEGER,
.arg1_type = ARG_PTR_TO_BTF_ID,
+ .arg1_btf_id = &bpf_get_task_stack_btf_ids[0],
.arg2_type = ARG_PTR_TO_UNINIT_MEM,
.arg3_type = ARG_CONST_SIZE_OR_ZERO,
.arg4_type = ARG_ANYTHING,
- .btf_id = bpf_get_task_stack_btf_ids,
};
BPF_CALL_4(bpf_get_stack_pe, struct bpf_perf_event_data_kern *, ctx,
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index c997f81c500b..9f95d6d55c5f 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -238,7 +238,6 @@ struct bpf_call_arg_meta {
u64 msize_max_value;
int ref_obj_id;
int func_id;
- u32 btf_id;
};
struct btf *btf_vmlinux;
@@ -4002,29 +4001,23 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
goto err_type;
}
} else if (arg_type == ARG_PTR_TO_BTF_ID) {
- bool ids_match = false;
+ const u32 *btf_id = fn->arg_btf_id[arg];
expected_type = PTR_TO_BTF_ID;
if (type != expected_type)
goto err_type;
- if (!fn->check_btf_id) {
- if (reg->btf_id != meta->btf_id) {
- ids_match = btf_struct_ids_match(&env->log, reg->off, reg->btf_id,
- meta->btf_id);
- if (!ids_match) {
- verbose(env, "Helper has type %s got %s in R%d\n",
- kernel_type_name(meta->btf_id),
- kernel_type_name(reg->btf_id), regno);
- return -EACCES;
- }
- }
- } else if (!fn->check_btf_id(reg->btf_id, arg)) {
- verbose(env, "Helper does not support %s in R%d\n",
- kernel_type_name(reg->btf_id), regno);
+ if (!btf_id) {
+ verbose(env, "verifier internal error: missing BTF ID\n");
+ return -EFAULT;
+ }
+
+ if (!btf_struct_ids_match(&env->log, reg->off, reg->btf_id, *btf_id)) {
+ verbose(env, "R%d is of type %s but %s is expected\n",
+ regno, kernel_type_name(reg->btf_id), kernel_type_name(*btf_id));
return -EACCES;
}
- if ((reg->off && !ids_match) || !tnum_is_const(reg->var_off) || reg->var_off.value) {
+ if (!tnum_is_const(reg->var_off) || reg->var_off.value) {
verbose(env, "R%d is a pointer to in-kernel struct with non-zero offset\n",
regno);
return -EACCES;
@@ -4493,10 +4486,22 @@ static bool check_refcount_ok(const struct bpf_func_proto *fn, int func_id)
return count <= 1;
}
+static bool check_btf_id_ok(const struct bpf_func_proto *fn)
+{
+ int i;
+
+ for (i = 0; i < ARRAY_SIZE(fn->arg_type); i++)
+ if (fn->arg_type[i] == ARG_PTR_TO_BTF_ID && !fn->arg_btf_id[i])
+ return false;
+
+ return true;
+}
+
static int check_func_proto(const struct bpf_func_proto *fn, int func_id)
{
return check_raw_mode_ok(fn) &&
check_arg_pair_ok(fn) &&
+ check_btf_id_ok(fn) &&
check_refcount_ok(fn, func_id) ? 0 : -EINVAL;
}
@@ -4892,11 +4897,6 @@ static int check_helper_call(struct bpf_verifier_env *env, int func_id, int insn
meta.func_id = func_id;
/* check args */
for (i = 0; i < 5; i++) {
- if (!fn->check_btf_id) {
- err = btf_resolve_helper_id(&env->log, fn, i);
- if (err > 0)
- meta.btf_id = err;
- }
err = check_func_arg(env, i, &meta, fn);
if (err)
return err;
diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index b2a5380eb187..ebf9be4d0d6a 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -743,19 +743,18 @@ BPF_CALL_5(bpf_seq_printf, struct seq_file *, m, char *, fmt, u32, fmt_size,
return err;
}
-BTF_ID_LIST(bpf_seq_printf_btf_ids)
-BTF_ID(struct, seq_file)
+BTF_ID_LIST_SINGLE(btf_seq_file_ids, struct, seq_file)
static const struct bpf_func_proto bpf_seq_printf_proto = {
.func = bpf_seq_printf,
.gpl_only = true,
.ret_type = RET_INTEGER,
.arg1_type = ARG_PTR_TO_BTF_ID,
+ .arg1_btf_id = &btf_seq_file_ids[0],
.arg2_type = ARG_PTR_TO_MEM,
.arg3_type = ARG_CONST_SIZE,
.arg4_type = ARG_PTR_TO_MEM_OR_NULL,
.arg5_type = ARG_CONST_SIZE_OR_ZERO,
- .btf_id = bpf_seq_printf_btf_ids,
};
BPF_CALL_3(bpf_seq_write, struct seq_file *, m, const void *, data, u32, len)
@@ -763,17 +762,14 @@ BPF_CALL_3(bpf_seq_write, struct seq_file *, m, const void *, data, u32, len)
return seq_write(m, data, len) ? -EOVERFLOW : 0;
}
-BTF_ID_LIST(bpf_seq_write_btf_ids)
-BTF_ID(struct, seq_file)
-
static const struct bpf_func_proto bpf_seq_write_proto = {
.func = bpf_seq_write,
.gpl_only = true,
.ret_type = RET_INTEGER,
.arg1_type = ARG_PTR_TO_BTF_ID,
+ .arg1_btf_id = &btf_seq_file_ids[0],
.arg2_type = ARG_PTR_TO_MEM,
.arg3_type = ARG_CONST_SIZE_OR_ZERO,
- .btf_id = bpf_seq_write_btf_ids,
};
static __always_inline int
@@ -1130,17 +1126,16 @@ static bool bpf_d_path_allowed(const struct bpf_prog *prog)
return btf_id_set_contains(&btf_allowlist_d_path, prog->aux->attach_btf_id);
}
-BTF_ID_LIST(bpf_d_path_btf_ids)
-BTF_ID(struct, path)
+BTF_ID_LIST_SINGLE(bpf_d_path_btf_ids, struct, path)
static const struct bpf_func_proto bpf_d_path_proto = {
.func = bpf_d_path,
.gpl_only = false,
.ret_type = RET_INTEGER,
.arg1_type = ARG_PTR_TO_BTF_ID,
+ .arg1_btf_id = &bpf_d_path_btf_ids[0],
.arg2_type = ARG_PTR_TO_MEM,
.arg3_type = ARG_CONST_SIZE_OR_ZERO,
- .btf_id = bpf_d_path_btf_ids,
.allowed = bpf_d_path_allowed,
};
diff --git a/net/core/bpf_sk_storage.c b/net/core/bpf_sk_storage.c
index 4a86ea34f29e..d653a583dbc9 100644
--- a/net/core/bpf_sk_storage.c
+++ b/net/core/bpf_sk_storage.c
@@ -378,19 +378,15 @@ const struct bpf_func_proto bpf_sk_storage_delete_proto = {
.arg2_type = ARG_PTR_TO_SOCKET,
};
-BTF_ID_LIST(sk_storage_btf_ids)
-BTF_ID_UNUSED
-BTF_ID(struct, sock)
-
const struct bpf_func_proto sk_storage_get_btf_proto = {
.func = bpf_sk_storage_get,
.gpl_only = false,
.ret_type = RET_PTR_TO_MAP_VALUE_OR_NULL,
.arg1_type = ARG_CONST_MAP_PTR,
.arg2_type = ARG_PTR_TO_BTF_ID,
+ .arg2_btf_id = &btf_sock_ids[BTF_SOCK_TYPE_SOCK],
.arg3_type = ARG_PTR_TO_MAP_VALUE_OR_NULL,
.arg4_type = ARG_ANYTHING,
- .btf_id = sk_storage_btf_ids,
};
const struct bpf_func_proto sk_storage_delete_btf_proto = {
@@ -399,7 +395,7 @@ const struct bpf_func_proto sk_storage_delete_btf_proto = {
.ret_type = RET_INTEGER,
.arg1_type = ARG_CONST_MAP_PTR,
.arg2_type = ARG_PTR_TO_BTF_ID,
- .btf_id = sk_storage_btf_ids,
+ .arg2_btf_id = &btf_sock_ids[BTF_SOCK_TYPE_SOCK],
};
struct bpf_sk_storage_diag {
diff --git a/net/core/filter.c b/net/core/filter.c
index d266c6941967..6014e5f40c58 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -3803,19 +3803,18 @@ static const struct bpf_func_proto bpf_skb_event_output_proto = {
.arg5_type = ARG_CONST_SIZE_OR_ZERO,
};
-BTF_ID_LIST(bpf_skb_output_btf_ids)
-BTF_ID(struct, sk_buff)
+BTF_ID_LIST_SINGLE(bpf_skb_output_btf_ids, struct, sk_buff)
const struct bpf_func_proto bpf_skb_output_proto = {
.func = bpf_skb_event_output,
.gpl_only = true,
.ret_type = RET_INTEGER,
.arg1_type = ARG_PTR_TO_BTF_ID,
+ .arg1_btf_id = &bpf_skb_output_btf_ids[0],
.arg2_type = ARG_CONST_MAP_PTR,
.arg3_type = ARG_ANYTHING,
.arg4_type = ARG_PTR_TO_MEM,
.arg5_type = ARG_CONST_SIZE_OR_ZERO,
- .btf_id = bpf_skb_output_btf_ids,
};
static unsigned short bpf_tunnel_key_af(u64 flags)
@@ -4199,19 +4198,18 @@ static const struct bpf_func_proto bpf_xdp_event_output_proto = {
.arg5_type = ARG_CONST_SIZE_OR_ZERO,
};
-BTF_ID_LIST(bpf_xdp_output_btf_ids)
-BTF_ID(struct, xdp_buff)
+BTF_ID_LIST_SINGLE(bpf_xdp_output_btf_ids, struct, xdp_buff)
const struct bpf_func_proto bpf_xdp_output_proto = {
.func = bpf_xdp_event_output,
.gpl_only = true,
.ret_type = RET_INTEGER,
.arg1_type = ARG_PTR_TO_BTF_ID,
+ .arg1_btf_id = &bpf_xdp_output_btf_ids[0],
.arg2_type = ARG_CONST_MAP_PTR,
.arg3_type = ARG_ANYTHING,
.arg4_type = ARG_PTR_TO_MEM,
.arg5_type = ARG_CONST_SIZE_OR_ZERO,
- .btf_id = bpf_xdp_output_btf_ids,
};
BPF_CALL_1(bpf_get_socket_cookie, struct sk_buff *, skb)
@@ -9897,17 +9895,6 @@ BTF_SOCK_TYPE_xxx
u32 btf_sock_ids[MAX_BTF_SOCK_TYPE];
#endif
-static bool check_arg_btf_id(u32 btf_id, u32 arg)
-{
- int i;
-
- /* only one argument, no need to check arg */
- for (i = 0; i < MAX_BTF_SOCK_TYPE; i++)
- if (btf_sock_ids[i] == btf_id)
- return true;
- return false;
-}
-
BPF_CALL_1(bpf_skc_to_tcp6_sock, struct sock *, sk)
{
/* tcp6_sock type is not generated in dwarf and hence btf,
@@ -9926,7 +9913,7 @@ const struct bpf_func_proto bpf_skc_to_tcp6_sock_proto = {
.gpl_only = false,
.ret_type = RET_PTR_TO_BTF_ID_OR_NULL,
.arg1_type = ARG_PTR_TO_BTF_ID,
- .check_btf_id = check_arg_btf_id,
+ .arg1_btf_id = &btf_sock_ids[BTF_SOCK_TYPE_SOCK_COMMON],
.ret_btf_id = &btf_sock_ids[BTF_SOCK_TYPE_TCP6],
};
@@ -9943,7 +9930,7 @@ const struct bpf_func_proto bpf_skc_to_tcp_sock_proto = {
.gpl_only = false,
.ret_type = RET_PTR_TO_BTF_ID_OR_NULL,
.arg1_type = ARG_PTR_TO_BTF_ID,
- .check_btf_id = check_arg_btf_id,
+ .arg1_btf_id = &btf_sock_ids[BTF_SOCK_TYPE_SOCK_COMMON],
.ret_btf_id = &btf_sock_ids[BTF_SOCK_TYPE_TCP],
};
@@ -9967,7 +9954,7 @@ const struct bpf_func_proto bpf_skc_to_tcp_timewait_sock_proto = {
.gpl_only = false,
.ret_type = RET_PTR_TO_BTF_ID_OR_NULL,
.arg1_type = ARG_PTR_TO_BTF_ID,
- .check_btf_id = check_arg_btf_id,
+ .arg1_btf_id = &btf_sock_ids[BTF_SOCK_TYPE_SOCK_COMMON],
.ret_btf_id = &btf_sock_ids[BTF_SOCK_TYPE_TCP_TW],
};
@@ -9991,7 +9978,7 @@ const struct bpf_func_proto bpf_skc_to_tcp_request_sock_proto = {
.gpl_only = false,
.ret_type = RET_PTR_TO_BTF_ID_OR_NULL,
.arg1_type = ARG_PTR_TO_BTF_ID,
- .check_btf_id = check_arg_btf_id,
+ .arg1_btf_id = &btf_sock_ids[BTF_SOCK_TYPE_SOCK_COMMON],
.ret_btf_id = &btf_sock_ids[BTF_SOCK_TYPE_TCP_REQ],
};
@@ -10013,6 +10000,6 @@ const struct bpf_func_proto bpf_skc_to_udp6_sock_proto = {
.gpl_only = false,
.ret_type = RET_PTR_TO_BTF_ID_OR_NULL,
.arg1_type = ARG_PTR_TO_BTF_ID,
- .check_btf_id = check_arg_btf_id,
+ .arg1_btf_id = &btf_sock_ids[BTF_SOCK_TYPE_SOCK_COMMON],
.ret_btf_id = &btf_sock_ids[BTF_SOCK_TYPE_UDP6],
};
diff --git a/net/ipv4/bpf_tcp_ca.c b/net/ipv4/bpf_tcp_ca.c
index e3939f76b024..74a2ef598c31 100644
--- a/net/ipv4/bpf_tcp_ca.c
+++ b/net/ipv4/bpf_tcp_ca.c
@@ -28,23 +28,18 @@ static u32 unsupported_ops[] = {
static const struct btf_type *tcp_sock_type;
static u32 tcp_sock_id, sock_id;
-static int btf_sk_storage_get_ids[5];
static struct bpf_func_proto btf_sk_storage_get_proto __read_mostly;
-
-static int btf_sk_storage_delete_ids[5];
static struct bpf_func_proto btf_sk_storage_delete_proto __read_mostly;
-static void convert_sk_func_proto(struct bpf_func_proto *to, int *to_btf_ids,
- const struct bpf_func_proto *from)
+static void convert_sk_func_proto(struct bpf_func_proto *to, const struct bpf_func_proto *from)
{
int i;
*to = *from;
- to->btf_id = to_btf_ids;
for (i = 0; i < ARRAY_SIZE(to->arg_type); i++) {
if (to->arg_type[i] == ARG_PTR_TO_SOCKET) {
to->arg_type[i] = ARG_PTR_TO_BTF_ID;
- to->btf_id[i] = tcp_sock_id;
+ to->arg_btf_id[i] = &tcp_sock_id;
}
}
}
@@ -64,12 +59,8 @@ static int bpf_tcp_ca_init(struct btf *btf)
tcp_sock_id = type_id;
tcp_sock_type = btf_type_by_id(btf, tcp_sock_id);
- convert_sk_func_proto(&btf_sk_storage_get_proto,
- btf_sk_storage_get_ids,
- &bpf_sk_storage_get_proto);
- convert_sk_func_proto(&btf_sk_storage_delete_proto,
- btf_sk_storage_delete_ids,
- &bpf_sk_storage_delete_proto);
+ convert_sk_func_proto(&btf_sk_storage_get_proto, &bpf_sk_storage_get_proto);
+ convert_sk_func_proto(&btf_sk_storage_delete_proto, &bpf_sk_storage_delete_proto);
return 0;
}
@@ -185,8 +176,8 @@ static const struct bpf_func_proto bpf_tcp_send_ack_proto = {
/* In case we want to report error later */
.ret_type = RET_INTEGER,
.arg1_type = ARG_PTR_TO_BTF_ID,
+ .arg1_btf_id = &tcp_sock_id,
.arg2_type = ARG_ANYTHING,
- .btf_id = &tcp_sock_id,
};
static const struct bpf_func_proto *
--
2.25.1
^ permalink raw reply related [flat|nested] 18+ messages in thread* [PATCH bpf-next v4 05/11] bpf: make BTF pointer type checking generic
2020-09-21 12:12 [PATCH RESEND bpf-next v4 00/11] Make check_func_arg type checks table driven Lorenz Bauer
` (3 preceding siblings ...)
2020-09-21 12:12 ` [PATCH bpf-next v4 04/11] bpf: allow specifying a BTF ID per argument in function protos Lorenz Bauer
@ 2020-09-21 12:12 ` Lorenz Bauer
2020-09-21 12:12 ` [PATCH bpf-next v4 06/11] bpf: make reference tracking generic Lorenz Bauer
` (5 subsequent siblings)
10 siblings, 0 replies; 18+ messages in thread
From: Lorenz Bauer @ 2020-09-21 12:12 UTC (permalink / raw)
To: ast, daniel; +Cc: bpf, netdev, Lorenz Bauer, Martin KaFai Lau
Perform BTF type checks if the register we're working on contains a BTF
pointer, rather than if the argument is for a BTF pointer. This is easier
to understand, and allows removing the code from the arg_type checking
section of the function.
Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
Acked-by: Martin KaFai Lau <kafai@fb.com>
---
kernel/bpf/verifier.c | 38 ++++++++++++++++++++------------------
1 file changed, 20 insertions(+), 18 deletions(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 9f95d6d55c5f..99c0d7adcb1e 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -4001,27 +4001,9 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
goto err_type;
}
} else if (arg_type == ARG_PTR_TO_BTF_ID) {
- const u32 *btf_id = fn->arg_btf_id[arg];
-
expected_type = PTR_TO_BTF_ID;
if (type != expected_type)
goto err_type;
-
- if (!btf_id) {
- verbose(env, "verifier internal error: missing BTF ID\n");
- return -EFAULT;
- }
-
- if (!btf_struct_ids_match(&env->log, reg->off, reg->btf_id, *btf_id)) {
- verbose(env, "R%d is of type %s but %s is expected\n",
- regno, kernel_type_name(reg->btf_id), kernel_type_name(*btf_id));
- return -EACCES;
- }
- if (!tnum_is_const(reg->var_off) || reg->var_off.value) {
- verbose(env, "R%d is a pointer to in-kernel struct with non-zero offset\n",
- regno);
- return -EACCES;
- }
} else if (arg_type == ARG_PTR_TO_SPIN_LOCK) {
if (meta->func_id == BPF_FUNC_spin_lock) {
if (process_spin_lock(env, regno, true))
@@ -4076,6 +4058,26 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
return -EFAULT;
}
+ if (type == PTR_TO_BTF_ID) {
+ const u32 *btf_id = fn->arg_btf_id[arg];
+
+ if (!btf_id) {
+ verbose(env, "verifier internal error: missing BTF ID\n");
+ return -EFAULT;
+ }
+
+ if (!btf_struct_ids_match(&env->log, reg->off, reg->btf_id, *btf_id)) {
+ verbose(env, "R%d is of type %s but %s is expected\n",
+ regno, kernel_type_name(reg->btf_id), kernel_type_name(*btf_id));
+ return -EACCES;
+ }
+ if (!tnum_is_const(reg->var_off) || reg->var_off.value) {
+ verbose(env, "R%d is a pointer to in-kernel struct with non-zero offset\n",
+ regno);
+ return -EACCES;
+ }
+ }
+
if (arg_type == ARG_CONST_MAP_PTR) {
/* bpf_map_xxx(map_ptr) call: remember that map_ptr */
meta->map_ptr = reg->map_ptr;
--
2.25.1
^ permalink raw reply related [flat|nested] 18+ messages in thread* [PATCH bpf-next v4 06/11] bpf: make reference tracking generic
2020-09-21 12:12 [PATCH RESEND bpf-next v4 00/11] Make check_func_arg type checks table driven Lorenz Bauer
` (4 preceding siblings ...)
2020-09-21 12:12 ` [PATCH bpf-next v4 05/11] bpf: make BTF pointer type checking generic Lorenz Bauer
@ 2020-09-21 12:12 ` Lorenz Bauer
2020-09-21 12:12 ` [PATCH bpf-next v4 07/11] bpf: make context access check generic Lorenz Bauer
` (4 subsequent siblings)
10 siblings, 0 replies; 18+ messages in thread
From: Lorenz Bauer @ 2020-09-21 12:12 UTC (permalink / raw)
To: ast, daniel; +Cc: bpf, netdev, Lorenz Bauer, Andrii Nakryiko, Martin KaFai Lau
Instead of dealing with reg->ref_obj_id individually for every arg type that
needs it, rely on the fact that ref_obj_id is zero if the register is not
reference tracked.
Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
Acked-by: Andrii Nakryiko <andriin@fb.com>
Acked-by: Martin KaFai Lau <kafai@fb.com>
---
kernel/bpf/verifier.c | 26 ++++++++++----------------
1 file changed, 10 insertions(+), 16 deletions(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 99c0d7adcb1e..0f7a9c65db5c 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -3983,15 +3983,6 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
/* Any sk pointer can be ARG_PTR_TO_SOCK_COMMON */
if (!type_is_sk_pointer(type))
goto err_type;
- if (reg->ref_obj_id) {
- if (meta->ref_obj_id) {
- verbose(env, "verifier internal error: more than one arg with ref_obj_id R%d %u %u\n",
- regno, reg->ref_obj_id,
- meta->ref_obj_id);
- return -EFAULT;
- }
- meta->ref_obj_id = reg->ref_obj_id;
- }
} else if (arg_type == ARG_PTR_TO_SOCKET ||
arg_type == ARG_PTR_TO_SOCKET_OR_NULL) {
expected_type = PTR_TO_SOCKET;
@@ -4040,13 +4031,6 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
/* final test in check_stack_boundary() */;
else if (type != expected_type)
goto err_type;
- if (meta->ref_obj_id) {
- verbose(env, "verifier internal error: more than one arg with ref_obj_id R%d %u %u\n",
- regno, reg->ref_obj_id,
- meta->ref_obj_id);
- return -EFAULT;
- }
- meta->ref_obj_id = reg->ref_obj_id;
} else if (arg_type_is_int_ptr(arg_type)) {
expected_type = PTR_TO_STACK;
if (!type_is_pkt_pointer(type) &&
@@ -4078,6 +4062,16 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
}
}
+ if (reg->ref_obj_id) {
+ if (meta->ref_obj_id) {
+ verbose(env, "verifier internal error: more than one arg with ref_obj_id R%d %u %u\n",
+ regno, reg->ref_obj_id,
+ meta->ref_obj_id);
+ return -EFAULT;
+ }
+ meta->ref_obj_id = reg->ref_obj_id;
+ }
+
if (arg_type == ARG_CONST_MAP_PTR) {
/* bpf_map_xxx(map_ptr) call: remember that map_ptr */
meta->map_ptr = reg->map_ptr;
--
2.25.1
^ permalink raw reply related [flat|nested] 18+ messages in thread* [PATCH bpf-next v4 07/11] bpf: make context access check generic
2020-09-21 12:12 [PATCH RESEND bpf-next v4 00/11] Make check_func_arg type checks table driven Lorenz Bauer
` (5 preceding siblings ...)
2020-09-21 12:12 ` [PATCH bpf-next v4 06/11] bpf: make reference tracking generic Lorenz Bauer
@ 2020-09-21 12:12 ` Lorenz Bauer
2020-09-21 12:12 ` [PATCH bpf-next v4 08/11] bpf: set meta->raw_mode for pointers close to use Lorenz Bauer
` (3 subsequent siblings)
10 siblings, 0 replies; 18+ messages in thread
From: Lorenz Bauer @ 2020-09-21 12:12 UTC (permalink / raw)
To: ast, daniel; +Cc: bpf, netdev, Lorenz Bauer, Martin KaFai Lau
Always check context access if the register we're operating on is
PTR_TO_CTX, rather than relying on ARG_PTR_TO_CTX. This allows
simplifying the arg_type checking section of the function.
Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
Acked-by: Martin KaFai Lau <kafai@fb.com>
---
kernel/bpf/verifier.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 0f7a9c65db5c..7d0f9ba18916 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -3974,9 +3974,6 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
arg_type == ARG_PTR_TO_CTX_OR_NULL)) {
if (type != expected_type)
goto err_type;
- err = check_ctx_reg(env, reg, regno);
- if (err < 0)
- return err;
}
} else if (arg_type == ARG_PTR_TO_SOCK_COMMON) {
expected_type = PTR_TO_SOCK_COMMON;
@@ -4060,6 +4057,10 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
regno);
return -EACCES;
}
+ } else if (type == PTR_TO_CTX) {
+ err = check_ctx_reg(env, reg, regno);
+ if (err < 0)
+ return err;
}
if (reg->ref_obj_id) {
--
2.25.1
^ permalink raw reply related [flat|nested] 18+ messages in thread* [PATCH bpf-next v4 08/11] bpf: set meta->raw_mode for pointers close to use
2020-09-21 12:12 [PATCH RESEND bpf-next v4 00/11] Make check_func_arg type checks table driven Lorenz Bauer
` (6 preceding siblings ...)
2020-09-21 12:12 ` [PATCH bpf-next v4 07/11] bpf: make context access check generic Lorenz Bauer
@ 2020-09-21 12:12 ` Lorenz Bauer
2020-09-21 12:12 ` [PATCH bpf-next v4 09/11] bpf: check ARG_PTR_TO_SPINLOCK register type in check_func_arg Lorenz Bauer
` (2 subsequent siblings)
10 siblings, 0 replies; 18+ messages in thread
From: Lorenz Bauer @ 2020-09-21 12:12 UTC (permalink / raw)
To: ast, daniel; +Cc: bpf, netdev, Lorenz Bauer, Martin KaFai Lau
If we encounter a pointer to memory, we set meta->raw_mode depending
on the type of memory we point at. What isn't obvious is that this
information is only used when the next memory size argument is
encountered.
Move the assignment closer to where it's used, and add a comment that
explains what is going on.
Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
Acked-by: Martin KaFai Lau <kafai@fb.com>
---
kernel/bpf/verifier.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 7d0f9ba18916..e09eedb30117 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -4020,7 +4020,6 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
type != PTR_TO_RDWR_BUF &&
type != expected_type)
goto err_type;
- meta->raw_mode = arg_type == ARG_PTR_TO_UNINIT_MEM;
} else if (arg_type_is_alloc_mem_ptr(arg_type)) {
expected_type = PTR_TO_MEM;
if (register_is_null(reg) &&
@@ -4109,6 +4108,11 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
err = check_helper_mem_access(env, regno,
meta->map_ptr->value_size, false,
meta);
+ } else if (arg_type_is_mem_ptr(arg_type)) {
+ /* The access to this pointer is only checked when we hit the
+ * next is_mem_size argument below.
+ */
+ meta->raw_mode = (arg_type == ARG_PTR_TO_UNINIT_MEM);
} else if (arg_type_is_mem_size(arg_type)) {
bool zero_size_allowed = (arg_type == ARG_CONST_SIZE_OR_ZERO);
--
2.25.1
^ permalink raw reply related [flat|nested] 18+ messages in thread* [PATCH bpf-next v4 09/11] bpf: check ARG_PTR_TO_SPINLOCK register type in check_func_arg
2020-09-21 12:12 [PATCH RESEND bpf-next v4 00/11] Make check_func_arg type checks table driven Lorenz Bauer
` (7 preceding siblings ...)
2020-09-21 12:12 ` [PATCH bpf-next v4 08/11] bpf: set meta->raw_mode for pointers close to use Lorenz Bauer
@ 2020-09-21 12:12 ` Lorenz Bauer
2020-09-21 12:12 ` [PATCH bpf-next v4 10/11] bpf: hoist type checking for nullable arg types Lorenz Bauer
2020-09-21 12:12 ` [PATCH bpf-next v4 11/11] bpf: use a table to drive helper arg type checks Lorenz Bauer
10 siblings, 0 replies; 18+ messages in thread
From: Lorenz Bauer @ 2020-09-21 12:12 UTC (permalink / raw)
To: ast, daniel; +Cc: bpf, netdev, Lorenz Bauer, Martin KaFai Lau
Move the check for PTR_TO_MAP_VALUE to check_func_arg, where all other
checking is done as well. Move the invocation of process_spin_lock away
from the register type checking, to allow a future refactoring.
Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
Acked-by: Martin KaFai Lau <kafai@fb.com>
---
kernel/bpf/verifier.c | 28 ++++++++++++++--------------
1 file changed, 14 insertions(+), 14 deletions(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index e09eedb30117..eefc8256df1c 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -3781,10 +3781,6 @@ static int process_spin_lock(struct bpf_verifier_env *env, int regno,
struct bpf_map *map = reg->map_ptr;
u64 val = reg->var_off.value;
- if (reg->type != PTR_TO_MAP_VALUE) {
- verbose(env, "R%d is not a pointer to map_value\n", regno);
- return -EINVAL;
- }
if (!is_const) {
verbose(env,
"R%d doesn't have constant offset. bpf_spin_lock has to be at the constant offset\n",
@@ -3993,16 +3989,9 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
if (type != expected_type)
goto err_type;
} else if (arg_type == ARG_PTR_TO_SPIN_LOCK) {
- if (meta->func_id == BPF_FUNC_spin_lock) {
- if (process_spin_lock(env, regno, true))
- return -EACCES;
- } else if (meta->func_id == BPF_FUNC_spin_unlock) {
- if (process_spin_lock(env, regno, false))
- return -EACCES;
- } else {
- verbose(env, "verifier internal error\n");
- return -EFAULT;
- }
+ expected_type = PTR_TO_MAP_VALUE;
+ if (type != expected_type)
+ goto err_type;
} else if (arg_type_is_mem_ptr(arg_type)) {
expected_type = PTR_TO_STACK;
/* One exception here. In case function allows for NULL to be
@@ -4108,6 +4097,17 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
err = check_helper_mem_access(env, regno,
meta->map_ptr->value_size, false,
meta);
+ } else if (arg_type == ARG_PTR_TO_SPIN_LOCK) {
+ if (meta->func_id == BPF_FUNC_spin_lock) {
+ if (process_spin_lock(env, regno, true))
+ return -EACCES;
+ } else if (meta->func_id == BPF_FUNC_spin_unlock) {
+ if (process_spin_lock(env, regno, false))
+ return -EACCES;
+ } else {
+ verbose(env, "verifier internal error\n");
+ return -EFAULT;
+ }
} else if (arg_type_is_mem_ptr(arg_type)) {
/* The access to this pointer is only checked when we hit the
* next is_mem_size argument below.
--
2.25.1
^ permalink raw reply related [flat|nested] 18+ messages in thread* [PATCH bpf-next v4 10/11] bpf: hoist type checking for nullable arg types
2020-09-21 12:12 [PATCH RESEND bpf-next v4 00/11] Make check_func_arg type checks table driven Lorenz Bauer
` (8 preceding siblings ...)
2020-09-21 12:12 ` [PATCH bpf-next v4 09/11] bpf: check ARG_PTR_TO_SPINLOCK register type in check_func_arg Lorenz Bauer
@ 2020-09-21 12:12 ` Lorenz Bauer
2020-09-21 12:12 ` [PATCH bpf-next v4 11/11] bpf: use a table to drive helper arg type checks Lorenz Bauer
10 siblings, 0 replies; 18+ messages in thread
From: Lorenz Bauer @ 2020-09-21 12:12 UTC (permalink / raw)
To: ast, daniel; +Cc: bpf, netdev, Lorenz Bauer, Andrii Nakryiko, Martin KaFai Lau
check_func_arg has a plethora of weird if statements with empty branches.
They work around the fact that *_OR_NULL argument types should accept a
SCALAR_VALUE register, as long as it's value is 0. These statements make
it difficult to reason about the type checking logic.
Instead, skip more detailed type checking logic iff the register is 0,
and the function expects a nullable type. This allows simplifying the type
checking itself.
Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
Acked-by: Andrii Nakryiko <andriin@fb.com>
Acked-by: Martin KaFai Lau <kafai@fb.com>
---
kernel/bpf/verifier.c | 64 ++++++++++++++++++++-----------------------
1 file changed, 30 insertions(+), 34 deletions(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index eefc8256df1c..d64ac79982ad 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -435,6 +435,15 @@ static bool arg_type_may_be_refcounted(enum bpf_arg_type type)
return type == ARG_PTR_TO_SOCK_COMMON;
}
+static bool arg_type_may_be_null(enum bpf_arg_type type)
+{
+ return type == ARG_PTR_TO_MAP_VALUE_OR_NULL ||
+ type == ARG_PTR_TO_MEM_OR_NULL ||
+ type == ARG_PTR_TO_CTX_OR_NULL ||
+ type == ARG_PTR_TO_SOCKET_OR_NULL ||
+ type == ARG_PTR_TO_ALLOC_MEM_OR_NULL;
+}
+
/* Determine whether the function releases some resources allocated by another
* function call. The first reference type argument will be assumed to be
* released by release_reference().
@@ -3941,17 +3950,20 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
return err;
}
+ if (register_is_null(reg) && arg_type_may_be_null(arg_type))
+ /* A NULL register has a SCALAR_VALUE type, so skip
+ * type checking.
+ */
+ goto skip_type_check;
+
if (arg_type == ARG_PTR_TO_MAP_KEY ||
arg_type == ARG_PTR_TO_MAP_VALUE ||
arg_type == ARG_PTR_TO_UNINIT_MAP_VALUE ||
arg_type == ARG_PTR_TO_MAP_VALUE_OR_NULL) {
expected_type = PTR_TO_STACK;
- if (register_is_null(reg) &&
- arg_type == ARG_PTR_TO_MAP_VALUE_OR_NULL)
- /* final test in check_stack_boundary() */;
- else if (!type_is_pkt_pointer(type) &&
- type != PTR_TO_MAP_VALUE &&
- type != expected_type)
+ if (!type_is_pkt_pointer(type) &&
+ type != PTR_TO_MAP_VALUE &&
+ type != expected_type)
goto err_type;
} else if (arg_type == ARG_CONST_SIZE ||
arg_type == ARG_CONST_SIZE_OR_ZERO ||
@@ -3966,11 +3978,8 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
} else if (arg_type == ARG_PTR_TO_CTX ||
arg_type == ARG_PTR_TO_CTX_OR_NULL) {
expected_type = PTR_TO_CTX;
- if (!(register_is_null(reg) &&
- arg_type == ARG_PTR_TO_CTX_OR_NULL)) {
- if (type != expected_type)
- goto err_type;
- }
+ if (type != expected_type)
+ goto err_type;
} else if (arg_type == ARG_PTR_TO_SOCK_COMMON) {
expected_type = PTR_TO_SOCK_COMMON;
/* Any sk pointer can be ARG_PTR_TO_SOCK_COMMON */
@@ -3979,11 +3988,8 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
} else if (arg_type == ARG_PTR_TO_SOCKET ||
arg_type == ARG_PTR_TO_SOCKET_OR_NULL) {
expected_type = PTR_TO_SOCKET;
- if (!(register_is_null(reg) &&
- arg_type == ARG_PTR_TO_SOCKET_OR_NULL)) {
- if (type != expected_type)
- goto err_type;
- }
+ if (type != expected_type)
+ goto err_type;
} else if (arg_type == ARG_PTR_TO_BTF_ID) {
expected_type = PTR_TO_BTF_ID;
if (type != expected_type)
@@ -3994,27 +4000,16 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
goto err_type;
} else if (arg_type_is_mem_ptr(arg_type)) {
expected_type = PTR_TO_STACK;
- /* One exception here. In case function allows for NULL to be
- * passed in as argument, it's a SCALAR_VALUE type. Final test
- * happens during stack boundary checking.
- */
- if (register_is_null(reg) &&
- (arg_type == ARG_PTR_TO_MEM_OR_NULL ||
- arg_type == ARG_PTR_TO_ALLOC_MEM_OR_NULL))
- /* final test in check_stack_boundary() */;
- else if (!type_is_pkt_pointer(type) &&
- type != PTR_TO_MAP_VALUE &&
- type != PTR_TO_MEM &&
- type != PTR_TO_RDONLY_BUF &&
- type != PTR_TO_RDWR_BUF &&
- type != expected_type)
+ if (!type_is_pkt_pointer(type) &&
+ type != PTR_TO_MAP_VALUE &&
+ type != PTR_TO_MEM &&
+ type != PTR_TO_RDONLY_BUF &&
+ type != PTR_TO_RDWR_BUF &&
+ type != expected_type)
goto err_type;
} else if (arg_type_is_alloc_mem_ptr(arg_type)) {
expected_type = PTR_TO_MEM;
- if (register_is_null(reg) &&
- arg_type == ARG_PTR_TO_ALLOC_MEM_OR_NULL)
- /* final test in check_stack_boundary() */;
- else if (type != expected_type)
+ if (type != expected_type)
goto err_type;
} else if (arg_type_is_int_ptr(arg_type)) {
expected_type = PTR_TO_STACK;
@@ -4051,6 +4046,7 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
return err;
}
+skip_type_check:
if (reg->ref_obj_id) {
if (meta->ref_obj_id) {
verbose(env, "verifier internal error: more than one arg with ref_obj_id R%d %u %u\n",
--
2.25.1
^ permalink raw reply related [flat|nested] 18+ messages in thread* [PATCH bpf-next v4 11/11] bpf: use a table to drive helper arg type checks
2020-09-21 12:12 [PATCH RESEND bpf-next v4 00/11] Make check_func_arg type checks table driven Lorenz Bauer
` (9 preceding siblings ...)
2020-09-21 12:12 ` [PATCH bpf-next v4 10/11] bpf: hoist type checking for nullable arg types Lorenz Bauer
@ 2020-09-21 12:12 ` Lorenz Bauer
2020-09-21 22:23 ` Alexei Starovoitov
10 siblings, 1 reply; 18+ messages in thread
From: Lorenz Bauer @ 2020-09-21 12:12 UTC (permalink / raw)
To: ast, daniel; +Cc: bpf, netdev, Lorenz Bauer, Martin KaFai Lau
The mapping between bpf_arg_type and bpf_reg_type is encoded in a big
hairy if statement that is hard to follow. The debug output also leaves
to be desired: if a reg_type doesn't match we only print one of the
options, instead printing all the valid ones.
Convert the if statement into a table which is then used to drive type
checking. If none of the reg_types match we print all options, e.g.:
R2 type=rdonly_buf expected=fp, pkt, pkt_meta, map_value
Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
Acked-by: Martin KaFai Lau <kafai@fb.com>
---
include/linux/bpf.h | 1 +
kernel/bpf/verifier.c | 183 +++++++++++++++++++++++++-----------------
2 files changed, 110 insertions(+), 74 deletions(-)
diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 732e2f144b6d..4ca817a9195c 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -292,6 +292,7 @@ enum bpf_arg_type {
ARG_PTR_TO_ALLOC_MEM, /* pointer to dynamically allocated memory */
ARG_PTR_TO_ALLOC_MEM_OR_NULL, /* pointer to dynamically allocated memory or NULL */
ARG_CONST_ALLOC_SIZE_OR_ZERO, /* number of allocated bytes requested */
+ __BPF_ARG_TYPE_MAX,
};
/* type of values returned from helper functions */
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index d64ac79982ad..b5c00d08f9c0 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -3856,12 +3856,6 @@ static bool arg_type_is_mem_size(enum bpf_arg_type type)
type == ARG_CONST_SIZE_OR_ZERO;
}
-static bool arg_type_is_alloc_mem_ptr(enum bpf_arg_type type)
-{
- return type == ARG_PTR_TO_ALLOC_MEM ||
- type == ARG_PTR_TO_ALLOC_MEM_OR_NULL;
-}
-
static bool arg_type_is_alloc_size(enum bpf_arg_type type)
{
return type == ARG_CONST_ALLOC_SIZE_OR_ZERO;
@@ -3910,14 +3904,115 @@ static int resolve_map_arg_type(struct bpf_verifier_env *env,
return 0;
}
+struct bpf_reg_types {
+ const enum bpf_reg_type types[10];
+};
+
+static const struct bpf_reg_types map_key_value_types = {
+ .types = {
+ PTR_TO_STACK,
+ PTR_TO_PACKET,
+ PTR_TO_PACKET_META,
+ PTR_TO_MAP_VALUE,
+ },
+};
+
+static const struct bpf_reg_types sock_types = {
+ .types = {
+ PTR_TO_SOCK_COMMON,
+ PTR_TO_SOCKET,
+ PTR_TO_TCP_SOCK,
+ PTR_TO_XDP_SOCK,
+ },
+};
+
+static const struct bpf_reg_types mem_types = {
+ .types = {
+ PTR_TO_STACK,
+ PTR_TO_PACKET,
+ PTR_TO_PACKET_META,
+ PTR_TO_MAP_VALUE,
+ PTR_TO_MEM,
+ PTR_TO_RDONLY_BUF,
+ PTR_TO_RDWR_BUF,
+ },
+};
+
+static const struct bpf_reg_types int_ptr_types = {
+ .types = {
+ PTR_TO_STACK,
+ PTR_TO_PACKET,
+ PTR_TO_PACKET_META,
+ PTR_TO_MAP_VALUE,
+ },
+};
+
+static const struct bpf_reg_types fullsock_types = { .types = { PTR_TO_SOCKET } };
+static const struct bpf_reg_types scalar_types = { .types = { SCALAR_VALUE } };
+static const struct bpf_reg_types context_types = { .types = { PTR_TO_CTX } };
+static const struct bpf_reg_types alloc_mem_types = { .types = { PTR_TO_MEM } };
+static const struct bpf_reg_types const_map_ptr_types = { .types = { CONST_PTR_TO_MAP } };
+static const struct bpf_reg_types btf_ptr_types = { .types = { PTR_TO_BTF_ID } };
+static const struct bpf_reg_types spin_lock_types = { .types = { PTR_TO_MAP_VALUE } };
+
+static const struct bpf_reg_types *compatible_reg_types[] = {
+ [ARG_PTR_TO_MAP_KEY] = &map_key_value_types,
+ [ARG_PTR_TO_MAP_VALUE] = &map_key_value_types,
+ [ARG_PTR_TO_UNINIT_MAP_VALUE] = &map_key_value_types,
+ [ARG_PTR_TO_MAP_VALUE_OR_NULL] = &map_key_value_types,
+ [ARG_CONST_SIZE] = &scalar_types,
+ [ARG_CONST_SIZE_OR_ZERO] = &scalar_types,
+ [ARG_CONST_ALLOC_SIZE_OR_ZERO] = &scalar_types,
+ [ARG_CONST_MAP_PTR] = &const_map_ptr_types,
+ [ARG_PTR_TO_CTX] = &context_types,
+ [ARG_PTR_TO_CTX_OR_NULL] = &context_types,
+ [ARG_PTR_TO_SOCK_COMMON] = &sock_types,
+ [ARG_PTR_TO_SOCKET] = &fullsock_types,
+ [ARG_PTR_TO_SOCKET_OR_NULL] = &fullsock_types,
+ [ARG_PTR_TO_BTF_ID] = &btf_ptr_types,
+ [ARG_PTR_TO_SPIN_LOCK] = &spin_lock_types,
+ [ARG_PTR_TO_MEM] = &mem_types,
+ [ARG_PTR_TO_MEM_OR_NULL] = &mem_types,
+ [ARG_PTR_TO_UNINIT_MEM] = &mem_types,
+ [ARG_PTR_TO_ALLOC_MEM] = &alloc_mem_types,
+ [ARG_PTR_TO_ALLOC_MEM_OR_NULL] = &alloc_mem_types,
+ [ARG_PTR_TO_INT] = &int_ptr_types,
+ [ARG_PTR_TO_LONG] = &int_ptr_types,
+ [__BPF_ARG_TYPE_MAX] = NULL,
+};
+
+static int check_reg_type(struct bpf_verifier_env *env, u32 regno,
+ const struct bpf_reg_types *compatible)
+{
+ struct bpf_reg_state *regs = cur_regs(env), *reg = ®s[regno];
+ enum bpf_reg_type expected, type = reg->type;
+ int i, j;
+
+ for (i = 0; i < ARRAY_SIZE(compatible->types); i++) {
+ expected = compatible->types[i];
+ if (expected == NOT_INIT)
+ break;
+
+ if (type == expected)
+ return 0;
+ }
+
+ verbose(env, "R%d type=%s expected=", regno, reg_type_str[type]);
+ for (j = 0; j + 1 < i; j++)
+ verbose(env, "%s, ", reg_type_str[compatible->types[j]]);
+ verbose(env, "%s\n", reg_type_str[compatible->types[j]]);
+ return -EACCES;
+}
+
static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
struct bpf_call_arg_meta *meta,
const struct bpf_func_proto *fn)
{
u32 regno = BPF_REG_1 + arg;
struct bpf_reg_state *regs = cur_regs(env), *reg = ®s[regno];
- enum bpf_reg_type expected_type, type = reg->type;
enum bpf_arg_type arg_type = fn->arg_type[arg];
+ const struct bpf_reg_types *compatible;
+ enum bpf_reg_type type = reg->type;
int err = 0;
if (arg_type == ARG_DONTCARE)
@@ -3956,72 +4051,16 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
*/
goto skip_type_check;
- if (arg_type == ARG_PTR_TO_MAP_KEY ||
- arg_type == ARG_PTR_TO_MAP_VALUE ||
- arg_type == ARG_PTR_TO_UNINIT_MAP_VALUE ||
- arg_type == ARG_PTR_TO_MAP_VALUE_OR_NULL) {
- expected_type = PTR_TO_STACK;
- if (!type_is_pkt_pointer(type) &&
- type != PTR_TO_MAP_VALUE &&
- type != expected_type)
- goto err_type;
- } else if (arg_type == ARG_CONST_SIZE ||
- arg_type == ARG_CONST_SIZE_OR_ZERO ||
- arg_type == ARG_CONST_ALLOC_SIZE_OR_ZERO) {
- expected_type = SCALAR_VALUE;
- if (type != expected_type)
- goto err_type;
- } else if (arg_type == ARG_CONST_MAP_PTR) {
- expected_type = CONST_PTR_TO_MAP;
- if (type != expected_type)
- goto err_type;
- } else if (arg_type == ARG_PTR_TO_CTX ||
- arg_type == ARG_PTR_TO_CTX_OR_NULL) {
- expected_type = PTR_TO_CTX;
- if (type != expected_type)
- goto err_type;
- } else if (arg_type == ARG_PTR_TO_SOCK_COMMON) {
- expected_type = PTR_TO_SOCK_COMMON;
- /* Any sk pointer can be ARG_PTR_TO_SOCK_COMMON */
- if (!type_is_sk_pointer(type))
- goto err_type;
- } else if (arg_type == ARG_PTR_TO_SOCKET ||
- arg_type == ARG_PTR_TO_SOCKET_OR_NULL) {
- expected_type = PTR_TO_SOCKET;
- if (type != expected_type)
- goto err_type;
- } else if (arg_type == ARG_PTR_TO_BTF_ID) {
- expected_type = PTR_TO_BTF_ID;
- if (type != expected_type)
- goto err_type;
- } else if (arg_type == ARG_PTR_TO_SPIN_LOCK) {
- expected_type = PTR_TO_MAP_VALUE;
- if (type != expected_type)
- goto err_type;
- } else if (arg_type_is_mem_ptr(arg_type)) {
- expected_type = PTR_TO_STACK;
- if (!type_is_pkt_pointer(type) &&
- type != PTR_TO_MAP_VALUE &&
- type != PTR_TO_MEM &&
- type != PTR_TO_RDONLY_BUF &&
- type != PTR_TO_RDWR_BUF &&
- type != expected_type)
- goto err_type;
- } else if (arg_type_is_alloc_mem_ptr(arg_type)) {
- expected_type = PTR_TO_MEM;
- if (type != expected_type)
- goto err_type;
- } else if (arg_type_is_int_ptr(arg_type)) {
- expected_type = PTR_TO_STACK;
- if (!type_is_pkt_pointer(type) &&
- type != PTR_TO_MAP_VALUE &&
- type != expected_type)
- goto err_type;
- } else {
- verbose(env, "unsupported arg_type %d\n", arg_type);
+ compatible = compatible_reg_types[arg_type];
+ if (!compatible) {
+ verbose(env, "verifier internal error: unsupported arg type %d\n", arg_type);
return -EFAULT;
}
+ err = check_reg_type(env, regno, compatible);
+ if (err)
+ return err;
+
if (type == PTR_TO_BTF_ID) {
const u32 *btf_id = fn->arg_btf_id[arg];
@@ -4174,10 +4213,6 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
}
return err;
-err_type:
- verbose(env, "R%d type=%s expected=%s\n", regno,
- reg_type_str[type], reg_type_str[expected_type]);
- return -EACCES;
}
static bool may_update_sockmap(struct bpf_verifier_env *env, int func_id)
--
2.25.1
^ permalink raw reply related [flat|nested] 18+ messages in thread* Re: [PATCH bpf-next v4 11/11] bpf: use a table to drive helper arg type checks
2020-09-21 12:12 ` [PATCH bpf-next v4 11/11] bpf: use a table to drive helper arg type checks Lorenz Bauer
@ 2020-09-21 22:23 ` Alexei Starovoitov
2020-09-22 8:20 ` Lorenz Bauer
0 siblings, 1 reply; 18+ messages in thread
From: Alexei Starovoitov @ 2020-09-21 22:23 UTC (permalink / raw)
To: Lorenz Bauer; +Cc: ast, daniel, bpf, netdev, Martin KaFai Lau
On Mon, Sep 21, 2020 at 01:12:27PM +0100, Lorenz Bauer wrote:
> +struct bpf_reg_types {
> + const enum bpf_reg_type types[10];
> +};
any idea on how to make it more robust?
> +
> +static const struct bpf_reg_types *compatible_reg_types[] = {
> + [ARG_PTR_TO_MAP_KEY] = &map_key_value_types,
> + [ARG_PTR_TO_MAP_VALUE] = &map_key_value_types,
> + [ARG_PTR_TO_UNINIT_MAP_VALUE] = &map_key_value_types,
> + [ARG_PTR_TO_MAP_VALUE_OR_NULL] = &map_key_value_types,
> + [ARG_CONST_SIZE] = &scalar_types,
> + [ARG_CONST_SIZE_OR_ZERO] = &scalar_types,
> + [ARG_CONST_ALLOC_SIZE_OR_ZERO] = &scalar_types,
> + [ARG_CONST_MAP_PTR] = &const_map_ptr_types,
> + [ARG_PTR_TO_CTX] = &context_types,
> + [ARG_PTR_TO_CTX_OR_NULL] = &context_types,
> + [ARG_PTR_TO_SOCK_COMMON] = &sock_types,
> + [ARG_PTR_TO_SOCKET] = &fullsock_types,
> + [ARG_PTR_TO_SOCKET_OR_NULL] = &fullsock_types,
> + [ARG_PTR_TO_BTF_ID] = &btf_ptr_types,
> + [ARG_PTR_TO_SPIN_LOCK] = &spin_lock_types,
> + [ARG_PTR_TO_MEM] = &mem_types,
> + [ARG_PTR_TO_MEM_OR_NULL] = &mem_types,
> + [ARG_PTR_TO_UNINIT_MEM] = &mem_types,
> + [ARG_PTR_TO_ALLOC_MEM] = &alloc_mem_types,
> + [ARG_PTR_TO_ALLOC_MEM_OR_NULL] = &alloc_mem_types,
> + [ARG_PTR_TO_INT] = &int_ptr_types,
> + [ARG_PTR_TO_LONG] = &int_ptr_types,
> + [__BPF_ARG_TYPE_MAX] = NULL,
I don't understand what this extra value is for.
I tried:
diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index fc5c901c7542..87b0d5dcc1ff 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -292,7 +292,6 @@ enum bpf_arg_type {
ARG_PTR_TO_ALLOC_MEM, /* pointer to dynamically allocated memory */
ARG_PTR_TO_ALLOC_MEM_OR_NULL, /* pointer to dynamically allocated memory or NULL */
ARG_CONST_ALLOC_SIZE_OR_ZERO, /* number of allocated bytes requested */
- __BPF_ARG_TYPE_MAX,
};
/* type of values returned from helper functions */
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 15ab889b0a3f..83faa67858b6 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -4025,7 +4025,6 @@ static const struct bpf_reg_types *compatible_reg_types[] = {
[ARG_PTR_TO_ALLOC_MEM_OR_NULL] = &alloc_mem_types,
[ARG_PTR_TO_INT] = &int_ptr_types,
[ARG_PTR_TO_LONG] = &int_ptr_types,
- [__BPF_ARG_TYPE_MAX] = NULL,
};
and everything is fine as I think it should be.
> + compatible = compatible_reg_types[arg_type];
> + if (!compatible) {
> + verbose(env, "verifier internal error: unsupported arg type %d\n", arg_type);
> return -EFAULT;
> }
This check will trigger the same way when somebody adds new ARG_* and doesn't add to the table.
>
> + err = check_reg_type(env, regno, compatible);
> + if (err)
> + return err;
> +
> if (type == PTR_TO_BTF_ID) {
> const u32 *btf_id = fn->arg_btf_id[arg];
>
> @@ -4174,10 +4213,6 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
> }
>
> return err;
> -err_type:
> - verbose(env, "R%d type=%s expected=%s\n", regno,
> - reg_type_str[type], reg_type_str[expected_type]);
> - return -EACCES;
I'm not a fan of table driven checks. I think one explicit switch statement
would have been easier to read, but I guess we can convert back to it later if
table becomes too limiting. The improvement in the verifier output is important
and justifies this approach.
Applied to bpf-next. Thanks!
^ permalink raw reply related [flat|nested] 18+ messages in thread* Re: [PATCH bpf-next v4 11/11] bpf: use a table to drive helper arg type checks
2020-09-21 22:23 ` Alexei Starovoitov
@ 2020-09-22 8:20 ` Lorenz Bauer
2020-09-22 20:07 ` Alexei Starovoitov
0 siblings, 1 reply; 18+ messages in thread
From: Lorenz Bauer @ 2020-09-22 8:20 UTC (permalink / raw)
To: Alexei Starovoitov
Cc: Alexei Starovoitov, Daniel Borkmann, bpf, Networking, Martin KaFai Lau
On Mon, 21 Sep 2020 at 23:23, Alexei Starovoitov
<alexei.starovoitov@gmail.com> wrote:
>
> On Mon, Sep 21, 2020 at 01:12:27PM +0100, Lorenz Bauer wrote:
> > +struct bpf_reg_types {
> > + const enum bpf_reg_type types[10];
> > +};
>
> any idea on how to make it more robust?
I kind of copied this from the bpf_iter context. I prototyped using an
enum bpf_reg_type * and then terminating the array with NOT_INIT.
Writing this out is more involved, and might need some macro magic to
make it palatable. The current approach is a lot simpler, and I
figured that the compiler will error out if we ever exceed the 10
items.
>
> > +
> > +static const struct bpf_reg_types *compatible_reg_types[] = {
> > + [ARG_PTR_TO_MAP_KEY] = &map_key_value_types,
> > + [ARG_PTR_TO_MAP_VALUE] = &map_key_value_types,
> > + [ARG_PTR_TO_UNINIT_MAP_VALUE] = &map_key_value_types,
> > + [ARG_PTR_TO_MAP_VALUE_OR_NULL] = &map_key_value_types,
> > + [ARG_CONST_SIZE] = &scalar_types,
> > + [ARG_CONST_SIZE_OR_ZERO] = &scalar_types,
> > + [ARG_CONST_ALLOC_SIZE_OR_ZERO] = &scalar_types,
> > + [ARG_CONST_MAP_PTR] = &const_map_ptr_types,
> > + [ARG_PTR_TO_CTX] = &context_types,
> > + [ARG_PTR_TO_CTX_OR_NULL] = &context_types,
> > + [ARG_PTR_TO_SOCK_COMMON] = &sock_types,
> > + [ARG_PTR_TO_SOCKET] = &fullsock_types,
> > + [ARG_PTR_TO_SOCKET_OR_NULL] = &fullsock_types,
> > + [ARG_PTR_TO_BTF_ID] = &btf_ptr_types,
> > + [ARG_PTR_TO_SPIN_LOCK] = &spin_lock_types,
> > + [ARG_PTR_TO_MEM] = &mem_types,
> > + [ARG_PTR_TO_MEM_OR_NULL] = &mem_types,
> > + [ARG_PTR_TO_UNINIT_MEM] = &mem_types,
> > + [ARG_PTR_TO_ALLOC_MEM] = &alloc_mem_types,
> > + [ARG_PTR_TO_ALLOC_MEM_OR_NULL] = &alloc_mem_types,
> > + [ARG_PTR_TO_INT] = &int_ptr_types,
> > + [ARG_PTR_TO_LONG] = &int_ptr_types,
> > + [__BPF_ARG_TYPE_MAX] = NULL,
>
> I don't understand what this extra value is for.
> I tried:
> diff --git a/include/linux/bpf.h b/include/linux/bpf.h
> index fc5c901c7542..87b0d5dcc1ff 100644
> --- a/include/linux/bpf.h
> +++ b/include/linux/bpf.h
> @@ -292,7 +292,6 @@ enum bpf_arg_type {
> ARG_PTR_TO_ALLOC_MEM, /* pointer to dynamically allocated memory */
> ARG_PTR_TO_ALLOC_MEM_OR_NULL, /* pointer to dynamically allocated memory or NULL */
> ARG_CONST_ALLOC_SIZE_OR_ZERO, /* number of allocated bytes requested */
> - __BPF_ARG_TYPE_MAX,
> };
>
> /* type of values returned from helper functions */
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 15ab889b0a3f..83faa67858b6 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -4025,7 +4025,6 @@ static const struct bpf_reg_types *compatible_reg_types[] = {
> [ARG_PTR_TO_ALLOC_MEM_OR_NULL] = &alloc_mem_types,
> [ARG_PTR_TO_INT] = &int_ptr_types,
> [ARG_PTR_TO_LONG] = &int_ptr_types,
> - [__BPF_ARG_TYPE_MAX] = NULL,
> };
>
> and everything is fine as I think it should be.
>
> > + compatible = compatible_reg_types[arg_type];
> > + if (!compatible) {
> > + verbose(env, "verifier internal error: unsupported arg type %d\n", arg_type);
> > return -EFAULT;
> > }
>
> This check will trigger the same way when somebody adds new ARG_* and doesn't add to the table.
I think in that case that value of compatible will be undefined, since
it points past the end of compatible_reg_types. Hence the
__BPF_ARG_TYPE_MAX to ensure that the array has a NULL slot for new
arg types.
>
> >
> > + err = check_reg_type(env, regno, compatible);
> > + if (err)
> > + return err;
> > +
> > if (type == PTR_TO_BTF_ID) {
> > const u32 *btf_id = fn->arg_btf_id[arg];
> >
> > @@ -4174,10 +4213,6 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
> > }
> >
> > return err;
> > -err_type:
> > - verbose(env, "R%d type=%s expected=%s\n", regno,
> > - reg_type_str[type], reg_type_str[expected_type]);
> > - return -EACCES;
>
> I'm not a fan of table driven checks. I think one explicit switch statement
> would have been easier to read, but I guess we can convert back to it later if
> table becomes too limiting. The improvement in the verifier output is important
> and justifies this approach.
>
> Applied to bpf-next. Thanks!
Thank you!
--
Lorenz Bauer | Systems Engineer
6th Floor, County Hall/The Riverside Building, SE1 7PB, UK
www.cloudflare.com
^ permalink raw reply [flat|nested] 18+ messages in thread* Re: [PATCH bpf-next v4 11/11] bpf: use a table to drive helper arg type checks
2020-09-22 8:20 ` Lorenz Bauer
@ 2020-09-22 20:07 ` Alexei Starovoitov
2020-09-23 9:45 ` Lorenz Bauer
0 siblings, 1 reply; 18+ messages in thread
From: Alexei Starovoitov @ 2020-09-22 20:07 UTC (permalink / raw)
To: Lorenz Bauer
Cc: Alexei Starovoitov, Daniel Borkmann, bpf, Networking, Martin KaFai Lau
On Tue, Sep 22, 2020 at 09:20:27AM +0100, Lorenz Bauer wrote:
> On Mon, 21 Sep 2020 at 23:23, Alexei Starovoitov
> <alexei.starovoitov@gmail.com> wrote:
> >
> > On Mon, Sep 21, 2020 at 01:12:27PM +0100, Lorenz Bauer wrote:
> > > +struct bpf_reg_types {
> > > + const enum bpf_reg_type types[10];
> > > +};
> >
> > any idea on how to make it more robust?
>
> I kind of copied this from the bpf_iter context. I prototyped using an
> enum bpf_reg_type * and then terminating the array with NOT_INIT.
> Writing this out is more involved, and might need some macro magic to
> make it palatable. The current approach is a lot simpler, and I
> figured that the compiler will error out if we ever exceed the 10
> items.
The compiler will be silent if number of types is exactly 10,
but at run-time the loop will access out of bounds.
> >
> > > +
> > > +static const struct bpf_reg_types *compatible_reg_types[] = {
> > > + [ARG_PTR_TO_MAP_KEY] = &map_key_value_types,
> > > + [ARG_PTR_TO_MAP_VALUE] = &map_key_value_types,
> > > + [ARG_PTR_TO_UNINIT_MAP_VALUE] = &map_key_value_types,
> > > + [ARG_PTR_TO_MAP_VALUE_OR_NULL] = &map_key_value_types,
> > > + [ARG_CONST_SIZE] = &scalar_types,
> > > + [ARG_CONST_SIZE_OR_ZERO] = &scalar_types,
> > > + [ARG_CONST_ALLOC_SIZE_OR_ZERO] = &scalar_types,
> > > + [ARG_CONST_MAP_PTR] = &const_map_ptr_types,
> > > + [ARG_PTR_TO_CTX] = &context_types,
> > > + [ARG_PTR_TO_CTX_OR_NULL] = &context_types,
> > > + [ARG_PTR_TO_SOCK_COMMON] = &sock_types,
> > > + [ARG_PTR_TO_SOCKET] = &fullsock_types,
> > > + [ARG_PTR_TO_SOCKET_OR_NULL] = &fullsock_types,
> > > + [ARG_PTR_TO_BTF_ID] = &btf_ptr_types,
> > > + [ARG_PTR_TO_SPIN_LOCK] = &spin_lock_types,
> > > + [ARG_PTR_TO_MEM] = &mem_types,
> > > + [ARG_PTR_TO_MEM_OR_NULL] = &mem_types,
> > > + [ARG_PTR_TO_UNINIT_MEM] = &mem_types,
> > > + [ARG_PTR_TO_ALLOC_MEM] = &alloc_mem_types,
> > > + [ARG_PTR_TO_ALLOC_MEM_OR_NULL] = &alloc_mem_types,
> > > + [ARG_PTR_TO_INT] = &int_ptr_types,
> > > + [ARG_PTR_TO_LONG] = &int_ptr_types,
> > > + [__BPF_ARG_TYPE_MAX] = NULL,
> >
> > I don't understand what this extra value is for.
> > I tried:
> > diff --git a/include/linux/bpf.h b/include/linux/bpf.h
> > index fc5c901c7542..87b0d5dcc1ff 100644
> > --- a/include/linux/bpf.h
> > +++ b/include/linux/bpf.h
> > @@ -292,7 +292,6 @@ enum bpf_arg_type {
> > ARG_PTR_TO_ALLOC_MEM, /* pointer to dynamically allocated memory */
> > ARG_PTR_TO_ALLOC_MEM_OR_NULL, /* pointer to dynamically allocated memory or NULL */
> > ARG_CONST_ALLOC_SIZE_OR_ZERO, /* number of allocated bytes requested */
> > - __BPF_ARG_TYPE_MAX,
> > };
> >
> > /* type of values returned from helper functions */
> > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> > index 15ab889b0a3f..83faa67858b6 100644
> > --- a/kernel/bpf/verifier.c
> > +++ b/kernel/bpf/verifier.c
> > @@ -4025,7 +4025,6 @@ static const struct bpf_reg_types *compatible_reg_types[] = {
> > [ARG_PTR_TO_ALLOC_MEM_OR_NULL] = &alloc_mem_types,
> > [ARG_PTR_TO_INT] = &int_ptr_types,
> > [ARG_PTR_TO_LONG] = &int_ptr_types,
> > - [__BPF_ARG_TYPE_MAX] = NULL,
> > };
> >
> > and everything is fine as I think it should be.
> >
> > > + compatible = compatible_reg_types[arg_type];
> > > + if (!compatible) {
> > > + verbose(env, "verifier internal error: unsupported arg type %d\n", arg_type);
> > > return -EFAULT;
> > > }
> >
> > This check will trigger the same way when somebody adds new ARG_* and doesn't add to the table.
>
> I think in that case that value of compatible will be undefined, since
> it points past the end of compatible_reg_types. Hence the
> __BPF_ARG_TYPE_MAX to ensure that the array has a NULL slot for new
> arg types.
I still don't see a point.
If anyone adds one more ARG_ to the end (or anywhere else)
the compatible_reg_types array will be zero inited in that place by the compiler.
Just like it does already for ARG_ANYTHING and ARG_DONTCARE.
Am I still missing something?
If not please follow up with removal of __BPF_ARG_TYPE_MAX.
^ permalink raw reply [flat|nested] 18+ messages in thread* Re: [PATCH bpf-next v4 11/11] bpf: use a table to drive helper arg type checks
2020-09-22 20:07 ` Alexei Starovoitov
@ 2020-09-23 9:45 ` Lorenz Bauer
2020-09-23 15:24 ` Alexei Starovoitov
0 siblings, 1 reply; 18+ messages in thread
From: Lorenz Bauer @ 2020-09-23 9:45 UTC (permalink / raw)
To: Alexei Starovoitov
Cc: Alexei Starovoitov, Daniel Borkmann, bpf, Networking, Martin KaFai Lau
On Tue, 22 Sep 2020 at 21:07, Alexei Starovoitov
<alexei.starovoitov@gmail.com> wrote:
>
> On Tue, Sep 22, 2020 at 09:20:27AM +0100, Lorenz Bauer wrote:
> > On Mon, 21 Sep 2020 at 23:23, Alexei Starovoitov
> > <alexei.starovoitov@gmail.com> wrote:
> > >
> > > On Mon, Sep 21, 2020 at 01:12:27PM +0100, Lorenz Bauer wrote:
> > > > +struct bpf_reg_types {
> > > > + const enum bpf_reg_type types[10];
> > > > +};
> > >
> > > any idea on how to make it more robust?
> >
> > I kind of copied this from the bpf_iter context. I prototyped using an
> > enum bpf_reg_type * and then terminating the array with NOT_INIT.
> > Writing this out is more involved, and might need some macro magic to
> > make it palatable. The current approach is a lot simpler, and I
> > figured that the compiler will error out if we ever exceed the 10
> > items.
>
> The compiler will be silent if number of types is exactly 10,
> but at run-time the loop will access out of bounds.
Which loop do you refer to?
The one in check_reg_type shouldn't go out of bounds due to ARRAY_SIZE:
for (i = 0; i < ARRAY_SIZE(compatible->types); i++) {
expected = compatible->types[i];
if (expected == NOT_INIT)
break;
>
> > >
> > > > +
> > > > +static const struct bpf_reg_types *compatible_reg_types[] = {
> > > > + [ARG_PTR_TO_MAP_KEY] = &map_key_value_types,
> > > > + [ARG_PTR_TO_MAP_VALUE] = &map_key_value_types,
> > > > + [ARG_PTR_TO_UNINIT_MAP_VALUE] = &map_key_value_types,
> > > > + [ARG_PTR_TO_MAP_VALUE_OR_NULL] = &map_key_value_types,
> > > > + [ARG_CONST_SIZE] = &scalar_types,
> > > > + [ARG_CONST_SIZE_OR_ZERO] = &scalar_types,
> > > > + [ARG_CONST_ALLOC_SIZE_OR_ZERO] = &scalar_types,
> > > > + [ARG_CONST_MAP_PTR] = &const_map_ptr_types,
> > > > + [ARG_PTR_TO_CTX] = &context_types,
> > > > + [ARG_PTR_TO_CTX_OR_NULL] = &context_types,
> > > > + [ARG_PTR_TO_SOCK_COMMON] = &sock_types,
> > > > + [ARG_PTR_TO_SOCKET] = &fullsock_types,
> > > > + [ARG_PTR_TO_SOCKET_OR_NULL] = &fullsock_types,
> > > > + [ARG_PTR_TO_BTF_ID] = &btf_ptr_types,
> > > > + [ARG_PTR_TO_SPIN_LOCK] = &spin_lock_types,
> > > > + [ARG_PTR_TO_MEM] = &mem_types,
> > > > + [ARG_PTR_TO_MEM_OR_NULL] = &mem_types,
> > > > + [ARG_PTR_TO_UNINIT_MEM] = &mem_types,
> > > > + [ARG_PTR_TO_ALLOC_MEM] = &alloc_mem_types,
> > > > + [ARG_PTR_TO_ALLOC_MEM_OR_NULL] = &alloc_mem_types,
> > > > + [ARG_PTR_TO_INT] = &int_ptr_types,
> > > > + [ARG_PTR_TO_LONG] = &int_ptr_types,
> > > > + [__BPF_ARG_TYPE_MAX] = NULL,
> > >
> > > I don't understand what this extra value is for.
> > > I tried:
> > > diff --git a/include/linux/bpf.h b/include/linux/bpf.h
> > > index fc5c901c7542..87b0d5dcc1ff 100644
> > > --- a/include/linux/bpf.h
> > > +++ b/include/linux/bpf.h
> > > @@ -292,7 +292,6 @@ enum bpf_arg_type {
> > > ARG_PTR_TO_ALLOC_MEM, /* pointer to dynamically allocated memory */
> > > ARG_PTR_TO_ALLOC_MEM_OR_NULL, /* pointer to dynamically allocated memory or NULL */
> > > ARG_CONST_ALLOC_SIZE_OR_ZERO, /* number of allocated bytes requested */
> > > - __BPF_ARG_TYPE_MAX,
> > > };
> > >
> > > /* type of values returned from helper functions */
> > > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> > > index 15ab889b0a3f..83faa67858b6 100644
> > > --- a/kernel/bpf/verifier.c
> > > +++ b/kernel/bpf/verifier.c
> > > @@ -4025,7 +4025,6 @@ static const struct bpf_reg_types *compatible_reg_types[] = {
> > > [ARG_PTR_TO_ALLOC_MEM_OR_NULL] = &alloc_mem_types,
> > > [ARG_PTR_TO_INT] = &int_ptr_types,
> > > [ARG_PTR_TO_LONG] = &int_ptr_types,
> > > - [__BPF_ARG_TYPE_MAX] = NULL,
> > > };
> > >
> > > and everything is fine as I think it should be.
> > >
> > > > + compatible = compatible_reg_types[arg_type];
> > > > + if (!compatible) {
> > > > + verbose(env, "verifier internal error: unsupported arg type %d\n", arg_type);
> > > > return -EFAULT;
> > > > }
> > >
> > > This check will trigger the same way when somebody adds new ARG_* and doesn't add to the table.
> >
> > I think in that case that value of compatible will be undefined, since
> > it points past the end of compatible_reg_types. Hence the
> > __BPF_ARG_TYPE_MAX to ensure that the array has a NULL slot for new
> > arg types.
>
> I still don't see a point.
> If anyone adds one more ARG_ to the end (or anywhere else)
> the compatible_reg_types array will be zero inited in that place by the compiler.
> Just like it does already for ARG_ANYTHING and ARG_DONTCARE.
I looked up designated initializers when I wrote this, since I wasn't
super familiar with them:
https://gcc.gnu.org/onlinedocs/gcc/Designated-Inits.html#Designated-Inits
Note that the length of the array is the highest value specified plus one.
So ARG_ANYTHING and ARG_DONTCARE are OK since there is a higher enum
value present in the initializer. If someone adds a new item to enum
bpf_arg_type I assume they would add it to the end. In that case the
highest value of the initializer doesn't change, and then indexing
into compatible_reg_types with the new enum value would be out of
bounds. Adding __BPF_ARG_TYPE_MAX fixes that.
It's very possible I misunderstood how this whole contraption works,
happy to send a patch.
--
Lorenz Bauer | Systems Engineer
6th Floor, County Hall/The Riverside Building, SE1 7PB, UK
www.cloudflare.com
^ permalink raw reply [flat|nested] 18+ messages in thread* Re: [PATCH bpf-next v4 11/11] bpf: use a table to drive helper arg type checks
2020-09-23 9:45 ` Lorenz Bauer
@ 2020-09-23 15:24 ` Alexei Starovoitov
0 siblings, 0 replies; 18+ messages in thread
From: Alexei Starovoitov @ 2020-09-23 15:24 UTC (permalink / raw)
To: Lorenz Bauer
Cc: Alexei Starovoitov, Daniel Borkmann, bpf, Networking, Martin KaFai Lau
On Wed, Sep 23, 2020 at 2:45 AM Lorenz Bauer <lmb@cloudflare.com> wrote:
>
> On Tue, 22 Sep 2020 at 21:07, Alexei Starovoitov
> <alexei.starovoitov@gmail.com> wrote:
> >
> > On Tue, Sep 22, 2020 at 09:20:27AM +0100, Lorenz Bauer wrote:
> > > On Mon, 21 Sep 2020 at 23:23, Alexei Starovoitov
> > > <alexei.starovoitov@gmail.com> wrote:
> > > >
> > > > On Mon, Sep 21, 2020 at 01:12:27PM +0100, Lorenz Bauer wrote:
> > > > > +struct bpf_reg_types {
> > > > > + const enum bpf_reg_type types[10];
> > > > > +};
> > > >
> > > > any idea on how to make it more robust?
> > >
> > > I kind of copied this from the bpf_iter context. I prototyped using an
> > > enum bpf_reg_type * and then terminating the array with NOT_INIT.
> > > Writing this out is more involved, and might need some macro magic to
> > > make it palatable. The current approach is a lot simpler, and I
> > > figured that the compiler will error out if we ever exceed the 10
> > > items.
> >
> > The compiler will be silent if number of types is exactly 10,
> > but at run-time the loop will access out of bounds.
>
> Which loop do you refer to?
>
> The one in check_reg_type shouldn't go out of bounds due to ARRAY_SIZE:
>
> for (i = 0; i < ARRAY_SIZE(compatible->types); i++) {
ahh. right. it will always be 10 here. got it.
> expected = compatible->types[i];
> if (expected == NOT_INIT)
> break;
>
> >
> > > >
> > > > > +
> > > > > +static const struct bpf_reg_types *compatible_reg_types[] = {
> > > > > + [ARG_PTR_TO_MAP_KEY] = &map_key_value_types,
> > > > > + [ARG_PTR_TO_MAP_VALUE] = &map_key_value_types,
> > > > > + [ARG_PTR_TO_UNINIT_MAP_VALUE] = &map_key_value_types,
> > > > > + [ARG_PTR_TO_MAP_VALUE_OR_NULL] = &map_key_value_types,
> > > > > + [ARG_CONST_SIZE] = &scalar_types,
> > > > > + [ARG_CONST_SIZE_OR_ZERO] = &scalar_types,
> > > > > + [ARG_CONST_ALLOC_SIZE_OR_ZERO] = &scalar_types,
> > > > > + [ARG_CONST_MAP_PTR] = &const_map_ptr_types,
> > > > > + [ARG_PTR_TO_CTX] = &context_types,
> > > > > + [ARG_PTR_TO_CTX_OR_NULL] = &context_types,
> > > > > + [ARG_PTR_TO_SOCK_COMMON] = &sock_types,
> > > > > + [ARG_PTR_TO_SOCKET] = &fullsock_types,
> > > > > + [ARG_PTR_TO_SOCKET_OR_NULL] = &fullsock_types,
> > > > > + [ARG_PTR_TO_BTF_ID] = &btf_ptr_types,
> > > > > + [ARG_PTR_TO_SPIN_LOCK] = &spin_lock_types,
> > > > > + [ARG_PTR_TO_MEM] = &mem_types,
> > > > > + [ARG_PTR_TO_MEM_OR_NULL] = &mem_types,
> > > > > + [ARG_PTR_TO_UNINIT_MEM] = &mem_types,
> > > > > + [ARG_PTR_TO_ALLOC_MEM] = &alloc_mem_types,
> > > > > + [ARG_PTR_TO_ALLOC_MEM_OR_NULL] = &alloc_mem_types,
> > > > > + [ARG_PTR_TO_INT] = &int_ptr_types,
> > > > > + [ARG_PTR_TO_LONG] = &int_ptr_types,
> > > > > + [__BPF_ARG_TYPE_MAX] = NULL,
> > > >
> > > > I don't understand what this extra value is for.
> > > > I tried:
> > > > diff --git a/include/linux/bpf.h b/include/linux/bpf.h
> > > > index fc5c901c7542..87b0d5dcc1ff 100644
> > > > --- a/include/linux/bpf.h
> > > > +++ b/include/linux/bpf.h
> > > > @@ -292,7 +292,6 @@ enum bpf_arg_type {
> > > > ARG_PTR_TO_ALLOC_MEM, /* pointer to dynamically allocated memory */
> > > > ARG_PTR_TO_ALLOC_MEM_OR_NULL, /* pointer to dynamically allocated memory or NULL */
> > > > ARG_CONST_ALLOC_SIZE_OR_ZERO, /* number of allocated bytes requested */
> > > > - __BPF_ARG_TYPE_MAX,
> > > > };
> > > >
> > > > /* type of values returned from helper functions */
> > > > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> > > > index 15ab889b0a3f..83faa67858b6 100644
> > > > --- a/kernel/bpf/verifier.c
> > > > +++ b/kernel/bpf/verifier.c
> > > > @@ -4025,7 +4025,6 @@ static const struct bpf_reg_types *compatible_reg_types[] = {
> > > > [ARG_PTR_TO_ALLOC_MEM_OR_NULL] = &alloc_mem_types,
> > > > [ARG_PTR_TO_INT] = &int_ptr_types,
> > > > [ARG_PTR_TO_LONG] = &int_ptr_types,
> > > > - [__BPF_ARG_TYPE_MAX] = NULL,
> > > > };
> > > >
> > > > and everything is fine as I think it should be.
> > > >
> > > > > + compatible = compatible_reg_types[arg_type];
> > > > > + if (!compatible) {
> > > > > + verbose(env, "verifier internal error: unsupported arg type %d\n", arg_type);
> > > > > return -EFAULT;
> > > > > }
> > > >
> > > > This check will trigger the same way when somebody adds new ARG_* and doesn't add to the table.
> > >
> > > I think in that case that value of compatible will be undefined, since
> > > it points past the end of compatible_reg_types. Hence the
> > > __BPF_ARG_TYPE_MAX to ensure that the array has a NULL slot for new
> > > arg types.
> >
> > I still don't see a point.
> > If anyone adds one more ARG_ to the end (or anywhere else)
> > the compatible_reg_types array will be zero inited in that place by the compiler.
> > Just like it does already for ARG_ANYTHING and ARG_DONTCARE.
>
> I looked up designated initializers when I wrote this, since I wasn't
> super familiar with them:
> https://gcc.gnu.org/onlinedocs/gcc/Designated-Inits.html#Designated-Inits
>
> Note that the length of the array is the highest value specified plus one.
>
> So ARG_ANYTHING and ARG_DONTCARE are OK since there is a higher enum
> value present in the initializer. If someone adds a new item to enum
> bpf_arg_type I assume they would add it to the end. In that case the
> highest value of the initializer doesn't change, and then indexing
> into compatible_reg_types with the new enum value would be out of
> bounds. Adding __BPF_ARG_TYPE_MAX fixes that.
I see. Could you do this instead then:
-static const struct bpf_reg_types *compatible_reg_types[] = {
+static const struct bpf_reg_types *compatible_reg_types[__BPF_ARG_TYPE_MAX] = {
[ARG_PTR_TO_MAP_KEY] = &map_key_value_types,
[ARG_PTR_TO_MAP_VALUE] = &map_key_value_types,
[ARG_PTR_TO_UNINIT_MAP_VALUE] = &map_key_value_types,
@@ -4025,7 +4025,6 @@ static const struct bpf_reg_types
*compatible_reg_types[] = {
[ARG_PTR_TO_ALLOC_MEM_OR_NULL] = &alloc_mem_types,
[ARG_PTR_TO_INT] = &int_ptr_types,
[ARG_PTR_TO_LONG] = &int_ptr_types,
- [__BPF_ARG_TYPE_MAX] = NULL,
};
That way is more obvious.
That =NULL initializer just for the last element and not for
ARG_ANYTHING/DONTCARE
bothered me enough to start this whole discussion.
^ permalink raw reply [flat|nested] 18+ messages in thread