bpf.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Lorenz Bauer <lmb@cloudflare.com>
To: Martin KaFai Lau <kafai@fb.com>
Cc: bpf <bpf@vger.kernel.org>, Alexei Starovoitov <ast@kernel.org>,
	Daniel Borkmann <daniel@iogearbox.net>,
	Kernel Team <kernel-team@fb.com>,
	Networking <netdev@vger.kernel.org>
Subject: Re: [PATCH v4 bpf-next 01/13] bpf: Move the PTR_TO_BTF_ID check to check_reg_type()
Date: Fri, 25 Sep 2020 09:22:22 +0100	[thread overview]
Message-ID: <CACAyw9_3im5vVepgsTw+XNYLAa1C7pQ+_kNFjzmWgEN7tkuvGw@mail.gmail.com> (raw)
In-Reply-To: <20200925000344.3854828-1-kafai@fb.com>

On Fri, 25 Sep 2020 at 01:03, Martin KaFai Lau <kafai@fb.com> wrote:
>
> check_reg_type() checks whether a reg can be used as an arg of a
> func_proto.  For PTR_TO_BTF_ID, the check is actually not
> completely done until the reg->btf_id is pointing to a
> kernel struct that is acceptable by the func_proto.
>
> Thus, this patch moves the btf_id check into check_reg_type().
> "arg_type" and "arg_btf_id" are passed to check_reg_type() instead of
> "compatible".  The compatible_reg_types[] usage is localized in
> check_reg_type() now.
>
> The "if (!btf_id) verbose(...); " is also removed since it won't happen.
>
> Signed-off-by: Martin KaFai Lau <kafai@fb.com>

Acked-by: Lorenz Bauer <lmb@cloudflare.com>

> ---
>  kernel/bpf/verifier.c | 60 ++++++++++++++++++++++---------------------
>  1 file changed, 31 insertions(+), 29 deletions(-)
>
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 42dee5dcbc74..945fa2b4d096 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -4028,19 +4028,27 @@ static const struct bpf_reg_types *compatible_reg_types[__BPF_ARG_TYPE_MAX] = {
>  };
>
>  static int check_reg_type(struct bpf_verifier_env *env, u32 regno,
> -                         const struct bpf_reg_types *compatible)
> +                         enum bpf_arg_type arg_type,
> +                         const u32 *arg_btf_id)
>  {
>         struct bpf_reg_state *regs = cur_regs(env), *reg = &regs[regno];
>         enum bpf_reg_type expected, type = reg->type;
> +       const struct bpf_reg_types *compatible;
>         int i, j;
>
> +       compatible = compatible_reg_types[arg_type];
> +       if (!compatible) {
> +               verbose(env, "verifier internal error: unsupported arg type %d\n", arg_type);
> +               return -EFAULT;
> +       }
> +
>         for (i = 0; i < ARRAY_SIZE(compatible->types); i++) {
>                 expected = compatible->types[i];
>                 if (expected == NOT_INIT)
>                         break;
>
>                 if (type == expected)
> -                       return 0;
> +                       goto found;
>         }
>
>         verbose(env, "R%d type=%s expected=", regno, reg_type_str[type]);
> @@ -4048,6 +4056,25 @@ static int check_reg_type(struct bpf_verifier_env *env, u32 regno,
>                 verbose(env, "%s, ", reg_type_str[compatible->types[j]]);
>         verbose(env, "%s\n", reg_type_str[compatible->types[j]]);
>         return -EACCES;
> +
> +found:
> +       if (type == PTR_TO_BTF_ID) {
> +               if (!btf_struct_ids_match(&env->log, reg->off, reg->btf_id,
> +                                         *arg_btf_id)) {
> +                       verbose(env, "R%d is of type %s but %s is expected\n",
> +                               regno, kernel_type_name(reg->btf_id),
> +                               kernel_type_name(*arg_btf_id));
> +                       return -EACCES;
> +               }
> +
> +               if (!tnum_is_const(reg->var_off) || reg->var_off.value) {
> +                       verbose(env, "R%d is a pointer to in-kernel struct with non-zero offset\n",
> +                               regno);
> +                       return -EACCES;
> +               }
> +       }
> +
> +       return 0;
>  }
>
>  static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
> @@ -4057,7 +4084,6 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
>         u32 regno = BPF_REG_1 + arg;
>         struct bpf_reg_state *regs = cur_regs(env), *reg = &regs[regno];
>         enum bpf_arg_type arg_type = fn->arg_type[arg];
> -       const struct bpf_reg_types *compatible;
>         enum bpf_reg_type type = reg->type;
>         int err = 0;
>
> @@ -4097,35 +4123,11 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
>                  */
>                 goto skip_type_check;
>
> -       compatible = compatible_reg_types[arg_type];
> -       if (!compatible) {
> -               verbose(env, "verifier internal error: unsupported arg type %d\n", arg_type);
> -               return -EFAULT;
> -       }
> -
> -       err = check_reg_type(env, regno, compatible);
> +       err = check_reg_type(env, regno, arg_type, fn->arg_btf_id[arg]);
>         if (err)
>                 return err;
>
> -       if (type == PTR_TO_BTF_ID) {
> -               const u32 *btf_id = fn->arg_btf_id[arg];
> -
> -               if (!btf_id) {
> -                       verbose(env, "verifier internal error: missing BTF ID\n");
> -                       return -EFAULT;
> -               }
> -
> -               if (!btf_struct_ids_match(&env->log, reg->off, reg->btf_id, *btf_id)) {
> -                       verbose(env, "R%d is of type %s but %s is expected\n",
> -                               regno, kernel_type_name(reg->btf_id), kernel_type_name(*btf_id));
> -                       return -EACCES;
> -               }
> -               if (!tnum_is_const(reg->var_off) || reg->var_off.value) {
> -                       verbose(env, "R%d is a pointer to in-kernel struct with non-zero offset\n",
> -                               regno);
> -                       return -EACCES;
> -               }
> -       } else if (type == PTR_TO_CTX) {
> +       if (type == PTR_TO_CTX) {
>                 err = check_ctx_reg(env, reg, regno);
>                 if (err < 0)
>                         return err;
> --
> 2.24.1
>


-- 
Lorenz Bauer  |  Systems Engineer
6th Floor, County Hall/The Riverside Building, SE1 7PB, UK

www.cloudflare.com

  reply	other threads:[~2020-09-25  8:22 UTC|newest]

Thread overview: 26+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-09-25  0:03 [PATCH v4 bpf-next 00/13] bpf: Enable bpf_skc_to_* sock casting helper to networking prog type Martin KaFai Lau
2020-09-25  0:03 ` [PATCH v4 bpf-next 01/13] bpf: Move the PTR_TO_BTF_ID check to check_reg_type() Martin KaFai Lau
2020-09-25  8:22   ` Lorenz Bauer [this message]
2020-09-25 13:36   ` John Fastabend
2020-09-25  0:03 ` [PATCH v4 bpf-next 02/13] bpf: Enable bpf_skc_to_* sock casting helper to networking prog type Martin KaFai Lau
2020-09-25  8:26   ` Lorenz Bauer
2020-09-25 13:18     ` Martin KaFai Lau
2020-09-25 13:50       ` Lorenz Bauer
2020-09-25 15:47         ` Alexei Starovoitov
2020-09-25 14:21   ` John Fastabend
2020-09-25  0:03 ` [PATCH v4 bpf-next 03/13] bpf: Change bpf_sk_release and bpf_sk_*cgroup_id to accept ARG_PTR_TO_BTF_ID_SOCK_COMMON Martin KaFai Lau
2020-09-25  0:04 ` [PATCH v4 bpf-next 04/13] bpf: Change bpf_sk_storage_*() " Martin KaFai Lau
2020-09-25  0:04 ` [PATCH v4 bpf-next 05/13] bpf: Change bpf_tcp_*_syncookie " Martin KaFai Lau
2020-09-25  0:04 ` [PATCH v4 bpf-next 06/13] bpf: Change bpf_sk_assign " Martin KaFai Lau
2020-09-25  0:04 ` [PATCH v4 bpf-next 07/13] bpf: selftest: Add ref_tracking verifier test for bpf_skc casting Martin KaFai Lau
2020-09-25  8:30   ` Lorenz Bauer
2020-09-25  0:04 ` [PATCH v4 bpf-next 08/13] bpf: selftest: Move sock_fields test into test_progs Martin KaFai Lau
2020-09-25  0:04 ` [PATCH v4 bpf-next 09/13] bpf: selftest: Adapt sock_fields test to use skel and global variables Martin KaFai Lau
2020-09-25  0:04 ` [PATCH v4 bpf-next 10/13] bpf: selftest: Use network_helpers in the sock_fields test Martin KaFai Lau
2020-09-25  0:04 ` [PATCH v4 bpf-next 11/13] bpf: selftest: Use bpf_skc_to_tcp_sock() " Martin KaFai Lau
2020-09-25  0:04 ` [PATCH v4 bpf-next 12/13] bpf: selftest: Remove enum tcp_ca_state from bpf_tcp_helpers.h Martin KaFai Lau
2020-09-25  0:04 ` [PATCH v4 bpf-next 13/13] bpf: selftest: Add test_btf_skc_cls_ingress Martin KaFai Lau
2020-09-25 16:24   ` John Fastabend
2020-09-25 17:58     ` Martin KaFai Lau
2020-09-25  9:40 ` [PATCH v4 bpf-next 00/13] bpf: Enable bpf_skc_to_* sock casting helper to networking prog type Lorenz Bauer
2020-09-25 23:22 ` Alexei Starovoitov

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=CACAyw9_3im5vVepgsTw+XNYLAa1C7pQ+_kNFjzmWgEN7tkuvGw@mail.gmail.com \
    --to=lmb@cloudflare.com \
    --cc=ast@kernel.org \
    --cc=bpf@vger.kernel.org \
    --cc=daniel@iogearbox.net \
    --cc=kafai@fb.com \
    --cc=kernel-team@fb.com \
    --cc=netdev@vger.kernel.org \
    --subject='Re: [PATCH v4 bpf-next 01/13] bpf: Move the PTR_TO_BTF_ID check to check_reg_type()' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).