From: Andrii Nakryiko <andrii.nakryiko@gmail.com>
To: Hao Luo <haoluo@google.com>
Cc: Alexei Starovoitov <ast@kernel.org>,
Andrii Nakryiko <andrii@kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>,
Martin KaFai Lau <kafai@fb.com>, Song Liu <songliubraving@fb.com>,
Yonghong Song <yhs@fb.com>, KP Singh <kpsingh@kernel.org>,
bpf <bpf@vger.kernel.org>
Subject: Re: [PATCH bpf-next v1 4/9] bpf: Replace PTR_TO_XXX_OR_NULL with PTR_TO_XXX | PTR_MAYBE_NULL
Date: Wed, 8 Dec 2021 12:03:44 -0800 [thread overview]
Message-ID: <CAEf4BzZ1-5Tbq5MXkJ=8REFGRFs5aXnT0aGbaQkWYKVo4vuqcA@mail.gmail.com> (raw)
In-Reply-To: <CA+khW7gVp9bp0Q4OcqQxLW2ARL=6VjiOZu6f2vWOt4vvzj29UQ@mail.gmail.com>
On Tue, Dec 7, 2021 at 7:37 PM Hao Luo <haoluo@google.com> wrote:
>
> On Mon, Dec 6, 2021 at 10:09 PM Andrii Nakryiko
> <andrii.nakryiko@gmail.com> wrote:
> >
> > On Mon, Dec 6, 2021 at 3:22 PM Hao Luo <haoluo@google.com> wrote:
> > >
> > > We have introduced a new type to make bpf_reg composable, by
> > > allocating bits in the type to represent flags.
> > >
> > > One of the flags is PTR_MAYBE_NULL which indicates a pointer
> > > may be NULL. This patch switches the qualified reg_types to
> > > use this flag. The reg_types changed in this patch include:
> > >
> > > 1. PTR_TO_MAP_VALUE_OR_NULL
> > > 2. PTR_TO_SOCKET_OR_NULL
> > > 3. PTR_TO_SOCK_COMMON_OR_NULL
> > > 4. PTR_TO_TCP_SOCK_OR_NULL
> > > 5. PTR_TO_BTF_ID_OR_NULL
> > > 6. PTR_TO_MEM_OR_NULL
> > > 7. PTR_TO_RDONLY_BUF_OR_NULL
> > > 8. PTR_TO_RDWR_BUF_OR_NULL
> > >
> > > Signed-off-by: Hao Luo <haoluo@google.com>
> > > ---
> > > drivers/net/ethernet/netronome/nfp/bpf/fw.h | 4 +-
> > > include/linux/bpf.h | 16 +-
> > > kernel/bpf/btf.c | 7 +-
> > > kernel/bpf/map_iter.c | 4 +-
> > > kernel/bpf/verifier.c | 278 ++++++++------------
> > > net/core/bpf_sk_storage.c | 2 +-
> > > net/core/sock_map.c | 2 +-
> > > 7 files changed, 126 insertions(+), 187 deletions(-)
> > >
> >
> > [...]
> >
> > > @@ -535,38 +520,35 @@ static bool is_cmpxchg_insn(const struct bpf_insn *insn)
> > > }
> > >
> > > /* string representation of 'enum bpf_reg_type' */
> > > -static const char * const reg_type_str[] = {
> > > - [NOT_INIT] = "?",
> > > - [SCALAR_VALUE] = "inv",
> > > - [PTR_TO_CTX] = "ctx",
> > > - [CONST_PTR_TO_MAP] = "map_ptr",
> > > - [PTR_TO_MAP_VALUE] = "map_value",
> > > - [PTR_TO_MAP_VALUE_OR_NULL] = "map_value_or_null",
> > > - [PTR_TO_STACK] = "fp",
> > > - [PTR_TO_PACKET] = "pkt",
> > > - [PTR_TO_PACKET_META] = "pkt_meta",
> > > - [PTR_TO_PACKET_END] = "pkt_end",
> > > - [PTR_TO_FLOW_KEYS] = "flow_keys",
> > > - [PTR_TO_SOCKET] = "sock",
> > > - [PTR_TO_SOCKET_OR_NULL] = "sock_or_null",
> > > - [PTR_TO_SOCK_COMMON] = "sock_common",
> > > - [PTR_TO_SOCK_COMMON_OR_NULL] = "sock_common_or_null",
> > > - [PTR_TO_TCP_SOCK] = "tcp_sock",
> > > - [PTR_TO_TCP_SOCK_OR_NULL] = "tcp_sock_or_null",
> > > - [PTR_TO_TP_BUFFER] = "tp_buffer",
> > > - [PTR_TO_XDP_SOCK] = "xdp_sock",
> > > - [PTR_TO_BTF_ID] = "ptr_",
> > > - [PTR_TO_BTF_ID_OR_NULL] = "ptr_or_null_",
> > > - [PTR_TO_PERCPU_BTF_ID] = "percpu_ptr_",
> > > - [PTR_TO_MEM] = "mem",
> > > - [PTR_TO_MEM_OR_NULL] = "mem_or_null",
> > > - [PTR_TO_RDONLY_BUF] = "rdonly_buf",
> > > - [PTR_TO_RDONLY_BUF_OR_NULL] = "rdonly_buf_or_null",
> > > - [PTR_TO_RDWR_BUF] = "rdwr_buf",
> > > - [PTR_TO_RDWR_BUF_OR_NULL] = "rdwr_buf_or_null",
> > > - [PTR_TO_FUNC] = "func",
> > > - [PTR_TO_MAP_KEY] = "map_key",
> > > -};
> > > +static const char *reg_type_str(enum bpf_reg_type type)
> > > +{
> > > + static const char * const str[] = {
> > > + [NOT_INIT] = "?",
> > > + [SCALAR_VALUE] = "inv",
> > > + [PTR_TO_CTX] = "ctx",
> > > + [CONST_PTR_TO_MAP] = "map_ptr",
> > > + [PTR_TO_MAP_VALUE] = "map_value",
> > > + [PTR_TO_STACK] = "fp",
> > > + [PTR_TO_PACKET] = "pkt",
> > > + [PTR_TO_PACKET_META] = "pkt_meta",
> > > + [PTR_TO_PACKET_END] = "pkt_end",
> > > + [PTR_TO_FLOW_KEYS] = "flow_keys",
> > > + [PTR_TO_SOCKET] = "sock",
> > > + [PTR_TO_SOCK_COMMON] = "sock_common",
> > > + [PTR_TO_TCP_SOCK] = "tcp_sock",
> > > + [PTR_TO_TP_BUFFER] = "tp_buffer",
> > > + [PTR_TO_XDP_SOCK] = "xdp_sock",
> > > + [PTR_TO_BTF_ID] = "ptr_",
> > > + [PTR_TO_PERCPU_BTF_ID] = "percpu_ptr_",
> > > + [PTR_TO_MEM] = "mem",
> > > + [PTR_TO_RDONLY_BUF] = "rdonly_buf",
> > > + [PTR_TO_RDWR_BUF] = "rdwr_buf",
> > > + [PTR_TO_FUNC] = "func",
> > > + [PTR_TO_MAP_KEY] = "map_key",
> > > + };
> > > +
> > > + return str[base_type(type)];
> >
> > well... now we lose the "_or_null" part, that can be pretty important.
> > Same will happen with RDONLY flag, right?
> >
> > What can we do about that?
> >
>
> We can format the string into a global buffer and return the buffer to
> the caller. A little overhead on string formatting.
Can't use global buffer, because multiple BPF verifications can
proceed at the same time.
>
> I assume there is already synchronization around the verifier to
> prevent race on the buffer. If not, we have to ask the caller of
> reg_type_str() to pass in a buffer.
I think passing temp buffer is the best (even if annoying) solution.
>
> > > +}
> > >
> > > static char slot_type_char[] = {
> > > [STACK_INVALID] = '?',
> > > @@ -631,7 +613,7 @@ static void print_verifier_state(struct bpf_verifier_env *env,
> > > continue;
> > > verbose(env, " R%d", i);
> > > print_liveness(env, reg->live);
> > > - verbose(env, "=%s", reg_type_str[t]);
> > > + verbose(env, "=%s", reg_type_str(t));
> > > if (t == SCALAR_VALUE && reg->precise)
> > > verbose(env, "P");
> > > if ((t == SCALAR_VALUE || t == PTR_TO_STACK) &&
> >
> > [...]
> >
> > > if (smin >= BPF_MAX_VAR_OFF || smin <= -BPF_MAX_VAR_OFF) {
> > > verbose(env, "value %lld makes %s pointer be out of bounds\n",
> > > - smin, reg_type_str[type]);
> > > + smin, reg_type_str(type));
> > > return false;
> > > }
> > >
> > > @@ -7209,11 +7151,13 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env,
> > > return -EACCES;
> > > }
> > >
> > > - switch (ptr_reg->type) {
> > > - case PTR_TO_MAP_VALUE_OR_NULL:
> > > + if (ptr_reg->type == PTR_TO_MAP_VALUE_OR_NULL) {
> > > verbose(env, "R%d pointer arithmetic on %s prohibited, null-check it first\n",
> >
> > the same message can be output for other pointer types, so instead of
> > special-casing, let's just combine them with more helpful message
> >
>
> Ok. Just want to confirm my understanding, do you mean checking for
> NULL? Like the following replacement:
>
> - if (ptr_reg->type == PTR_TO_MAP_VALUE_OR_NULL) {
> + if (ptr_reg->type & PTR_MAYBE_NULL) {
no, I meant combine PTR_TO_MAP_VALUE_OR_NULL with all the other cases
(PTR_TO_PACKET_END and others), but update their message to suggest
"null-check it first".
>
> > > - dst, reg_type_str[ptr_reg->type]);
> > > + dst, reg_type_str(ptr_reg->type));
> > > return -EACCES;
> > > + }
> > > +
> > > + switch (base_type(ptr_reg->type)) {
> > > case CONST_PTR_TO_MAP:
> > > /* smin_val represents the known value */
> > > if (known && smin_val == 0 && opcode == BPF_ADD)
> > > @@ -7221,14 +7165,11 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env,
> > > fallthrough;
> > > case PTR_TO_PACKET_END:
> > > case PTR_TO_SOCKET:
> > > - case PTR_TO_SOCKET_OR_NULL:
> > > case PTR_TO_SOCK_COMMON:
> > > - case PTR_TO_SOCK_COMMON_OR_NULL:
> > > case PTR_TO_TCP_SOCK:
> > > - case PTR_TO_TCP_SOCK_OR_NULL:
> > > case PTR_TO_XDP_SOCK:
> > > verbose(env, "R%d pointer arithmetic on %s prohibited\n",
> > > - dst, reg_type_str[ptr_reg->type]);
> > > + dst, reg_type_str(ptr_reg->type));
> > > return -EACCES;
> > > default:
> > > break;
> >
> > [...]
next prev parent reply other threads:[~2021-12-08 20:03 UTC|newest]
Thread overview: 32+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-12-06 23:22 [PATCH bpf-next v1 0/9] Introduce composable bpf types Hao Luo
2021-12-06 23:22 ` [PATCH bpf-next v1 1/9] bpf: Introduce composable reg, ret and arg types Hao Luo
2021-12-06 23:22 ` [PATCH bpf-next v1 2/9] bpf: Replace ARG_XXX_OR_NULL with ARG_XXX | PTR_MAYBE_NULL Hao Luo
2021-12-07 5:45 ` Andrii Nakryiko
2021-12-07 18:52 ` Hao Luo
2021-12-06 23:22 ` [PATCH bpf-next v1 3/9] bpf: Replace RET_XXX_OR_NULL with RET_XXX " Hao Luo
2021-12-07 5:51 ` Andrii Nakryiko
2021-12-07 19:05 ` Hao Luo
2021-12-06 23:22 ` [PATCH bpf-next v1 4/9] bpf: Replace PTR_TO_XXX_OR_NULL with PTR_TO_XXX " Hao Luo
2021-12-07 6:08 ` Andrii Nakryiko
2021-12-08 3:37 ` Hao Luo
2021-12-08 20:03 ` Andrii Nakryiko [this message]
2021-12-09 21:45 ` Alexei Starovoitov
2021-12-10 19:56 ` Hao Luo
2021-12-13 1:51 ` Alexei Starovoitov
2021-12-13 2:02 ` Alexei Starovoitov
2021-12-17 0:32 ` Hao Luo
2021-12-06 23:22 ` [PATCH bpf-next v1 5/9] bpf: Introduce MEM_RDONLY flag Hao Luo
2021-12-07 6:14 ` Andrii Nakryiko
2021-12-08 3:41 ` Hao Luo
2021-12-06 23:22 ` [PATCH bpf-next v1 6/9] bpf: Convert PTR_TO_MEM_OR_NULL to composable types Hao Luo
2021-12-06 23:22 ` [PATCH bpf-next v1 7/9] bpf: Make per_cpu_ptr return rdonly PTR_TO_MEM Hao Luo
2021-12-07 6:18 ` Andrii Nakryiko
2021-12-08 3:54 ` Hao Luo
2021-12-10 17:42 ` Andrii Nakryiko
2021-12-10 18:36 ` Hao Luo
2021-12-06 23:22 ` [PATCH bpf-next v1 8/9] bpf: Add MEM_RDONLY for helper args that are pointers to rdonly mem Hao Luo
2021-12-07 6:23 ` Andrii Nakryiko
2021-12-08 3:49 ` Hao Luo
2021-12-09 20:04 ` Hao Luo
2021-12-10 17:55 ` Andrii Nakryiko
2021-12-06 23:22 ` [PATCH bpf-next v1 9/9] bpf/selftests: Test PTR_TO_RDONLY_MEM Hao Luo
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='CAEf4BzZ1-5Tbq5MXkJ=8REFGRFs5aXnT0aGbaQkWYKVo4vuqcA@mail.gmail.com' \
--to=andrii.nakryiko@gmail.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=haoluo@google.com \
--cc=kafai@fb.com \
--cc=kpsingh@kernel.org \
--cc=songliubraving@fb.com \
--cc=yhs@fb.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).