Commit 216e3cd2 authored by Hao Luo's avatar Hao Luo Committed by Alexei Starovoitov
Browse files

bpf: Add MEM_RDONLY for helper args that are pointers to rdonly mem. 



Some helper functions may modify its arguments, for example,
bpf_d_path, bpf_get_stack etc. Previously, their argument types
were marked as ARG_PTR_TO_MEM, which is compatible with read-only
mem types, such as PTR_TO_RDONLY_BUF. Therefore it's legitimate,
but technically incorrect, to modify a read-only memory by passing
it into one of such helper functions.

This patch tags the bpf_args compatible with immutable memory with
MEM_RDONLY flag. The arguments that don't have this flag will be
only compatible with mutable memory types, preventing the helper
from modifying a read-only memory. The bpf_args that have
MEM_RDONLY are compatible with both mutable memory and immutable
memory.

Signed-off-by: default avatarHao Luo <haoluo@google.com>
Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20211217003152.48334-9-haoluo@google.com
parent 34d3a78c

include/linux/bpf.h

+3 −1
Original line number Diff line number Diff line
@@ -311,7 +311,9 @@ enum bpf_type_flag { 
	/* PTR may be NULL. */

	PTR_MAYBE_NULL		= BIT(0 + BPF_BASE_TYPE_BITS),



	/* MEM is read-only. */

	/* MEM is read-only. When applied on bpf_arg, it indicates the arg is

	 * compatible with both mutable and immutable memory.

	 */

	MEM_RDONLY		= BIT(1 + BPF_BASE_TYPE_BITS),



	__BPF_TYPE_LAST_FLAG	= MEM_RDONLY,

kernel/bpf/btf.c

+1 −1
Original line number Diff line number Diff line
@@ -6353,7 +6353,7 @@ const struct bpf_func_proto bpf_btf_find_by_name_kind_proto = { 
	.func		= bpf_btf_find_by_name_kind,

	.gpl_only	= false,

	.ret_type	= RET_INTEGER,

	.arg1_type	= ARG_PTR_TO_MEM,

	.arg1_type	= ARG_PTR_TO_MEM | MEM_RDONLY,

	.arg2_type	= ARG_CONST_SIZE,

	.arg3_type	= ARG_ANYTHING,

	.arg4_type	= ARG_ANYTHING,

kernel/bpf/cgroup.c

+1 −1
Original line number Diff line number Diff line
@@ -1789,7 +1789,7 @@ static const struct bpf_func_proto bpf_sysctl_set_new_value_proto = { 
	.gpl_only	= false,

	.ret_type	= RET_INTEGER,

	.arg1_type	= ARG_PTR_TO_CTX,

	.arg2_type	= ARG_PTR_TO_MEM,

	.arg2_type	= ARG_PTR_TO_MEM | MEM_RDONLY,

	.arg3_type	= ARG_CONST_SIZE,

};

kernel/bpf/helpers.c

+4 −4
Original line number Diff line number Diff line
@@ -531,7 +531,7 @@ const struct bpf_func_proto bpf_strtol_proto = { 
	.func		= bpf_strtol,

	.gpl_only	= false,

	.ret_type	= RET_INTEGER,

	.arg1_type	= ARG_PTR_TO_MEM,

	.arg1_type	= ARG_PTR_TO_MEM | MEM_RDONLY,

	.arg2_type	= ARG_CONST_SIZE,

	.arg3_type	= ARG_ANYTHING,

	.arg4_type	= ARG_PTR_TO_LONG,
@@ -559,7 +559,7 @@ const struct bpf_func_proto bpf_strtoul_proto = { 
	.func		= bpf_strtoul,

	.gpl_only	= false,

	.ret_type	= RET_INTEGER,

	.arg1_type	= ARG_PTR_TO_MEM,

	.arg1_type	= ARG_PTR_TO_MEM | MEM_RDONLY,

	.arg2_type	= ARG_CONST_SIZE,

	.arg3_type	= ARG_ANYTHING,

	.arg4_type	= ARG_PTR_TO_LONG,
@@ -645,7 +645,7 @@ const struct bpf_func_proto bpf_event_output_data_proto = { 
	.arg1_type      = ARG_PTR_TO_CTX,

	.arg2_type      = ARG_CONST_MAP_PTR,

	.arg3_type      = ARG_ANYTHING,

	.arg4_type      = ARG_PTR_TO_MEM,

	.arg4_type      = ARG_PTR_TO_MEM | MEM_RDONLY,

	.arg5_type      = ARG_CONST_SIZE_OR_ZERO,

};
@@ -1026,7 +1026,7 @@ const struct bpf_func_proto bpf_snprintf_proto = { 
	.arg1_type	= ARG_PTR_TO_MEM_OR_NULL,

	.arg2_type	= ARG_CONST_SIZE_OR_ZERO,

	.arg3_type	= ARG_PTR_TO_CONST_STR,

	.arg4_type	= ARG_PTR_TO_MEM_OR_NULL,

	.arg4_type	= ARG_PTR_TO_MEM | PTR_MAYBE_NULL | MEM_RDONLY,

	.arg5_type	= ARG_CONST_SIZE_OR_ZERO,

};

kernel/bpf/ringbuf.c

+1 −1
Original line number Diff line number Diff line
@@ -444,7 +444,7 @@ const struct bpf_func_proto bpf_ringbuf_output_proto = { 
	.func		= bpf_ringbuf_output,

	.ret_type	= RET_INTEGER,

	.arg1_type	= ARG_CONST_MAP_PTR,

	.arg2_type	= ARG_PTR_TO_MEM,

	.arg2_type	= ARG_PTR_TO_MEM | MEM_RDONLY,

	.arg3_type	= ARG_CONST_SIZE_OR_ZERO,

	.arg4_type	= ARG_ANYTHING,

};