Commit 283b40c5 authored by Martin KaFai Lau's avatar Martin KaFai Lau
Browse files

Merge branch 'bpf: Allow helpers access ptr_to_btf_id.' 



Alexei Starovoitov says:

====================

From: Alexei Starovoitov <ast@kernel.org>

Allow code like:
bpf_strncmp(task->comm, 16, "foo");
====================

Signed-off-by: default avatarMartin KaFai Lau <martin.lau@kernel.org>
parents b9fe8e8d f25fd608

kernel/bpf/helpers.c

+1 −1
Original line number Diff line number Diff line
@@ -571,7 +571,7 @@ static const struct bpf_func_proto bpf_strncmp_proto = { 
	.func		= bpf_strncmp,

	.gpl_only	= false,

	.ret_type	= RET_INTEGER,

	.arg1_type	= ARG_PTR_TO_MEM,

	.arg1_type	= ARG_PTR_TO_MEM | MEM_RDONLY,

	.arg2_type	= ARG_CONST_SIZE,

	.arg3_type	= ARG_PTR_TO_CONST_STR,

};

kernel/bpf/verifier.c

+15 −0
Original line number Diff line number Diff line
@@ -6303,6 +6303,9 @@ static int check_helper_mem_access(struct bpf_verifier_env *env, int regno, 
				env,

				regno, reg->off, access_size,

				zero_size_allowed, ACCESS_HELPER, meta);

	case PTR_TO_BTF_ID:

		return check_ptr_to_btf_access(env, regs, regno, reg->off,

					       access_size, BPF_READ, -1);

	case PTR_TO_CTX:

		/* in case the function doesn't know how to access the context,

		 * (because we are in a program of type SYSCALL for example), we
@@ -7014,6 +7017,7 @@ static const struct bpf_reg_types mem_types = { 
		PTR_TO_MEM,

		PTR_TO_MEM | MEM_RINGBUF,

		PTR_TO_BUF,

		PTR_TO_BTF_ID | PTR_TRUSTED,

	},

};








@@ -7145,6 +7149,17 @@ static int check_reg_type(struct bpf_verifier_env *env, u32 regno,







	if (base_type(reg->type) != PTR_TO_BTF_ID)









		return 0;

















	if (compatible == &mem_types) {









		if (!(arg_type & MEM_RDONLY)) {









			verbose(env,









				"%s() may write into memory pointed by R%d type=%s\n",









				func_id_name(meta->func_id),









				regno, reg_type_str(env, reg->type));









			return -EACCES;









		}









		return 0;









	}

















	switch ((int)reg->type) {









	case PTR_TO_BTF_ID:









	case PTR_TO_BTF_ID | PTR_TRUSTED:
































tools/testing/selftests/bpf/progs/task_kfunc_failure.c



+36
−0






























Original line number
Diff line number
Diff line







@@ -301,3 +301,39 @@ int BPF_PROG(task_kfunc_from_lsm_task_free, struct task_struct *task)







	bpf_task_release(acquired);









	return 0;









}



















SEC("tp_btf/task_newtask")









__failure __msg("access beyond the end of member comm")









int BPF_PROG(task_access_comm1, struct task_struct *task, u64 clone_flags)









{









	bpf_strncmp(task->comm, 17, "foo");









	return 0;









}



















SEC("tp_btf/task_newtask")









__failure __msg("access beyond the end of member comm")









int BPF_PROG(task_access_comm2, struct task_struct *task, u64 clone_flags)









{









	bpf_strncmp(task->comm + 1, 16, "foo");









	return 0;









}



















SEC("tp_btf/task_newtask")









__failure __msg("write into memory")









int BPF_PROG(task_access_comm3, struct task_struct *task, u64 clone_flags)









{









	bpf_probe_read_kernel(task->comm, 16, task->comm);









	return 0;









}



















SEC("fentry/__set_task_comm")









__failure __msg("R1 type=ptr_ expected")









int BPF_PROG(task_access_comm4, struct task_struct *task, const char *buf, bool exec)









{









	/*









	 * task->comm is a legacy ptr_to_btf_id. The verifier cannot guarantee









	 * its safety. Hence it cannot be accessed with normal load insns.









	 */









	bpf_strncmp(task->comm, 16, "foo");









	return 0;









}
























tools/testing/selftests/bpf/progs/task_kfunc_success.c



+4
−0






























Original line number
Diff line number
Diff line







@@ -207,6 +207,10 @@ int BPF_PROG(test_task_from_pid_invalid, struct task_struct *task, u64 clone_fla







	if (!is_test_kfunc_task())









		return 0;



















	bpf_strncmp(task->comm, 12, "foo");









	bpf_strncmp(task->comm, 16, "foo");









	bpf_strncmp(&task->comm[8], 4, "foo");



















	if (is_pid_lookup_valid(-1)) {









		err = 1;









		return 0;