Commit 3e30be42 authored by Alexei Starovoitov's avatar Alexei Starovoitov Committed by Martin KaFai Lau
Browse files

bpf: Allow helpers access trusted PTR_TO_BTF_ID. 



The verifier rejects the code:
  bpf_strncmp(task->comm, 16, "my_task");
with the message:
  16: (85) call bpf_strncmp#182
  R1 type=trusted_ptr_ expected=fp, pkt, pkt_meta, map_key, map_value, mem, ringbuf_mem, buf

Teach the verifier that such access pattern is safe.
Do not allow untrusted and legacy ptr_to_btf_id to be passed into helpers.

Reported-by: default avatarDavid Vernet <void@manifault.com>
Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
Acked-by: default avatarDavid Vernet <void@manifault.com>
Link: https://lore.kernel.org/r/20230313235845.61029-3-alexei.starovoitov@gmail.com


Signed-off-by: default avatarMartin KaFai Lau <martin.lau@kernel.org>
parent c9267aa8

kernel/bpf/verifier.c

+15 −0
Original line number Diff line number Diff line
@@ -6303,6 +6303,9 @@ static int check_helper_mem_access(struct bpf_verifier_env *env, int regno, 
				env,

				regno, reg->off, access_size,

				zero_size_allowed, ACCESS_HELPER, meta);

	case PTR_TO_BTF_ID:

		return check_ptr_to_btf_access(env, regs, regno, reg->off,

					       access_size, BPF_READ, -1);

	case PTR_TO_CTX:

		/* in case the function doesn't know how to access the context,

		 * (because we are in a program of type SYSCALL for example), we
@@ -7014,6 +7017,7 @@ static const struct bpf_reg_types mem_types = { 
		PTR_TO_MEM,

		PTR_TO_MEM | MEM_RINGBUF,

		PTR_TO_BUF,

		PTR_TO_BTF_ID | PTR_TRUSTED,

	},

};








@@ -7145,6 +7149,17 @@ static int check_reg_type(struct bpf_verifier_env *env, u32 regno,







	if (base_type(reg->type) != PTR_TO_BTF_ID)









		return 0;

















	if (compatible == &mem_types) {









		if (!(arg_type & MEM_RDONLY)) {









			verbose(env,









				"%s() may write into memory pointed by R%d type=%s\n",









				func_id_name(meta->func_id),









				regno, reg_type_str(env, reg->type));









			return -EACCES;









		}









		return 0;









	}

















	switch ((int)reg->type) {









	case PTR_TO_BTF_ID:









	case PTR_TO_BTF_ID | PTR_TRUSTED: