Commit 87680ac7 authored by Alexei Starovoitov's avatar Alexei Starovoitov
Browse files

Merge branch 'fix-for-check_func_arg_reg_off' 

Kumar Kartikeya Dwivedi says:

====================
Fix for check_func_arg_reg_off

Remove a leftover hunk in check_func_arg_reg_off that incorrectly
bypasses reg->off == 0 requirement for release kfuncs and helpers.
====================

Link: https://lore.kernel.org/r/20230822175140.1317749-1-memxor@gmail.com


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parents fb301594 fbc5bc4c

kernel/bpf/verifier.c

+0 −11
Original line number Diff line number Diff line
@@ -7973,17 +7973,6 @@ int check_func_arg_reg_off(struct bpf_verifier_env *env, 
		if (arg_type_is_dynptr(arg_type) && type == PTR_TO_STACK)

			return 0;









		if ((type_is_ptr_alloc_obj(type) || type_is_non_owning_ref(type)) && reg->off) {









			if (reg_find_field_offset(reg, reg->off, BPF_GRAPH_NODE_OR_ROOT))









				return __check_ptr_off_reg(env, reg, regno, true);

















			verbose(env, "R%d must have zero offset when passed to release func\n",









				regno);









			verbose(env, "No graph node or root found at R%d type:%s off:%d\n", regno,









				btf_type_name(reg->btf, reg->btf_id), reg->off);









			return -EINVAL;









		}

















		/* Doing check_ptr_off_reg check for the offset will catch this









		 * because fixed_off_ok is false, but checking here allows us









		 * to give the user a better error message.
































tools/testing/selftests/bpf/progs/local_kptr_stash_fail.c



+20
−0






























Original line number
Diff line number
Diff line







@@ -62,4 +62,24 @@ long stash_rb_nodes(void *ctx)







	return 0;









}



















SEC("tc")









__failure __msg("R1 must have zero offset when passed to release func")









long drop_rb_node_off(void *ctx)









{









	struct map_value *mapval;









	struct node_data *res;









	int idx = 0;



















	mapval = bpf_map_lookup_elem(&some_nodes, &idx);









	if (!mapval)









		return 1;



















	res = bpf_obj_new(typeof(*res));









	if (!res)









		return 1;









	/* Try releasing with graph node offset */









	bpf_obj_drop(&res->node);









	return 0;









}



















char _license[] SEC("license") = "GPL";