Commit 9dfcfd4d authored Mar 08, 2022 by Hao Luo Committed by Zheng Zengkai Mar 08, 2022

bpf: Replace PTR_TO_XXX_OR_NULL with PTR_TO_XXX | PTR_MAYBE_NULL

mainline inclusion
from mainline-v5.17-rc1
commit c25b2ae1
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I4WRPV
CVE: CVE-2022-0500

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c25b2ae136039ffa820c26138ed4a5e5f3ab3841



--------------------------------

We have introduced a new type to make bpf_reg composable, by
allocating bits in the type to represent flags.

One of the flags is PTR_MAYBE_NULL which indicates a pointer
may be NULL. This patch switches the qualified reg_types to
use this flag. The reg_types changed in this patch include:

1. PTR_TO_MAP_VALUE_OR_NULL
2. PTR_TO_SOCKET_OR_NULL
3. PTR_TO_SOCK_COMMON_OR_NULL
4. PTR_TO_TCP_SOCK_OR_NULL
5. PTR_TO_BTF_ID_OR_NULL
6. PTR_TO_MEM_OR_NULL
7. PTR_TO_RDONLY_BUF_OR_NULL
8. PTR_TO_RDWR_BUF_OR_NULL

Signed-off-by: Hao Luo <haoluo@google.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/r/20211217003152.48334-5-haoluo@google.com


Conflicts:
	include/linux/bpf.h
	include/linux/bpf_verifier.h
	kernel/bpf/verifier.c
Signed-off-by: Pu Lehui <pulehui@huawei.com>
Reviewed-by: Kuohai Xu <xukuohai@huawei.com>
Signed-off-by: Zheng Zengkai <zhengzengkai@huawei.com>

parent 526bdce2

drivers/net/ethernet/netronome/nfp/bpf/fw.h

+2 −2

Original line number	Diff line number	Diff line
		@@ -13,8 +13,8 @@
		*/
		#define NFP_BPF_SCALAR_VALUE 1
		#define NFP_BPF_MAP_VALUE 4
		#define NFP_BPF_STACK 6
		#define NFP_BPF_PACKET_DATA 8
		#define NFP_BPF_STACK 5
		#define NFP_BPF_PACKET_DATA 7

		enum bpf_cap_tlv_type {
		NFP_BPF_CAP_TYPE_FUNC = 1,

include/linux/bpf.h

+8 −8

Original line number	Diff line number	Diff line
		@@ -417,18 +417,14 @@ enum bpf_reg_type {
		PTR_TO_CTX, /* reg points to bpf_context */
		CONST_PTR_TO_MAP, /* reg points to struct bpf_map */
		PTR_TO_MAP_VALUE, /* reg points to map element value */
		PTR_TO_MAP_VALUE_OR_NULL,/* points to map elem value or NULL */
		PTR_TO_STACK, /* reg == frame_pointer + offset */
		PTR_TO_PACKET_META, /* skb->data - meta_len */
		PTR_TO_PACKET, /* reg points to skb->data */
		PTR_TO_PACKET_END, /* skb->data + headlen */
		PTR_TO_FLOW_KEYS, /* reg points to bpf_flow_keys */
		PTR_TO_SOCKET, /* reg points to struct bpf_sock */
		PTR_TO_SOCKET_OR_NULL, /* reg points to struct bpf_sock or NULL */
		PTR_TO_SOCK_COMMON, /* reg points to sock_common */
		PTR_TO_SOCK_COMMON_OR_NULL, /* reg points to sock_common or NULL */
		PTR_TO_TCP_SOCK, /* reg points to struct tcp_sock */
		PTR_TO_TCP_SOCK_OR_NULL, /* reg points to struct tcp_sock or NULL */
		PTR_TO_TP_BUFFER, /* reg points to a writable raw tp's buffer */
		PTR_TO_XDP_SOCK, /* reg points to struct xdp_sock */
		/* PTR_TO_BTF_ID points to a kernel struct that does not need
		@@ -446,16 +442,20 @@ enum bpf_reg_type {
		* been checked for null. Used primarily to inform the verifier
		* an explicit null check is required for this struct.
		*/
		PTR_TO_BTF_ID_OR_NULL,
		PTR_TO_MEM, /* reg points to valid memory region */
		PTR_TO_MEM_OR_NULL, /* reg points to valid memory region or NULL */
		PTR_TO_RDONLY_BUF, /* reg points to a readonly buffer */
		PTR_TO_RDONLY_BUF_OR_NULL, /* reg points to a readonly buffer or NULL */
		PTR_TO_RDWR_BUF, /* reg points to a read/write buffer */
		PTR_TO_RDWR_BUF_OR_NULL, /* reg points to a read/write buffer or NULL */
		PTR_TO_PERCPU_BTF_ID, /* reg points to a percpu kernel variable */
		__BPF_REG_TYPE_MAX,

		/* Extended reg_types. */
		PTR_TO_MAP_VALUE_OR_NULL = PTR_MAYBE_NULL \| PTR_TO_MAP_VALUE,
		PTR_TO_SOCKET_OR_NULL = PTR_MAYBE_NULL \| PTR_TO_SOCKET,
		PTR_TO_SOCK_COMMON_OR_NULL = PTR_MAYBE_NULL \| PTR_TO_SOCK_COMMON,
		PTR_TO_TCP_SOCK_OR_NULL = PTR_MAYBE_NULL \| PTR_TO_TCP_SOCK,
		PTR_TO_BTF_ID_OR_NULL = PTR_MAYBE_NULL \| PTR_TO_BTF_ID,
		PTR_TO_MEM_OR_NULL = PTR_MAYBE_NULL \| PTR_TO_MEM,

		/* This must be the last entry. Its purpose is to ensure the enum is
		* wide enough to hold the higher bits reserved for bpf_type_flag.
		*/

include/linux/bpf_verifier.h

+4 −0

Original line number	Diff line number	Diff line
		@@ -17,6 +17,8 @@
		* that converting umax_value to int cannot overflow.
		*/
		#define BPF_MAX_VAR_SIZ (1 << 29)
		/* size of type_str_buf in bpf_verifier. */
		#define TYPE_STR_BUF_LEN 64

		/* Liveness marks, used for registers and spilled-regs (in stack slots).
		* Read marks propagate upwards until they find a write mark; they record that
		@@ -434,6 +436,8 @@ struct bpf_verifier_env {
		u32 peak_states;
		/* longest register parentage chain walked for liveness marking */
		u32 longest_mark_read_walk;
		/* buffer used in reg_type_str() to generate reg_type string */
		char type_str_buf[TYPE_STR_BUF_LEN];
		};

		__printf(2, 0) void bpf_verifier_vlog(struct bpf_verifier_log *log,

kernel/bpf/btf.c

+5 −2

Original line number	Diff line number	Diff line
		@@ -4525,10 +4525,13 @@ bool btf_ctx_access(int off, int size, enum bpf_access_type type,
		/* check for PTR_TO_RDONLY_BUF_OR_NULL or PTR_TO_RDWR_BUF_OR_NULL */
		for (i = 0; i < prog->aux->ctx_arg_info_size; i++) {
		const struct bpf_ctx_arg_aux *ctx_arg_info = &prog->aux->ctx_arg_info[i];
		u32 type, flag;

		type = base_type(ctx_arg_info->reg_type);
		flag = type_flag(ctx_arg_info->reg_type);
		if (ctx_arg_info->offset == off &&
		(ctx_arg_info->reg_type == PTR_TO_RDONLY_BUF_OR_NULL \|\|
		ctx_arg_info->reg_type == PTR_TO_RDWR_BUF_OR_NULL)) {
		(type == PTR_TO_RDWR_BUF \|\| type == PTR_TO_RDONLY_BUF) &&
		(flag & PTR_MAYBE_NULL)) {
		info->reg_type = ctx_arg_info->reg_type;
		return true;
		}

kernel/bpf/map_iter.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -174,9 +174,9 @@ static const struct bpf_iter_reg bpf_map_elem_reg_info = {
		.ctx_arg_info_size = 2,
		.ctx_arg_info = {
		{ offsetof(struct bpf_iter__bpf_map_elem, key),
		PTR_TO_RDONLY_BUF_OR_NULL },
		PTR_TO_RDONLY_BUF \| PTR_MAYBE_NULL },
		{ offsetof(struct bpf_iter__bpf_map_elem, value),
		PTR_TO_RDWR_BUF_OR_NULL },
		PTR_TO_RDWR_BUF \| PTR_MAYBE_NULL },
		},
		};