Commit a672b2e3 authored by Daniel Borkmann's avatar Daniel Borkmann
Browse files

bpf: Fix ringbuf memory type confusion when passing to helpers 



The bpf_ringbuf_submit() and bpf_ringbuf_discard() have ARG_PTR_TO_ALLOC_MEM
in their bpf_func_proto definition as their first argument, and thus both expect
the result from a prior bpf_ringbuf_reserve() call which has a return type of
RET_PTR_TO_ALLOC_MEM_OR_NULL.

While the non-NULL memory from bpf_ringbuf_reserve() can be passed to other
helpers, the two sinks (bpf_ringbuf_submit(), bpf_ringbuf_discard()) right now
only enforce a register type of PTR_TO_MEM.

This can lead to potential type confusion since it would allow other PTR_TO_MEM
memory to be passed into the two sinks which did not come from bpf_ringbuf_reserve().

Add a new MEM_ALLOC composable type attribute for PTR_TO_MEM, and enforce that:

 - bpf_ringbuf_reserve() returns NULL or PTR_TO_MEM | MEM_ALLOC
 - bpf_ringbuf_submit() and bpf_ringbuf_discard() only take PTR_TO_MEM | MEM_ALLOC
   but not plain PTR_TO_MEM arguments via ARG_PTR_TO_ALLOC_MEM
 - however, other helpers might treat PTR_TO_MEM | MEM_ALLOC as plain PTR_TO_MEM
   to populate the memory area when they use ARG_PTR_TO_{UNINIT_,}MEM in their
   func proto description

Fixes: 457f4436 ("bpf: Implement BPF ring buffer and verifier support for it")
Reported-by: default avatarAlexei Starovoitov <ast@kernel.org>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Acked-by: default avatarJohn Fastabend <john.fastabend@gmail.com>
Acked-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent 64620e0a

include/linux/bpf.h

+7 −2
Original line number Diff line number Diff line
@@ -316,7 +316,12 @@ enum bpf_type_flag { 
	 */

	MEM_RDONLY		= BIT(1 + BPF_BASE_TYPE_BITS),



	__BPF_TYPE_LAST_FLAG	= MEM_RDONLY,

	/* MEM was "allocated" from a different helper, and cannot be mixed

	 * with regular non-MEM_ALLOC'ed MEM types.

	 */

	MEM_ALLOC		= BIT(2 + BPF_BASE_TYPE_BITS),



	__BPF_TYPE_LAST_FLAG	= MEM_ALLOC,

};



/* Max number of base types. */
@@ -400,7 +405,7 @@ enum bpf_return_type { 
	RET_PTR_TO_SOCKET_OR_NULL	= PTR_MAYBE_NULL | RET_PTR_TO_SOCKET,

	RET_PTR_TO_TCP_SOCK_OR_NULL	= PTR_MAYBE_NULL | RET_PTR_TO_TCP_SOCK,

	RET_PTR_TO_SOCK_COMMON_OR_NULL	= PTR_MAYBE_NULL | RET_PTR_TO_SOCK_COMMON,

	RET_PTR_TO_ALLOC_MEM_OR_NULL	= PTR_MAYBE_NULL | RET_PTR_TO_ALLOC_MEM,

	RET_PTR_TO_ALLOC_MEM_OR_NULL	= PTR_MAYBE_NULL | MEM_ALLOC | RET_PTR_TO_ALLOC_MEM,

	RET_PTR_TO_BTF_ID_OR_NULL	= PTR_MAYBE_NULL | RET_PTR_TO_BTF_ID,



	/* This must be the last entry. Its purpose is to ensure the enum is

kernel/bpf/verifier.c

+5 −1
Original line number Diff line number Diff line
@@ -570,6 +570,8 @@ static const char *reg_type_str(struct bpf_verifier_env *env, 


	if (type & MEM_RDONLY)

		strncpy(prefix, "rdonly_", 16);

	if (type & MEM_ALLOC)

		strncpy(prefix, "alloc_", 16);



	snprintf(env->type_str_buf, TYPE_STR_BUF_LEN, "%s%s%s",

		 prefix, str[base_type(type)], postfix);
@@ -5135,6 +5137,7 @@ static const struct bpf_reg_types mem_types = { 
		PTR_TO_MAP_KEY,

		PTR_TO_MAP_VALUE,

		PTR_TO_MEM,

		PTR_TO_MEM | MEM_ALLOC,

		PTR_TO_BUF,

	},

};
@@ -5152,7 +5155,7 @@ static const struct bpf_reg_types int_ptr_types = { 
static const struct bpf_reg_types fullsock_types = { .types = { PTR_TO_SOCKET } };

static const struct bpf_reg_types scalar_types = { .types = { SCALAR_VALUE } };

static const struct bpf_reg_types context_types = { .types = { PTR_TO_CTX } };

static const struct bpf_reg_types alloc_mem_types = { .types = { PTR_TO_MEM } };

static const struct bpf_reg_types alloc_mem_types = { .types = { PTR_TO_MEM | MEM_ALLOC } };

static const struct bpf_reg_types const_map_ptr_types = { .types = { CONST_PTR_TO_MAP } };

static const struct bpf_reg_types btf_ptr_types = { .types = { PTR_TO_BTF_ID } };

static const struct bpf_reg_types spin_lock_types = { .types = { PTR_TO_MAP_VALUE } };
@@ -5315,6 +5318,7 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg, 
	case PTR_TO_MAP_VALUE:

	case PTR_TO_MEM:

	case PTR_TO_MEM | MEM_RDONLY:

	case PTR_TO_MEM | MEM_ALLOC:

	case PTR_TO_BUF:

	case PTR_TO_BUF | MEM_RDONLY:

	case PTR_TO_STACK: