Commit be80a1d3 authored by Daniel Borkmann's avatar Daniel Borkmann
Browse files

bpf: Generalize check_ctx_reg for reuse with other types 



Generalize the check_ctx_reg() helper function into a more generic named one
so that it can be reused for other register types as well to check whether
their offset is non-zero. No functional change.

Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Acked-by: default avatarJohn Fastabend <john.fastabend@gmail.com>
Acked-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent 343e5375

include/linux/bpf_verifier.h

+2 −2
Original line number Diff line number Diff line
@@ -519,7 +519,7 @@ bpf_prog_offload_replace_insn(struct bpf_verifier_env *env, u32 off, 
void

bpf_prog_offload_remove_insns(struct bpf_verifier_env *env, u32 off, u32 cnt);



int check_ctx_reg(struct bpf_verifier_env *env,

int check_ptr_off_reg(struct bpf_verifier_env *env,

		      const struct bpf_reg_state *reg, int regno);

int check_mem_reg(struct bpf_verifier_env *env, struct bpf_reg_state *reg,

		   u32 regno, u32 mem_size);

kernel/bpf/btf.c

+1 −1
Original line number Diff line number Diff line
@@ -5686,7 +5686,7 @@ static int btf_check_func_arg_match(struct bpf_verifier_env *env, 
					i, btf_type_str(t));

				return -EINVAL;

			}

			if (check_ctx_reg(env, reg, regno))

			if (check_ptr_off_reg(env, reg, regno))

				return -EINVAL;

		} else if (is_kfunc && (reg->type == PTR_TO_BTF_ID || reg2btf_ids[reg->type])) {

			const struct btf_type *reg_ref_t;

kernel/bpf/verifier.c

+11 −10
Original line number Diff line number Diff line
@@ -3969,16 +3969,16 @@ static int get_callee_stack_depth(struct bpf_verifier_env *env, 
}

#endif



int check_ctx_reg(struct bpf_verifier_env *env,

int check_ptr_off_reg(struct bpf_verifier_env *env,

		      const struct bpf_reg_state *reg, int regno)

{

	/* Access to ctx or passing it to a helper is only allowed in

	 * its original, unmodified form.

	/* Access to this pointer-typed register or passing it to a helper

	 * is only allowed in its original, unmodified form.

	 */



	if (reg->off) {

		verbose(env, "dereference of modified ctx ptr R%d off=%d disallowed\n",

			regno, reg->off);

		verbose(env, "dereference of modified %s ptr R%d off=%d disallowed\n",

			reg_type_str(env, reg->type), regno, reg->off);

		return -EACCES;

	}
@@ -3986,7 +3986,8 @@ int check_ctx_reg(struct bpf_verifier_env *env, 
		char tn_buf[48];



		tnum_strn(tn_buf, sizeof(tn_buf), reg->var_off);

		verbose(env, "variable ctx access var_off=%s disallowed\n", tn_buf);

		verbose(env, "variable %s access var_off=%s disallowed\n",

			reg_type_str(env, reg->type), tn_buf);

		return -EACCES;

	}
@@ -4437,7 +4438,7 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn 
			return -EACCES;

		}



		err = check_ctx_reg(env, reg, regno);

		err = check_ptr_off_reg(env, reg, regno);

		if (err < 0)

			return err;
@@ -5305,7 +5306,7 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg, 
		return err;



	if (type == PTR_TO_CTX) {

		err = check_ctx_reg(env, reg, regno);

		err = check_ptr_off_reg(env, reg, regno);

		if (err < 0)

			return err;

	}
@@ -9651,7 +9652,7 @@ static int check_ld_abs(struct bpf_verifier_env *env, struct bpf_insn *insn) 
			return err;

	}



	err = check_ctx_reg(env, &regs[ctx_reg], ctx_reg);

	err = check_ptr_off_reg(env, &regs[ctx_reg], ctx_reg);

	if (err < 0)

		return err;