Commit c18f0b6a authored by Lorenz Bauer's avatar Lorenz Bauer Committed by Alexei Starovoitov
Browse files

bpf: Check ARG_PTR_TO_SPINLOCK register type in check_func_arg 



Move the check for PTR_TO_MAP_VALUE to check_func_arg, where all other
checking is done as well. Move the invocation of process_spin_lock away
from the register type checking, to allow a future refactoring.

Signed-off-by: default avatarLorenz Bauer <lmb@cloudflare.com>
Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
Acked-by: default avatarMartin KaFai Lau <kafai@fb.com>
Link: https://lore.kernel.org/bpf/20200921121227.255763-10-lmb@cloudflare.com
parent a2bbe7cc

kernel/bpf/verifier.c

+14 −14
Original line number Diff line number Diff line
@@ -3828,10 +3828,6 @@ static int process_spin_lock(struct bpf_verifier_env *env, int regno, 
	struct bpf_map *map = reg->map_ptr;

	u64 val = reg->var_off.value;



	if (reg->type != PTR_TO_MAP_VALUE) {

		verbose(env, "R%d is not a pointer to map_value\n", regno);

		return -EINVAL;

	}

	if (!is_const) {

		verbose(env,

			"R%d doesn't have constant offset. bpf_spin_lock has to be at the constant offset\n",
@@ -4040,16 +4036,9 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg, 
		if (type != expected_type)

			goto err_type;

	} else if (arg_type == ARG_PTR_TO_SPIN_LOCK) {

		if (meta->func_id == BPF_FUNC_spin_lock) {

			if (process_spin_lock(env, regno, true))

				return -EACCES;

		} else if (meta->func_id == BPF_FUNC_spin_unlock) {

			if (process_spin_lock(env, regno, false))

				return -EACCES;

		} else {

			verbose(env, "verifier internal error\n");

			return -EFAULT;

		}

		expected_type = PTR_TO_MAP_VALUE;

		if (type != expected_type)

			goto err_type;

	} else if (arg_type_is_mem_ptr(arg_type)) {

		expected_type = PTR_TO_STACK;

		/* One exception here. In case function allows for NULL to be
@@ -4155,6 +4144,17 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg, 
		err = check_helper_mem_access(env, regno,

					      meta->map_ptr->value_size, false,

					      meta);

	} else if (arg_type == ARG_PTR_TO_SPIN_LOCK) {

		if (meta->func_id == BPF_FUNC_spin_lock) {

			if (process_spin_lock(env, regno, true))

				return -EACCES;

		} else if (meta->func_id == BPF_FUNC_spin_unlock) {

			if (process_spin_lock(env, regno, false))

				return -EACCES;

		} else {

			verbose(env, "verifier internal error\n");

			return -EFAULT;

		}

	} else if (arg_type_is_mem_ptr(arg_type)) {

		/* The access to this pointer is only checked when we hit the

		 * next is_mem_size argument below.