Commit c6b0337f authored by Alexei Starovoitov's avatar Alexei Starovoitov Committed by Daniel Borkmann
Browse files

bpf: Don't mark arguments to fentry/fexit programs as trusted. 



The PTR_TRUSTED flag should only be applied to pointers where the verifier can
guarantee that such pointers are valid.
The fentry/fexit/fmod_ret programs are not in this category.
Only arguments of SEC("tp_btf") and SEC("iter") programs are trusted
(which have BPF_TRACE_RAW_TP and BPF_TRACE_ITER attach_type correspondingly)

This bug was masked because convert_ctx_accesses() was converting trusted
loads into BPF_PROBE_MEM loads. Fix it as well.
The loads from trusted pointers don't need exception handling.

Fixes: 3f00c523 ("bpf: Allow trusted pointers to be passed to KF_TRUSTED_ARGS kfuncs")
Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20221124215314.55890-1-alexei.starovoitov@gmail.com
parent 6099754a

kernel/bpf/btf.c

+13 −3
Original line number Diff line number Diff line
@@ -5821,9 +5821,19 @@ static u32 get_ctx_arg_idx(struct btf *btf, const struct btf_type *func_proto, 
	return nr_args + 1;

}



static bool prog_type_args_trusted(enum bpf_prog_type prog_type)

static bool prog_args_trusted(const struct bpf_prog *prog)

{

	return prog_type == BPF_PROG_TYPE_TRACING || prog_type == BPF_PROG_TYPE_STRUCT_OPS;

	enum bpf_attach_type atype = prog->expected_attach_type;



	switch (prog->type) {

	case BPF_PROG_TYPE_TRACING:

		return atype == BPF_TRACE_RAW_TP || atype == BPF_TRACE_ITER;

	case BPF_PROG_TYPE_LSM:

	case BPF_PROG_TYPE_STRUCT_OPS:

		return true;

	default:

		return false;

	}

}



bool btf_ctx_access(int off, int size, enum bpf_access_type type,
@@ -5969,7 +5979,7 @@ bool btf_ctx_access(int off, int size, enum bpf_access_type type, 
	}



	info->reg_type = PTR_TO_BTF_ID;

	if (prog_type_args_trusted(prog->type))

	if (prog_args_trusted(prog))

		info->reg_type |= PTR_TRUSTED;



	if (tgt_prog) {

kernel/bpf/verifier.c

+0 −3
Original line number Diff line number Diff line
@@ -14905,7 +14905,6 @@ static int convert_ctx_accesses(struct bpf_verifier_env *env) 
			break;

		case PTR_TO_BTF_ID:

		case PTR_TO_BTF_ID | PTR_UNTRUSTED:

		case PTR_TO_BTF_ID | PTR_TRUSTED:

		/* PTR_TO_BTF_ID | MEM_ALLOC always has a valid lifetime, unlike

		 * PTR_TO_BTF_ID, and an active ref_obj_id, but the same cannot

		 * be said once it is marked PTR_UNTRUSTED, hence we must handle
@@ -14913,8 +14912,6 @@ static int convert_ctx_accesses(struct bpf_verifier_env *env) 
		 * for this case.

		 */

		case PTR_TO_BTF_ID | MEM_ALLOC | PTR_UNTRUSTED:

		case PTR_TO_BTF_ID | PTR_UNTRUSTED | PTR_TRUSTED:

		case PTR_TO_BTF_ID | PTR_UNTRUSTED | MEM_ALLOC | PTR_TRUSTED:

			if (type == BPF_READ) {

				insn->code = BPF_LDX | BPF_PROBE_MEM |

					BPF_SIZE((insn)->code);