From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Hao Luo <haoluo@google.com>,
Alexei Starovoitov <ast@kernel.org>
Subject: [PATCH 5.15 03/33] bpf: Replace ARG_XXX_OR_NULL with ARG_XXX | PTR_MAYBE_NULL
Date: Fri, 29 Apr 2022 12:41:50 +0200 [thread overview]
Message-ID: <20220429104052.444732851@linuxfoundation.org> (raw)
In-Reply-To: <20220429104052.345760505@linuxfoundation.org>
From: Hao Luo <haoluo@google.com>
commit 48946bd6a5d695c50b34546864b79c1f910a33c1 upstream.
We have introduced a new type to make bpf_arg composable, by
reserving high bits of bpf_arg to represent flags of a type.
One of the flags is PTR_MAYBE_NULL which indicates a pointer
may be NULL. When applying this flag to an arg_type, it means
the arg can take NULL pointer. This patch switches the
qualified arg_types to use this flag. The arg_types changed
in this patch include:
1. ARG_PTR_TO_MAP_VALUE_OR_NULL
2. ARG_PTR_TO_MEM_OR_NULL
3. ARG_PTR_TO_CTX_OR_NULL
4. ARG_PTR_TO_SOCKET_OR_NULL
5. ARG_PTR_TO_ALLOC_MEM_OR_NULL
6. ARG_PTR_TO_STACK_OR_NULL
This patch does not eliminate the use of these arg_types, instead
it makes them an alias to the 'ARG_XXX | PTR_MAYBE_NULL'.
Signed-off-by: Hao Luo <haoluo@google.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Link: https://lore.kernel.org/bpf/20211217003152.48334-3-haoluo@google.com
Cc: stable@vger.kernel.org # 5.15.x
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/bpf.h | 15 +++++++++------
kernel/bpf/verifier.c | 39 ++++++++++++++-------------------------
2 files changed, 23 insertions(+), 31 deletions(-)
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -327,13 +327,11 @@ enum bpf_arg_type {
ARG_PTR_TO_MAP_KEY, /* pointer to stack used as map key */
ARG_PTR_TO_MAP_VALUE, /* pointer to stack used as map value */
ARG_PTR_TO_UNINIT_MAP_VALUE, /* pointer to valid memory used to store a map value */
- ARG_PTR_TO_MAP_VALUE_OR_NULL, /* pointer to stack used as map value or NULL */
/* the following constraints used to prototype bpf_memcmp() and other
* functions that access data on eBPF program stack
*/
ARG_PTR_TO_MEM, /* pointer to valid memory (stack, packet, map value) */
- ARG_PTR_TO_MEM_OR_NULL, /* pointer to valid memory or NULL */
ARG_PTR_TO_UNINIT_MEM, /* pointer to memory does not need to be initialized,
* helper function must fill all bytes or clear
* them in error case.
@@ -343,26 +341,31 @@ enum bpf_arg_type {
ARG_CONST_SIZE_OR_ZERO, /* number of bytes accessed from memory or 0 */
ARG_PTR_TO_CTX, /* pointer to context */
- ARG_PTR_TO_CTX_OR_NULL, /* pointer to context or NULL */
ARG_ANYTHING, /* any (initialized) argument is ok */
ARG_PTR_TO_SPIN_LOCK, /* pointer to bpf_spin_lock */
ARG_PTR_TO_SOCK_COMMON, /* pointer to sock_common */
ARG_PTR_TO_INT, /* pointer to int */
ARG_PTR_TO_LONG, /* pointer to long */
ARG_PTR_TO_SOCKET, /* pointer to bpf_sock (fullsock) */
- ARG_PTR_TO_SOCKET_OR_NULL, /* pointer to bpf_sock (fullsock) or NULL */
ARG_PTR_TO_BTF_ID, /* pointer to in-kernel struct */
ARG_PTR_TO_ALLOC_MEM, /* pointer to dynamically allocated memory */
- ARG_PTR_TO_ALLOC_MEM_OR_NULL, /* pointer to dynamically allocated memory or NULL */
ARG_CONST_ALLOC_SIZE_OR_ZERO, /* number of allocated bytes requested */
ARG_PTR_TO_BTF_ID_SOCK_COMMON, /* pointer to in-kernel sock_common or bpf-mirrored bpf_sock */
ARG_PTR_TO_PERCPU_BTF_ID, /* pointer to in-kernel percpu type */
ARG_PTR_TO_FUNC, /* pointer to a bpf program function */
- ARG_PTR_TO_STACK_OR_NULL, /* pointer to stack or NULL */
+ ARG_PTR_TO_STACK, /* pointer to stack */
ARG_PTR_TO_CONST_STR, /* pointer to a null terminated read-only string */
ARG_PTR_TO_TIMER, /* pointer to bpf_timer */
__BPF_ARG_TYPE_MAX,
+ /* Extended arg_types. */
+ ARG_PTR_TO_MAP_VALUE_OR_NULL = PTR_MAYBE_NULL | ARG_PTR_TO_MAP_VALUE,
+ ARG_PTR_TO_MEM_OR_NULL = PTR_MAYBE_NULL | ARG_PTR_TO_MEM,
+ ARG_PTR_TO_CTX_OR_NULL = PTR_MAYBE_NULL | ARG_PTR_TO_CTX,
+ ARG_PTR_TO_SOCKET_OR_NULL = PTR_MAYBE_NULL | ARG_PTR_TO_SOCKET,
+ ARG_PTR_TO_ALLOC_MEM_OR_NULL = PTR_MAYBE_NULL | ARG_PTR_TO_ALLOC_MEM,
+ ARG_PTR_TO_STACK_OR_NULL = PTR_MAYBE_NULL | ARG_PTR_TO_STACK,
+
/* This must be the last entry. Its purpose is to ensure the enum is
* wide enough to hold the higher bits reserved for bpf_type_flag.
*/
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -478,14 +478,9 @@ static bool arg_type_may_be_refcounted(e
return type == ARG_PTR_TO_SOCK_COMMON;
}
-static bool arg_type_may_be_null(enum bpf_arg_type type)
+static bool type_may_be_null(u32 type)
{
- return type == ARG_PTR_TO_MAP_VALUE_OR_NULL ||
- type == ARG_PTR_TO_MEM_OR_NULL ||
- type == ARG_PTR_TO_CTX_OR_NULL ||
- type == ARG_PTR_TO_SOCKET_OR_NULL ||
- type == ARG_PTR_TO_ALLOC_MEM_OR_NULL ||
- type == ARG_PTR_TO_STACK_OR_NULL;
+ return type & PTR_MAYBE_NULL;
}
/* Determine whether the function releases some resources allocated by another
@@ -4796,9 +4791,8 @@ static int process_timer_func(struct bpf
static bool arg_type_is_mem_ptr(enum bpf_arg_type type)
{
- return type == ARG_PTR_TO_MEM ||
- type == ARG_PTR_TO_MEM_OR_NULL ||
- type == ARG_PTR_TO_UNINIT_MEM;
+ return base_type(type) == ARG_PTR_TO_MEM ||
+ base_type(type) == ARG_PTR_TO_UNINIT_MEM;
}
static bool arg_type_is_mem_size(enum bpf_arg_type type)
@@ -4932,31 +4926,26 @@ static const struct bpf_reg_types *compa
[ARG_PTR_TO_MAP_KEY] = &map_key_value_types,
[ARG_PTR_TO_MAP_VALUE] = &map_key_value_types,
[ARG_PTR_TO_UNINIT_MAP_VALUE] = &map_key_value_types,
- [ARG_PTR_TO_MAP_VALUE_OR_NULL] = &map_key_value_types,
[ARG_CONST_SIZE] = &scalar_types,
[ARG_CONST_SIZE_OR_ZERO] = &scalar_types,
[ARG_CONST_ALLOC_SIZE_OR_ZERO] = &scalar_types,
[ARG_CONST_MAP_PTR] = &const_map_ptr_types,
[ARG_PTR_TO_CTX] = &context_types,
- [ARG_PTR_TO_CTX_OR_NULL] = &context_types,
[ARG_PTR_TO_SOCK_COMMON] = &sock_types,
#ifdef CONFIG_NET
[ARG_PTR_TO_BTF_ID_SOCK_COMMON] = &btf_id_sock_common_types,
#endif
[ARG_PTR_TO_SOCKET] = &fullsock_types,
- [ARG_PTR_TO_SOCKET_OR_NULL] = &fullsock_types,
[ARG_PTR_TO_BTF_ID] = &btf_ptr_types,
[ARG_PTR_TO_SPIN_LOCK] = &spin_lock_types,
[ARG_PTR_TO_MEM] = &mem_types,
- [ARG_PTR_TO_MEM_OR_NULL] = &mem_types,
[ARG_PTR_TO_UNINIT_MEM] = &mem_types,
[ARG_PTR_TO_ALLOC_MEM] = &alloc_mem_types,
- [ARG_PTR_TO_ALLOC_MEM_OR_NULL] = &alloc_mem_types,
[ARG_PTR_TO_INT] = &int_ptr_types,
[ARG_PTR_TO_LONG] = &int_ptr_types,
[ARG_PTR_TO_PERCPU_BTF_ID] = &percpu_btf_ptr_types,
[ARG_PTR_TO_FUNC] = &func_ptr_types,
- [ARG_PTR_TO_STACK_OR_NULL] = &stack_ptr_types,
+ [ARG_PTR_TO_STACK] = &stack_ptr_types,
[ARG_PTR_TO_CONST_STR] = &const_str_ptr_types,
[ARG_PTR_TO_TIMER] = &timer_types,
};
@@ -4970,7 +4959,7 @@ static int check_reg_type(struct bpf_ver
const struct bpf_reg_types *compatible;
int i, j;
- compatible = compatible_reg_types[arg_type];
+ compatible = compatible_reg_types[base_type(arg_type)];
if (!compatible) {
verbose(env, "verifier internal error: unsupported arg type %d\n", arg_type);
return -EFAULT;
@@ -5051,15 +5040,14 @@ static int check_func_arg(struct bpf_ver
return -EACCES;
}
- if (arg_type == ARG_PTR_TO_MAP_VALUE ||
- arg_type == ARG_PTR_TO_UNINIT_MAP_VALUE ||
- arg_type == ARG_PTR_TO_MAP_VALUE_OR_NULL) {
+ if (base_type(arg_type) == ARG_PTR_TO_MAP_VALUE ||
+ base_type(arg_type) == ARG_PTR_TO_UNINIT_MAP_VALUE) {
err = resolve_map_arg_type(env, meta, &arg_type);
if (err)
return err;
}
- if (register_is_null(reg) && arg_type_may_be_null(arg_type))
+ if (register_is_null(reg) && type_may_be_null(arg_type))
/* A NULL register has a SCALAR_VALUE type, so skip
* type checking.
*/
@@ -5128,10 +5116,11 @@ skip_type_check:
err = check_helper_mem_access(env, regno,
meta->map_ptr->key_size, false,
NULL);
- } else if (arg_type == ARG_PTR_TO_MAP_VALUE ||
- (arg_type == ARG_PTR_TO_MAP_VALUE_OR_NULL &&
- !register_is_null(reg)) ||
- arg_type == ARG_PTR_TO_UNINIT_MAP_VALUE) {
+ } else if (base_type(arg_type) == ARG_PTR_TO_MAP_VALUE ||
+ base_type(arg_type) == ARG_PTR_TO_UNINIT_MAP_VALUE) {
+ if (type_may_be_null(arg_type) && register_is_null(reg))
+ return 0;
+
/* bpf_map_xxx(..., map_ptr, ..., value) call:
* check [value, value + map->value_size) validity
*/
next prev parent reply other threads:[~2022-04-29 10:45 UTC|newest]
Thread overview: 44+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-04-29 10:41 [PATCH 5.15 00/33] 5.15.37-rc1 review Greg Kroah-Hartman
2022-04-29 10:41 ` [PATCH 5.15 01/33] floppy: disable FDRAWCMD by default Greg Kroah-Hartman
2022-04-29 10:41 ` [PATCH 5.15 02/33] bpf: Introduce composable reg, ret and arg types Greg Kroah-Hartman
2022-04-29 10:41 ` Greg Kroah-Hartman [this message]
2022-04-29 10:41 ` [PATCH 5.15 04/33] bpf: Replace RET_XXX_OR_NULL with RET_XXX | PTR_MAYBE_NULL Greg Kroah-Hartman
2022-04-29 10:41 ` [PATCH 5.15 05/33] bpf: Replace PTR_TO_XXX_OR_NULL with PTR_TO_XXX " Greg Kroah-Hartman
2022-04-29 10:41 ` [PATCH 5.15 06/33] bpf: Introduce MEM_RDONLY flag Greg Kroah-Hartman
2022-04-29 10:41 ` [PATCH 5.15 07/33] bpf: Convert PTR_TO_MEM_OR_NULL to composable types Greg Kroah-Hartman
2022-04-29 10:41 ` [PATCH 5.15 08/33] bpf: Make per_cpu_ptr return rdonly PTR_TO_MEM Greg Kroah-Hartman
2022-04-29 10:41 ` [PATCH 5.15 09/33] bpf: Add MEM_RDONLY for helper args that are pointers to rdonly mem Greg Kroah-Hartman
2022-04-29 10:41 ` [PATCH 5.15 10/33] bpf/selftests: Test PTR_TO_RDONLY_MEM Greg Kroah-Hartman
2022-04-29 10:41 ` [PATCH 5.15 11/33] bpf: Fix crash due to out of bounds access into reg2btf_ids Greg Kroah-Hartman
2022-04-29 10:41 ` [PATCH 5.15 12/33] spi: cadence-quadspi: fix write completion support Greg Kroah-Hartman
2022-04-29 10:42 ` [PATCH 5.15 13/33] ARM: dts: socfpga: change qspi to "intel,socfpga-qspi" Greg Kroah-Hartman
2022-04-29 10:42 ` [PATCH 5.15 14/33] mm: kfence: fix objcgs vector allocation Greg Kroah-Hartman
2022-04-29 10:42 ` [PATCH 5.15 15/33] gup: Turn fault_in_pages_{readable,writeable} into fault_in_{readable,writeable} Greg Kroah-Hartman
2022-04-29 10:42 ` [PATCH 5.15 16/33] iov_iter: Turn iov_iter_fault_in_readable into fault_in_iov_iter_readable Greg Kroah-Hartman
2022-04-29 10:42 ` [PATCH 5.15 17/33] iov_iter: Introduce fault_in_iov_iter_writeable Greg Kroah-Hartman
2022-04-29 10:42 ` [PATCH 5.15 18/33] gfs2: Add wrapper for iomap_file_buffered_write Greg Kroah-Hartman
2022-04-29 10:42 ` [PATCH 5.15 19/33] gfs2: Clean up function may_grant Greg Kroah-Hartman
2022-04-29 10:42 ` [PATCH 5.15 20/33] gfs2: Introduce flag for glock holder auto-demotion Greg Kroah-Hartman
2022-04-29 10:42 ` [PATCH 5.15 21/33] gfs2: Move the inode glock locking to gfs2_file_buffered_write Greg Kroah-Hartman
2022-04-29 10:42 ` [PATCH 5.15 22/33] gfs2: Eliminate ip->i_gh Greg Kroah-Hartman
2022-04-29 10:42 ` [PATCH 5.15 23/33] gfs2: Fix mmap + page fault deadlocks for buffered I/O Greg Kroah-Hartman
2022-04-29 10:42 ` [PATCH 5.15 24/33] iomap: Fix iomap_dio_rw return value for user copies Greg Kroah-Hartman
2022-04-29 10:42 ` [PATCH 5.15 25/33] iomap: Support partial direct I/O on user copy failures Greg Kroah-Hartman
2022-04-29 10:42 ` [PATCH 5.15 26/33] iomap: Add done_before argument to iomap_dio_rw Greg Kroah-Hartman
2022-04-29 10:42 ` [PATCH 5.15 27/33] gup: Introduce FOLL_NOFAULT flag to disable page faults Greg Kroah-Hartman
2022-04-29 10:42 ` [PATCH 5.15 28/33] iov_iter: Introduce nofault " Greg Kroah-Hartman
2022-04-29 10:42 ` [PATCH 5.15 29/33] gfs2: Fix mmap + page fault deadlocks for direct I/O Greg Kroah-Hartman
2022-04-29 10:42 ` [PATCH 5.15 30/33] btrfs: fix deadlock due to page faults during direct IO reads and writes Greg Kroah-Hartman
2022-04-29 10:42 ` [PATCH 5.15 31/33] btrfs: fallback to blocking mode when doing async dio over multiple extents Greg Kroah-Hartman
2022-04-29 10:42 ` [PATCH 5.15 32/33] mm: gup: make fault_in_safe_writeable() use fixup_user_fault() Greg Kroah-Hartman
2022-04-29 10:42 ` [PATCH 5.15 33/33] selftests/bpf: Add test for reg2btf_ids out of bounds access Greg Kroah-Hartman
2022-06-24 10:33 ` Po-Hsu Lin
2022-06-24 11:09 ` Greg Kroah-Hartman
2022-07-01 12:51 ` Po-Hsu Lin
2022-04-29 16:39 ` [PATCH 5.15 00/33] 5.15.37-rc1 review Florian Fainelli
2022-04-29 17:15 ` Jon Hunter
2022-04-29 18:36 ` Shuah Khan
2022-04-29 21:14 ` Naresh Kamboju
2022-04-29 23:47 ` Guenter Roeck
2022-04-29 23:54 ` Ron Economos
2022-04-30 10:17 ` Sudip Mukherjee
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220429104052.444732851@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=ast@kernel.org \
--cc=haoluo@google.com \
--cc=linux-kernel@vger.kernel.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.