[PATCH bpf-next v3 1/5] bpf: Don't apply the trusted field lists to an RCU-protected parent

[Justin Suess <utilityemal77@gmail.com>]

Walking a field in the __safe_trusted or __safe_trusted_or_null set
yields PTR_TRUSTED whenever the parent is trusted or RCU-protected. For
an RCU-protected parent that is wrong: RCU only keeps the parent's
memory valid, and the resulting pointer survives bpf_rcu_read_unlock()
as fully trusted. mm->exe_file read under bpf_rcu_read_lock() is
MEM_RCU, and file->f_inode walked out of it escapes the RCU critical
section as a trusted inode that can be dereferenced without PROBE_MEM
and passed to kfuncs expecting trusted arguments after the grace period.

Substituting MEM_RCU for PTR_TRUSTED on an RCU parent is not a fix
either. A field of an RCU-protected object is only safe to read under
RCU if the object it points to is itself RCU-freed: inode is, but
mm_struct is not, as __mmdrop() does kmem_cache_free() without a grace
period, so an RCU-protected vma would hand out vma->vm_mm as an RCU
pointer that can be freed under the reader.

Apply the trusted lists only to a trusted parent, so a field of an
RCU-protected parent falls through to the RCU lists and is otherwise
untrusted. Add file->f_inode to the __safe_rcu_or_null list: inode is
RCU-freed, and struct file is SLAB_TYPESAFE_BY_RCU, so a file read
under RCU may have been freed and reused, in which case init_file() has
zeroed f_inode. The field may be NULL and programs have to check it.
exe_file->f_inode is now rcu_ptr_or_null_inode, bounded by the critical
section like every other RCU pointer.

Fixes: 6fcd486b3a0a ("bpf: Refactor RCU enforcement in the verifier.")
Suggested-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Justin Suess <utilityemal77@gmail.com>
---
 kernel/bpf/verifier.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 5601d2056218..4a32875d7077 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -6517,6 +6517,11 @@ BTF_TYPE_SAFE_RCU_OR_NULL(struct request_sock) {
 	struct sock *sk;
 };
 
+/* struct file is SLAB_TYPESAFE_BY_RCU. A reused file has f_inode == NULL. */
+BTF_TYPE_SAFE_RCU_OR_NULL(struct file) {
+	struct inode *f_inode;
+};
+
 /* full trusted: these fields are trusted even outside of RCU CS and never NULL */
 BTF_TYPE_SAFE_TRUSTED(struct bpf_iter_meta) {
 	struct seq_file *seq;
@@ -6593,6 +6598,7 @@ static bool type_is_rcu_or_null(struct bpf_verifier_env *env,
 	BTF_TYPE_EMIT(BTF_TYPE_SAFE_RCU_OR_NULL(struct mm_struct));
 	BTF_TYPE_EMIT(BTF_TYPE_SAFE_RCU_OR_NULL(struct sk_buff));
 	BTF_TYPE_EMIT(BTF_TYPE_SAFE_RCU_OR_NULL(struct request_sock));
+	BTF_TYPE_EMIT(BTF_TYPE_SAFE_RCU_OR_NULL(struct file));
 
 	return btf_nested_type_is_trusted(&env->log, reg, field_name, btf_id, "__safe_rcu_or_null");
 }
@@ -6798,10 +6804,14 @@ static int check_ptr_to_btf_access(struct bpf_verifier_env *env,
 		 *
 		 * A regular RCU-protected pointer with __rcu tag can also be deemed
 		 * trusted if we are in an RCU CS. Such pointer can be NULL.
+		 *
+		 * If the parent is not trusted, the field can't regain trusted status.
 		 */
-		if (type_is_trusted(env, reg, field_name, btf_id)) {
+		bool trusted = is_trusted_reg(env, reg);
+
+		if (trusted && type_is_trusted(env, reg, field_name, btf_id)) {
 			flag |= PTR_TRUSTED;
-		} else if (type_is_trusted_or_null(env, reg, field_name, btf_id)) {
+		} else if (trusted && type_is_trusted_or_null(env, reg, field_name, btf_id)) {
 			flag |= PTR_TRUSTED | PTR_MAYBE_NULL;
 		} else if (in_rcu_cs(env) && !type_may_be_null(reg->type)) {
 			if (type_is_rcu(env, reg, field_name, btf_id)) {
-- 
2.55.0