Re: [PATCH v1 bpf-next] bpf: Tidy up verifier checking

[Jiri Olsa <olsajiri@gmail.com>]

On Thu, Feb 16, 2023 at 04:54:51PM -0800, Joanne Koong wrote:
> This change refactors check_mem_access() to check against the base type of
> the register, and uses switch case checking instead of if / else if
> checks. This change also uses the existing clear_called_saved_regs()
> function for resetting caller saved regs in check_helper_call().
> 
> Signed-off-by: Joanne Koong <joannelkoong@gmail.com>
> ---
>  kernel/bpf/verifier.c | 67 +++++++++++++++++++++++++++++--------------
>  1 file changed, 46 insertions(+), 21 deletions(-)
> 
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 272563a0b770..b40165be2943 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -5317,7 +5317,8 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
>  	/* for access checks, reg->off is just part of off */
>  	off += reg->off;
>  
> -	if (reg->type == PTR_TO_MAP_KEY) {
> +	switch (base_type(reg->type)) {
> +	case PTR_TO_MAP_KEY:
>  		if (t == BPF_WRITE) {
>  			verbose(env, "write to change key R%d not allowed\n", regno);
>  			return -EACCES;
> @@ -5329,7 +5330,10 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
>  			return err;
>  		if (value_regno >= 0)
>  			mark_reg_unknown(env, regs, value_regno);
> -	} else if (reg->type == PTR_TO_MAP_VALUE) {
> +
> +		break;
> +	case PTR_TO_MAP_VALUE:
> +	{

I'm getting failure in this test:
  #92/1    jeq_infer_not_null/jeq_infer_not_null_ptr_to_btfid:FAIL

I wonder with this change we execute this case even if there's PTR_MAYBE_NULL set,
which we did not do before, so the test won't fail now as expected

>  		struct btf_field *kptr_field = NULL;
>  
>  		if (t == BPF_WRITE && value_regno >= 0 &&
> @@ -5369,7 +5373,10 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
>  				mark_reg_unknown(env, regs, value_regno);
>  			}
>  		}
> -	} else if (base_type(reg->type) == PTR_TO_MEM) {
> +		break;
> +	}

SNIP

> @@ -5521,7 +5539,17 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
>  
>  		if (!err && value_regno >= 0 && (rdonly_mem || t == BPF_READ))
>  			mark_reg_unknown(env, regs, value_regno);
> -	} else {
> +		break;
> +	}
> +	case PTR_TO_BTF_ID:
> +		if (!type_may_be_null(reg->type)) {
> +			err = check_ptr_to_btf_access(env, regs, regno, off, size, t,
> +						      value_regno);
> +			break;
> +		} else {
> +			fallthrough;
> +		}

nit, no need for the else branch, just use fallthrough directly

> +	default:
>  		verbose(env, "R%d invalid mem access '%s'\n", regno,
>  			reg_type_str(env, reg->type));
>  		return -EACCES;
> @@ -8377,10 +8405,7 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn
>  		return err;
>  
>  	/* reset caller saved regs */

nit, we could remove the comment as well, the function name says it all

jirka

> -	for (i = 0; i < CALLER_SAVED_REGS; i++) {
> -		mark_reg_not_init(env, regs, caller_saved[i]);
> -		check_reg_arg(env, caller_saved[i], DST_OP_NO_MARK);
> -	}
> +	clear_caller_saved_regs(env, regs);
>  
>  	/* helper call returns 64-bit value. */
>  	regs[BPF_REG_0].subreg_def = DEF_NOT_SUBREG;
> -- 
> 2.30.2
>