From: Lorenz Bauer <lmb@cloudflare.com>
To: ast@kernel.org, yhs@fb.com, daniel@iogearbox.net, kafai@fb.com
Cc: bpf@vger.kernel.org, kernel-team@cloudflare.com,
Lorenz Bauer <lmb@cloudflare.com>
Subject: [PATCH bpf-next 08/11] bpf: set meta->raw_mode for pointers to memory closer to it's use
Date: Fri, 4 Sep 2020 12:23:58 +0100 [thread overview]
Message-ID: <20200904112401.667645-9-lmb@cloudflare.com> (raw)
In-Reply-To: <20200904112401.667645-1-lmb@cloudflare.com>
If we encounter a pointer to memory, we set meta->raw_mode depending
on the type of memory we point at. What isn't obvious is that this
information is only used when the next memory size argument is
encountered.
Move the assignment closer to where it's used, and add a comment that
explains what is going on.
Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
---
kernel/bpf/verifier.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index ba710a702cae..734ae5af9db9 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -4027,7 +4027,6 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
type != PTR_TO_RDWR_BUF &&
type != expected_type)
goto err_type;
- meta->raw_mode = arg_type == ARG_PTR_TO_UNINIT_MEM;
} else if (arg_type_is_alloc_mem_ptr(arg_type)) {
expected_type = PTR_TO_MEM;
if (register_is_null(reg) &&
@@ -4120,6 +4119,11 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
err = check_helper_mem_access(env, regno,
meta->map_ptr->value_size, false,
meta);
+ } else if (arg_type_is_mem_ptr(arg_type)) {
+ /* The access to this pointer is only checked when we hit the
+ * next is_mem_size argument below.
+ */
+ meta->raw_mode = (arg_type == ARG_PTR_TO_UNINIT_MEM);
} else if (arg_type_is_mem_size(arg_type)) {
bool zero_size_allowed = (arg_type == ARG_CONST_SIZE_OR_ZERO);
--
2.25.1
next prev parent reply other threads:[~2020-09-04 11:28 UTC|newest]
Thread overview: 28+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-09-04 11:23 [PATCH bpf-next 00/11] RFC: Make check_func_arg table driven Lorenz Bauer
2020-09-04 11:23 ` [PATCH bpf-next 01/11] btf: Fix BTF_SET_START_GLOBAL macro Lorenz Bauer
2020-09-09 4:04 ` Andrii Nakryiko
2020-09-09 9:51 ` Lorenz Bauer
2020-09-04 11:23 ` [PATCH bpf-next 02/11] btf: add a global set of valid BTF socket ids Lorenz Bauer
2020-09-09 4:12 ` Andrii Nakryiko
2020-09-04 11:23 ` [PATCH bpf-next 03/11] btf: make btf_set_contains take a const pointer Lorenz Bauer
2020-09-09 4:13 ` Andrii Nakryiko
2020-09-04 11:23 ` [PATCH bpf-next 04/11] bpf: check scalar or invalid register in check_helper_mem_access Lorenz Bauer
2020-09-09 4:22 ` Andrii Nakryiko
2020-09-09 10:02 ` Lorenz Bauer
2020-09-04 11:23 ` [PATCH bpf-next 05/11] bpf: allow specifying a set of BTF IDs for helper arguments Lorenz Bauer
2020-09-06 23:04 ` Martin KaFai Lau
2020-09-07 9:15 ` Lorenz Bauer
2020-09-09 4:47 ` Andrii Nakryiko
2020-09-09 5:56 ` Martin KaFai Lau
2020-09-09 10:06 ` Lorenz Bauer
2020-09-09 10:11 ` Lorenz Bauer
2020-09-04 11:23 ` [PATCH bpf-next 06/11] bpf: make reference tracking in check_func_arg generic Lorenz Bauer
2020-09-09 4:50 ` Andrii Nakryiko
2020-09-04 11:23 ` [PATCH bpf-next 07/11] bpf: always check access to PTR_TO_CTX regardless of arg_type Lorenz Bauer
2020-09-04 11:23 ` Lorenz Bauer [this message]
2020-09-04 11:23 ` [PATCH bpf-next 09/11] bpf: check ARG_PTR_TO_SPINLOCK register type in check_func_arg Lorenz Bauer
2020-09-04 11:24 ` [PATCH bpf-next 10/11] bpf: hoist type checking for nullable arg types Lorenz Bauer
2020-09-09 5:07 ` Andrii Nakryiko
2020-09-04 11:24 ` [PATCH bpf-next 11/11] bpf: use a table to drive helper arg type checks Lorenz Bauer
2020-09-09 6:17 ` [PATCH bpf-next 00/11] RFC: Make check_func_arg table driven Martin KaFai Lau
2020-09-09 10:15 ` Lorenz Bauer
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200904112401.667645-9-lmb@cloudflare.com \
--to=lmb@cloudflare.com \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=kafai@fb.com \
--cc=kernel-team@cloudflare.com \
--cc=yhs@fb.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox