From: Kumar Kartikeya Dwivedi <memxor@gmail.com>
To: bpf@vger.kernel.org
Cc: Alexei Starovoitov <ast@kernel.org>,
Andrii Nakryiko <andrii@kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>,
Dave Marchevsky <davemarchevsky@fb.com>,
Delyan Kratunov <delyank@fb.com>
Subject: [PATCH bpf-next v1 13/25] bpf: Support locking bpf_spin_lock in local kptr
Date: Tue, 11 Oct 2022 06:52:28 +0530 [thread overview]
Message-ID: <20221011012240.3149-14-memxor@gmail.com> (raw)
In-Reply-To: <20221011012240.3149-1-memxor@gmail.com>
Allow locking a bpf_spin_lock embedded in local kptr, in addition to
already support map value pointers. The handling is similar to that
of map values, by just preserving the reg->id of local kptrs as well,
and adjusting process_spin_lock to work with non-PTR_TO_MAP_VALUE and
remember the id in verifier state.
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
---
kernel/bpf/helpers.c | 2 ++
kernel/bpf/verifier.c | 74 ++++++++++++++++++++++++++++++++-----------
2 files changed, 57 insertions(+), 19 deletions(-)
diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
index 19d20bf39708..882cd0ebf117 100644
--- a/kernel/bpf/helpers.c
+++ b/kernel/bpf/helpers.c
@@ -336,6 +336,7 @@ const struct bpf_func_proto bpf_spin_lock_proto = {
.gpl_only = false,
.ret_type = RET_VOID,
.arg1_type = ARG_PTR_TO_SPIN_LOCK,
+ .arg1_btf_id = BPF_PTR_POISON,
};
static inline void __bpf_spin_unlock_irqrestore(struct bpf_spin_lock *lock)
@@ -358,6 +359,7 @@ const struct bpf_func_proto bpf_spin_unlock_proto = {
.gpl_only = false,
.ret_type = RET_VOID,
.arg1_type = ARG_PTR_TO_SPIN_LOCK,
+ .arg1_btf_id = BPF_PTR_POISON,
};
void copy_map_value_locked(struct bpf_map *map, void *dst, void *src,
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 6ee8c06c2080..156c1a1254d5 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -453,8 +453,16 @@ static bool reg_type_not_null(enum bpf_reg_type type)
static bool reg_may_point_to_spin_lock(const struct bpf_reg_state *reg)
{
- return reg->type == PTR_TO_MAP_VALUE &&
- btf_type_fields_has_field(reg->map_ptr->fields_tab, BPF_SPIN_LOCK);
+ struct btf_type_fields *tab = NULL;
+
+ if (reg->type == PTR_TO_MAP_VALUE) {
+ tab = reg->map_ptr->fields_tab;
+ } else if (reg->type == (PTR_TO_BTF_ID | MEM_TYPE_LOCAL)) {
+ struct btf_struct_meta *meta = btf_find_struct_meta(reg->btf, reg->btf_id);
+ if (meta)
+ tab = meta->fields_tab;
+ }
+ return btf_type_fields_has_field(tab, BPF_SPIN_LOCK);
}
static bool type_is_rdonly_mem(u32 type)
@@ -5412,8 +5420,10 @@ static int process_spin_lock(struct bpf_verifier_env *env, int regno,
struct bpf_reg_state *regs = cur_regs(env), *reg = ®s[regno];
struct bpf_verifier_state *cur = env->cur_state;
bool is_const = tnum_is_const(reg->var_off);
- struct bpf_map *map = reg->map_ptr;
u64 val = reg->var_off.value;
+ struct btf_type_fields *tab;
+ struct bpf_map *map = NULL;
+ struct btf *btf = NULL;
if (!is_const) {
verbose(env,
@@ -5421,19 +5431,32 @@ static int process_spin_lock(struct bpf_verifier_env *env, int regno,
regno);
return -EINVAL;
}
- if (!map->btf) {
- verbose(env,
- "map '%s' has to have BTF in order to use bpf_spin_lock\n",
- map->name);
- return -EINVAL;
+ if (reg->type == PTR_TO_MAP_VALUE) {
+ map = reg->map_ptr;
+ if (!map->btf) {
+ verbose(env,
+ "map '%s' has to have BTF in order to use bpf_spin_lock\n",
+ map->name);
+ return -EINVAL;
+ }
+ tab = map->fields_tab;
+ } else {
+ struct btf_struct_meta *meta;
+
+ btf = reg->btf;
+ meta = btf_find_struct_meta(reg->btf, reg->btf_id);
+ if (meta)
+ tab = meta->fields_tab;
}
- if (!btf_type_fields_has_field(map->fields_tab, BPF_SPIN_LOCK)) {
- verbose(env, "map '%s' has no valid bpf_spin_lock\n", map->name);
+
+ if (!btf_type_fields_has_field(tab, BPF_SPIN_LOCK)) {
+ verbose(env, "%s '%s' has no valid bpf_spin_lock\n", map ? "map" : "local",
+ map ? map->name : "kptr");
return -EINVAL;
}
- if (map->fields_tab->spin_lock_off != val + reg->off) {
+ if (tab->spin_lock_off != val + reg->off) {
verbose(env, "off %lld doesn't point to 'struct bpf_spin_lock' that is at %d\n",
- val + reg->off, map->fields_tab->spin_lock_off);
+ val + reg->off, tab->spin_lock_off);
return -EINVAL;
}
if (is_lock) {
@@ -5649,13 +5672,19 @@ static const struct bpf_reg_types int_ptr_types = {
},
};
+static const struct bpf_reg_types spin_lock_types = {
+ .types = {
+ PTR_TO_MAP_VALUE,
+ PTR_TO_BTF_ID | MEM_TYPE_LOCAL,
+ }
+};
+
static const struct bpf_reg_types fullsock_types = { .types = { PTR_TO_SOCKET } };
static const struct bpf_reg_types scalar_types = { .types = { SCALAR_VALUE } };
static const struct bpf_reg_types context_types = { .types = { PTR_TO_CTX } };
static const struct bpf_reg_types alloc_mem_types = { .types = { PTR_TO_MEM | MEM_ALLOC } };
static const struct bpf_reg_types const_map_ptr_types = { .types = { CONST_PTR_TO_MAP } };
static const struct bpf_reg_types btf_ptr_types = { .types = { PTR_TO_BTF_ID } };
-static const struct bpf_reg_types spin_lock_types = { .types = { PTR_TO_MAP_VALUE } };
static const struct bpf_reg_types percpu_btf_ptr_types = { .types = { PTR_TO_BTF_ID | MEM_PERCPU } };
static const struct bpf_reg_types func_ptr_types = { .types = { PTR_TO_FUNC } };
static const struct bpf_reg_types stack_ptr_types = { .types = { PTR_TO_STACK } };
@@ -5759,8 +5788,13 @@ static int check_reg_type(struct bpf_verifier_env *env, u32 regno,
}
arg_btf_id = compatible->btf_id;
}
-
- if (meta->func_id == BPF_FUNC_kptr_xchg) {
+ if (meta->func_id == BPF_FUNC_spin_lock || meta->func_id == BPF_FUNC_spin_unlock) {
+ if (WARN_ON_ONCE(!(reg->type != (PTR_TO_BTF_ID | MEM_TYPE_LOCAL))))
+ return -EFAULT;
+ /* process_spin_lock later checks whether bpf_spin_lock
+ * field exists or not.
+ */
+ } if (meta->func_id == BPF_FUNC_kptr_xchg) {
if (map_kptr_match_type(env, meta->kptr_field, reg, regno))
return -EACCES;
} else {
@@ -5896,7 +5930,8 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
goto skip_type_check;
/* arg_btf_id and arg_size are in a union. */
- if (base_type(arg_type) == ARG_PTR_TO_BTF_ID)
+ if (base_type(arg_type) == ARG_PTR_TO_BTF_ID ||
+ base_type(arg_type) == ARG_PTR_TO_SPIN_LOCK)
arg_btf_id = fn->arg_btf_id[arg];
err = check_reg_type(env, regno, arg_type, arg_btf_id, meta);
@@ -6504,9 +6539,10 @@ static bool check_btf_id_ok(const struct bpf_func_proto *fn)
int i;
for (i = 0; i < ARRAY_SIZE(fn->arg_type); i++) {
- if (base_type(fn->arg_type[i]) == ARG_PTR_TO_BTF_ID && !fn->arg_btf_id[i])
- return false;
-
+ if (base_type(fn->arg_type[i]) == ARG_PTR_TO_BTF_ID)
+ return !!fn->arg_btf_id[i];
+ if (base_type(fn->arg_type[i]) == ARG_PTR_TO_SPIN_LOCK)
+ return fn->arg_btf_id[i] == BPF_PTR_POISON;
if (base_type(fn->arg_type[i]) != ARG_PTR_TO_BTF_ID && fn->arg_btf_id[i] &&
/* arg_btf_id and arg_size are in a union. */
(base_type(fn->arg_type[i]) != ARG_PTR_TO_MEM ||
--
2.34.1
next prev parent reply other threads:[~2022-10-11 1:26 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-10-11 1:22 [PATCH bpf-next v1 00/25] Local kptrs, BPF linked lists Kumar Kartikeya Dwivedi
2022-10-11 1:22 ` [PATCH bpf-next v1 01/25] bpf: Document UAPI details for special BPF types Kumar Kartikeya Dwivedi
2022-10-11 1:22 ` [PATCH bpf-next v1 02/25] bpf: Allow specifying volatile type modifier for kptrs Kumar Kartikeya Dwivedi
2022-10-11 1:22 ` [PATCH bpf-next v1 03/25] bpf: Clobber stack slot when writing over spilled PTR_TO_BTF_ID Kumar Kartikeya Dwivedi
2022-10-11 1:22 ` [PATCH bpf-next v1 04/25] bpf: Fix slot type check in check_stack_write_var_off Kumar Kartikeya Dwivedi
2022-10-11 1:22 ` [PATCH bpf-next v1 05/25] bpf: Drop reg_type_may_be_refcounted_or_null Kumar Kartikeya Dwivedi
2022-10-11 1:22 ` [PATCH bpf-next v1 06/25] bpf: Refactor kptr_off_tab into fields_tab Kumar Kartikeya Dwivedi
2022-10-11 1:22 ` [PATCH bpf-next v1 07/25] bpf: Consolidate spin_lock, timer management " Kumar Kartikeya Dwivedi
2022-10-11 1:22 ` [PATCH bpf-next v1 08/25] bpf: Refactor map->off_arr handling Kumar Kartikeya Dwivedi
2022-10-11 1:22 ` [PATCH bpf-next v1 09/25] bpf: Support bpf_list_head in map values Kumar Kartikeya Dwivedi
2022-10-11 1:22 ` [PATCH bpf-next v1 10/25] bpf: Introduce local kptrs Kumar Kartikeya Dwivedi
2022-10-11 1:22 ` [PATCH bpf-next v1 11/25] bpf: Recognize bpf_{spin_lock,list_head,list_node} in " Kumar Kartikeya Dwivedi
2022-10-11 1:22 ` [PATCH bpf-next v1 12/25] bpf: Verify ownership relationships for owning types Kumar Kartikeya Dwivedi
2022-10-11 1:22 ` Kumar Kartikeya Dwivedi [this message]
2022-10-11 1:22 ` [PATCH bpf-next v1 14/25] bpf: Allow locking bpf_spin_lock global variables Kumar Kartikeya Dwivedi
2022-10-11 1:22 ` [PATCH bpf-next v1 15/25] bpf: Rewrite kfunc argument handling Kumar Kartikeya Dwivedi
2022-10-11 1:22 ` [PATCH bpf-next v1 16/25] bpf: Drop kfunc bits from btf_check_func_arg_match Kumar Kartikeya Dwivedi
2022-10-11 1:22 ` [PATCH bpf-next v1 17/25] bpf: Support constant scalar arguments for kfuncs Kumar Kartikeya Dwivedi
2022-10-11 1:22 ` [PATCH bpf-next v1 18/25] bpf: Teach verifier about non-size constant arguments Kumar Kartikeya Dwivedi
2022-10-11 1:22 ` [PATCH bpf-next v1 19/25] bpf: Introduce bpf_kptr_new Kumar Kartikeya Dwivedi
2022-10-11 1:22 ` [PATCH bpf-next v1 20/25] bpf: Introduce bpf_kptr_drop Kumar Kartikeya Dwivedi
2022-10-11 1:22 ` [PATCH bpf-next v1 21/25] bpf: Permit NULL checking pointer with non-zero fixed offset Kumar Kartikeya Dwivedi
2022-10-11 1:22 ` [PATCH bpf-next v1 22/25] bpf: Introduce single ownership BPF linked list API Kumar Kartikeya Dwivedi
2022-10-11 1:22 ` [PATCH bpf-next v1 23/25] libbpf: Add support for private BSS map section Kumar Kartikeya Dwivedi
2022-10-11 1:22 ` [PATCH bpf-next v1 24/25] selftests/bpf: Add __contains macro to bpf_experimental.h Kumar Kartikeya Dwivedi
2022-10-11 1:22 ` [PATCH bpf-next v1 25/25] selftests/bpf: Add BPF linked list API tests Kumar Kartikeya Dwivedi
2022-10-11 1:51 ` [PATCH bpf-next v1 00/25] Local kptrs, BPF linked lists Kumar Kartikeya Dwivedi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20221011012240.3149-14-memxor@gmail.com \
--to=memxor@gmail.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=davemarchevsky@fb.com \
--cc=delyank@fb.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox