bpf.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH bpf-next v2 0/8] bpf: additional use-cases for untrusted PTR_TO_MEM
@ 2025-07-04 23:03 Eduard Zingerman
  2025-07-04 23:03 ` [PATCH bpf-next v2 1/8] bpf: make makr_btf_ld_reg return error for unexpected reg types Eduard Zingerman
                   ` (8 more replies)
  0 siblings, 9 replies; 10+ messages in thread
From: Eduard Zingerman @ 2025-07-04 23:03 UTC (permalink / raw)
  To: bpf, ast
  Cc: andrii, daniel, martin.lau, kernel-team, yonghong.song,
	Eduard Zingerman

This patch set introduces two usability enhancements leveraging
untrusted pointers to mem:
- When reading a pointer field from a PTR_TO_BTF_ID, the resulting
  value is now assumed to be PTR_TO_MEM|MEM_RDONLY|PTR_UNTRUSTED
  instead of SCALAR_VALUE, provided the pointer points to a primitive
  type.
- __arg_untrusted attribute for global function parameters,
  allowed for pointer arguments of both structural and primitive
  types:
  - For structural types, the attribute produces
    PTR_TO_BTF_ID|PTR_UNTRUSTED.
  - For primitive types, it yields
    PTR_TO_MEM|MEM_RDONLY|PTR_UNTRUSTED.

Here are examples enabled by the series:

  struct foo {
    int *arr;
  };
  ...
  p = bpf_core_cast(..., struct foo);
  bpf_for(i, 0, ...) {
    ... p->arr[i] ...       // load at any offset is allowed
  }

  int memcmp(void *a __arg_untrusted, void *b __arg_untrusted, size_t n) {
    bpf_for(i, 0, n)
      if (a[i] - b[i])      // load at any offset is allowed
        return ...;
    return 0;
  }

The patch-set was inspired by Anrii's series [1]. The goal of that
series was to define a generic global glob_match function, capable to
accept any pointer type:

  __weak int glob_match(const char *pat, const char *str);

  char filename_glob[32];

  void foo(...) {
    ...
    task = bpf_get_current_task_btf();
    filename = task->mm->exe_file->f_path.dentry->d_name.name;
    ... match_glob(filename_glob,  // pointer to map value
                   filename) ...   // scalar
  }

At the moment, there is no straightforward way to express such a
function. This patch-set makes it possible to define it as follows:

  __weak int glob_match(const char *pat __arg_untrusted,
                        const char *str __arg_untrusted);

[1] https://github.com/anakryiko/linux/tree/bpf-mem-cast

Changelog:
v1: https://lore.kernel.org/bpf/20250702224209.3300396-1-eddyz87@gmail.com/
v1 -> v2:
- Added safety check in btf_prepare_func_args() to ensure that only
  struct or primitive types could be combined with __arg_untrusted
  (Alexei).
- Removed unnecessary 'continue' btf_check_func_arg_match() (Alexei).
- Added test cases for __arg_untrusted pointers to enum and
  __arg_untrusted combined with non-kernel type (Kumar).
- Added acks from Kumar.

Eduard Zingerman (8):
  bpf: make makr_btf_ld_reg return error for unexpected reg types
  bpf: rdonly_untrusted_mem for btf id walk pointer leafs
  selftests/bpf: ptr_to_btf_id struct walk ending with primitive pointer
  bpf: attribute __arg_untrusted for global function parameters
  libbpf: __arg_untrusted in bpf_helpers.h
  selftests/bpf: test cases for __arg_untrusted
  bpf: support for void/primitive __arg_untrusted global func params
  selftests/bpf: tests for __arg_untrusted void * global func params

 include/linux/btf.h                           |   1 +
 kernel/bpf/btf.c                              |  57 +++++++-
 kernel/bpf/verifier.c                         |  77 +++++++---
 tools/lib/bpf/bpf_helpers.h                   |   1 +
 .../selftests/bpf/prog_tests/linked_list.c    |   2 +-
 .../bpf/progs/mem_rdonly_untrusted.c          |  31 ++++
 .../bpf/progs/verifier_global_ptr_args.c      | 134 ++++++++++++++++++
 7 files changed, 274 insertions(+), 29 deletions(-)

-- 
2.49.0


^ permalink raw reply	[flat|nested] 10+ messages in thread
end of thread, other threads:[~2025-07-07 15:29 UTC | newest]

Thread overview: 10+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-07-04 23:03 [PATCH bpf-next v2 0/8] bpf: additional use-cases for untrusted PTR_TO_MEM Eduard Zingerman
2025-07-04 23:03 ` [PATCH bpf-next v2 1/8] bpf: make makr_btf_ld_reg return error for unexpected reg types Eduard Zingerman
2025-07-04 23:03 ` [PATCH bpf-next v2 2/8] bpf: rdonly_untrusted_mem for btf id walk pointer leafs Eduard Zingerman
2025-07-04 23:03 ` [PATCH bpf-next v2 3/8] selftests/bpf: ptr_to_btf_id struct walk ending with primitive pointer Eduard Zingerman
2025-07-04 23:03 ` [PATCH bpf-next v2 4/8] bpf: attribute __arg_untrusted for global function parameters Eduard Zingerman
2025-07-04 23:03 ` [PATCH bpf-next v2 5/8] libbpf: __arg_untrusted in bpf_helpers.h Eduard Zingerman
2025-07-04 23:03 ` [PATCH bpf-next v2 6/8] selftests/bpf: test cases for __arg_untrusted Eduard Zingerman
2025-07-04 23:03 ` [PATCH bpf-next v2 7/8] bpf: support for void/primitive __arg_untrusted global func params Eduard Zingerman
2025-07-04 23:03 ` [PATCH bpf-next v2 8/8] selftests/bpf: tests for __arg_untrusted void * " Eduard Zingerman
2025-07-07 15:30 ` [PATCH bpf-next v2 0/8] bpf: additional use-cases for untrusted PTR_TO_MEM patchwork-bot+netdevbpf

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).