[PATCH bpf-next v1 3/4] bpf: Reject modified syscall PTR_TO_CTX for global subprogs

[Kumar Kartikeya Dwivedi <memxor@gmail.com>]

Now that syscall programs allow modified offsets to be passed as a
context argument, we must make sure that they are passed unmodified to
global subprogs. The reasoning is that we can have inconsistent and
potentially unsafe max_ctx_offset based checks if the global subprog is
used to access the ctx, or when it is replaced by an extension prog.
We'll need a post-processing pass to correctly identify the
max_ctx_offset across the call graph, but it's extra work for little
functional gain, hence just reject this case.

We have to make this change now, since we opened up the checks made in
check_func_arg_reg_off for BPF_PROG_TYPE_SYSCALL's PTR_TO_CTX in past
commits.

Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
---
 kernel/bpf/verifier.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 50639bb69d91..3f34510ec183 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -10778,6 +10778,17 @@ static int btf_check_func_arg_match(struct bpf_verifier_env *env, int subprog,
 				bpf_log(log, "arg#%d expects pointer to ctx\n", i);
 				return -EINVAL;
 			}
+			/*
+			 * We should not allow modified offset ctx to be passed
+			 * into global subprogs, to avoid messing up the math of
+			 * max_ctx_offset for the whole program. Supporting this
+			 * will require a post-verification pass, not worth it.
+			 */
+			if (resolve_prog_type(env->prog) == BPF_PROG_TYPE_SYSCALL &&
+			    (!tnum_is_const(reg->var_off) || reg->var_off.value)) {
+				bpf_log(log, "arg#%d of syscall prog must have zero offset\n", i);
+				return -EINVAL;
+			}
 		} else if (base_type(arg->arg_type) == ARG_PTR_TO_MEM) {
 			ret = check_func_arg_reg_off(env, reg, regno, ARG_DONTCARE);
 			if (ret < 0)
-- 
2.52.0