[PATCH bpf-next v2 14/18] bpf: Check helper mem+size in ARG_PTR_TO_MEM case

[Amery Hung <ameryhung@gmail.com>]

check_func_arg() verified a variable-size memory argument across two
cases: ARG_PTR_TO_MEM was a no-op and the buffer+size pair was checked
only when the following ARG_MEM_SIZE argument was reached. Handle the
pair in the ARG_PTR_TO_MEM case instead, looking ahead to the size
register at regno + 1, mirroring the kfunc handling.

check_func_proto() already rejects a non-MEM_FIXED_SIZE ARG_PTR_TO_MEM
that is not paired with a following mem_size argument, so the size
register is guaranteed to exist and ARG_MEM_SIZE needs no case of its
own.

Signed-off-by: Amery Hung <ameryhung@gmail.com>
---
 kernel/bpf/verifier.c | 16 +++++++---------
 1 file changed, 7 insertions(+), 9 deletions(-)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 144c2d8aa492..2326b12a1531 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -8505,9 +8505,6 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
 		meta->subprogno = reg->subprogno;
 		break;
 	case ARG_PTR_TO_MEM:
-		/* The access to this pointer is only checked when we hit the
-		 * next is_mem_size argument below.
-		 */
 		if (arg_type & MEM_FIXED_SIZE) {
 			err = check_mem_reg(env, reg, argno_from_reg(regno), fn->arg_size[arg],
 					    arg_type & MEM_WRITE ? BPF_WRITE : BPF_READ, meta);
@@ -8515,14 +8512,15 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
 				return err;
 			if (arg_type & MEM_ALIGNED)
 				err = check_ptr_alignment(env, reg, 0, fn->arg_size[arg], true);
+		} else {
+			struct bpf_reg_state *size_reg = reg_state(env, regno + 1);
+
+			err = check_mem_size_reg(env, reg, size_reg, argno,
+						 argno_from_reg(regno + 1),
+						 arg_type & MEM_WRITE ? BPF_WRITE : BPF_READ,
+						 fn->arg_type[arg + 1] & SCALAR_MAYBE_ZERO, meta);
 		}
 		break;
-	case ARG_MEM_SIZE:
-		err = check_mem_size_reg(env, reg_state(env, regno - 1), reg,
-					 argno_from_reg(regno - 1), argno,
-					 fn->arg_type[arg - 1] & MEM_WRITE ? BPF_WRITE : BPF_READ,
-					 arg_type & SCALAR_MAYBE_ZERO, meta);
-		break;
 	case ARG_PTR_TO_DYNPTR:
 		err = process_dynptr_func(env, reg, argno, insn_idx, arg_type, &meta->ref_obj,
 					  &meta->dynptr);
-- 
2.52.0