From: Jiri Olsa <olsajiri@gmail.com>
To: Joanne Koong <joannelkoong@gmail.com>
Cc: bpf@vger.kernel.org, martin.lau@kernel.org, andrii@kernel.org,
ast@kernel.org, daniel@iogearbox.net, kernel-team@fb.com
Subject: Re: [PATCH v1 bpf-next] bpf: Tidy up verifier checking
Date: Fri, 17 Feb 2023 10:05:58 +0100 [thread overview]
Message-ID: <Y+9Ddvey0iPgC8ZS@krava> (raw)
In-Reply-To: <20230217005451.2438147-1-joannelkoong@gmail.com>
On Thu, Feb 16, 2023 at 04:54:51PM -0800, Joanne Koong wrote:
> This change refactors check_mem_access() to check against the base type of
> the register, and uses switch case checking instead of if / else if
> checks. This change also uses the existing clear_called_saved_regs()
> function for resetting caller saved regs in check_helper_call().
>
> Signed-off-by: Joanne Koong <joannelkoong@gmail.com>
> ---
> kernel/bpf/verifier.c | 67 +++++++++++++++++++++++++++++--------------
> 1 file changed, 46 insertions(+), 21 deletions(-)
>
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 272563a0b770..b40165be2943 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -5317,7 +5317,8 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
> /* for access checks, reg->off is just part of off */
> off += reg->off;
>
> - if (reg->type == PTR_TO_MAP_KEY) {
> + switch (base_type(reg->type)) {
> + case PTR_TO_MAP_KEY:
> if (t == BPF_WRITE) {
> verbose(env, "write to change key R%d not allowed\n", regno);
> return -EACCES;
> @@ -5329,7 +5330,10 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
> return err;
> if (value_regno >= 0)
> mark_reg_unknown(env, regs, value_regno);
> - } else if (reg->type == PTR_TO_MAP_VALUE) {
> +
> + break;
> + case PTR_TO_MAP_VALUE:
> + {
I'm getting failure in this test:
#92/1 jeq_infer_not_null/jeq_infer_not_null_ptr_to_btfid:FAIL
I wonder with this change we execute this case even if there's PTR_MAYBE_NULL set,
which we did not do before, so the test won't fail now as expected
> struct btf_field *kptr_field = NULL;
>
> if (t == BPF_WRITE && value_regno >= 0 &&
> @@ -5369,7 +5373,10 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
> mark_reg_unknown(env, regs, value_regno);
> }
> }
> - } else if (base_type(reg->type) == PTR_TO_MEM) {
> + break;
> + }
SNIP
> @@ -5521,7 +5539,17 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
>
> if (!err && value_regno >= 0 && (rdonly_mem || t == BPF_READ))
> mark_reg_unknown(env, regs, value_regno);
> - } else {
> + break;
> + }
> + case PTR_TO_BTF_ID:
> + if (!type_may_be_null(reg->type)) {
> + err = check_ptr_to_btf_access(env, regs, regno, off, size, t,
> + value_regno);
> + break;
> + } else {
> + fallthrough;
> + }
nit, no need for the else branch, just use fallthrough directly
> + default:
> verbose(env, "R%d invalid mem access '%s'\n", regno,
> reg_type_str(env, reg->type));
> return -EACCES;
> @@ -8377,10 +8405,7 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn
> return err;
>
> /* reset caller saved regs */
nit, we could remove the comment as well, the function name says it all
jirka
> - for (i = 0; i < CALLER_SAVED_REGS; i++) {
> - mark_reg_not_init(env, regs, caller_saved[i]);
> - check_reg_arg(env, caller_saved[i], DST_OP_NO_MARK);
> - }
> + clear_caller_saved_regs(env, regs);
>
> /* helper call returns 64-bit value. */
> regs[BPF_REG_0].subreg_def = DEF_NOT_SUBREG;
> --
> 2.30.2
>
next prev parent reply other threads:[~2023-02-17 9:06 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-02-17 0:54 [PATCH v1 bpf-next] bpf: Tidy up verifier checking Joanne Koong
2023-02-17 9:05 ` Jiri Olsa [this message]
2023-02-17 18:15 ` Joanne Koong
2023-02-17 21:06 ` Joanne Koong
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Y+9Ddvey0iPgC8ZS@krava \
--to=olsajiri@gmail.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=joannelkoong@gmail.com \
--cc=kernel-team@fb.com \
--cc=martin.lau@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox