From: Kumar Kartikeya Dwivedi <memxor@gmail.com>
To: bpf@vger.kernel.org
Cc: "Alexei Starovoitov" <ast@kernel.org>,
"Andrii Nakryiko" <andrii@kernel.org>,
"Daniel Borkmann" <daniel@iogearbox.net>,
"Toke Høiland-Jørgensen" <toke@redhat.com>,
"Jesper Dangaard Brouer" <hawk@kernel.org>,
netfilter-devel@vger.kernel.org, netdev@vger.kernel.org
Subject: [PATCH bpf-next v1 06/15] bpf: Allow storing __user PTR_TO_BTF_ID in map
Date: Sun, 20 Feb 2022 19:18:04 +0530 [thread overview]
Message-ID: <20220220134813.3411982-7-memxor@gmail.com> (raw)
In-Reply-To: <20220220134813.3411982-1-memxor@gmail.com>
Recently, verifier gained __user annotation support [0] where it
prevents BPF program from normally derefering user memory pointer in the
kernel, and instead requires use of bpf_probe_read_user. We can allow
the user to also store these pointers in BPF maps, with the logic that
whenever user loads it from the BPF map, it gets marked as MEM_USER.
[0]: https://lore.kernel.org/bpf/20220127154555.650886-1-yhs@fb.com
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
---
include/linux/bpf.h | 1 +
kernel/bpf/btf.c | 20 +++++++++++++++-----
kernel/bpf/verifier.c | 21 +++++++++++++++------
3 files changed, 31 insertions(+), 11 deletions(-)
diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 843c8c01cf9d..37ca92f4c7b7 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -163,6 +163,7 @@ enum {
enum {
BPF_MAP_VALUE_OFF_F_REF = (1U << 0),
BPF_MAP_VALUE_OFF_F_PERCPU = (1U << 1),
+ BPF_MAP_VALUE_OFF_F_USER = (1U << 2),
};
struct bpf_map_value_off_desc {
diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
index eb57584ee0a8..bafceae90c32 100644
--- a/kernel/bpf/btf.c
+++ b/kernel/bpf/btf.c
@@ -3146,7 +3146,7 @@ static s32 btf_find_by_name_kind_all(const char *name, u32 kind, struct btf **bt
static int btf_find_field_kptr(const struct btf *btf, const struct btf_type *t,
u32 off, int sz, void *data)
{
- bool btf_id_tag = false, ref_tag = false, percpu_tag = false;
+ bool btf_id_tag = false, ref_tag = false, percpu_tag = false, user_tag = false;
struct bpf_map_value_off *tab;
struct bpf_map *map = data;
int nr_off, ret, flags = 0;
@@ -3181,6 +3181,13 @@ static int btf_find_field_kptr(const struct btf *btf, const struct btf_type *t,
goto end;
}
percpu_tag = true;
+ } else if (!strcmp("kernel.bpf.user", __btf_name_by_offset(btf, t->name_off))) {
+ /* repeated tag */
+ if (user_tag) {
+ ret = -EINVAL;
+ goto end;
+ }
+ user_tag = true;
} else if (!strncmp("kernel.", __btf_name_by_offset(btf, t->name_off),
sizeof("kernel.") - 1)) {
/* TODO: Should we reject these when loading BTF? */
@@ -3192,15 +3199,16 @@ static int btf_find_field_kptr(const struct btf *btf, const struct btf_type *t,
t = btf_type_by_id(btf, t->type);
}
if (!btf_id_tag) {
- /* 'ref' or 'percpu' tag must be specified together with 'btf_id' tag */
- if (ref_tag || percpu_tag) {
+ /* 'ref', 'percpu', 'user' tag must be specified together with 'btf_id' tag */
+ if (ref_tag || percpu_tag || user_tag) {
ret = -EINVAL;
goto end;
}
return 0;
}
- /* referenced percpu btf_id pointer is not yet supported */
- if (ref_tag && percpu_tag) {
+ /* All three are mutually exclusive */
+ ret = ref_tag + percpu_tag + user_tag;
+ if (ret > 1) {
ret = -EINVAL;
goto end;
}
@@ -3257,6 +3265,8 @@ static int btf_find_field_kptr(const struct btf *btf, const struct btf_type *t,
flags |= BPF_MAP_VALUE_OFF_F_REF;
else if (percpu_tag)
flags |= BPF_MAP_VALUE_OFF_F_PERCPU;
+ else if (user_tag)
+ flags |= BPF_MAP_VALUE_OFF_F_USER;
tab->off[nr_off].offset = off;
tab->off[nr_off].btf_id = id;
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 00d6ab49033d..28da858bb921 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -3482,7 +3482,11 @@ static int map_ptr_to_btf_id_match_type(struct bpf_verifier_env *env,
enum bpf_reg_type reg_type;
const char *reg_name = "";
- if (off_desc->flags & BPF_MAP_VALUE_OFF_F_PERCPU) {
+ if (off_desc->flags & BPF_MAP_VALUE_OFF_F_USER) {
+ if (reg->type != (PTR_TO_BTF_ID | MEM_USER) &&
+ reg->type != (PTR_TO_BTF_ID | PTR_MAYBE_NULL | MEM_USER))
+ goto end;
+ } else if (off_desc->flags & BPF_MAP_VALUE_OFF_F_PERCPU) {
if (reg->type != PTR_TO_PERCPU_BTF_ID &&
reg->type != (PTR_TO_PERCPU_BTF_ID | PTR_MAYBE_NULL))
goto end;
@@ -3536,7 +3540,9 @@ static int map_ptr_to_btf_id_match_type(struct bpf_verifier_env *env,
return 0;
end:
- if (off_desc->flags & BPF_MAP_VALUE_OFF_F_PERCPU)
+ if (off_desc->flags & BPF_MAP_VALUE_OFF_F_USER)
+ reg_type = PTR_TO_BTF_ID | PTR_MAYBE_NULL | MEM_USER;
+ else if (off_desc->flags & BPF_MAP_VALUE_OFF_F_PERCPU)
reg_type = PTR_TO_PERCPU_BTF_ID | PTR_MAYBE_NULL;
else
reg_type = PTR_TO_BTF_ID | PTR_MAYBE_NULL;
@@ -3556,14 +3562,14 @@ static int check_map_ptr_to_btf_id(struct bpf_verifier_env *env, u32 regno, int
struct bpf_reg_state *atomic_load_reg)
{
struct bpf_reg_state *reg = reg_state(env, regno), *val_reg;
+ bool ref_ptr = false, percpu_ptr = false, user_ptr = false;
struct bpf_insn *insn = &env->prog->insnsi[insn_idx];
enum bpf_reg_type reg_type = PTR_TO_BTF_ID;
- bool ref_ptr = false, percpu_ptr = false;
struct bpf_map_value_off_desc *off_desc;
int insn_class = BPF_CLASS(insn->code);
+ int ret, reg_flags = PTR_MAYBE_NULL;
struct bpf_map *map = reg->map_ptr;
u32 ref_obj_id = 0;
- int ret;
/* Things we already checked for in check_map_access:
* - Reject cases where variable offset may touch BTF ID pointer
@@ -3590,8 +3596,11 @@ static int check_map_ptr_to_btf_id(struct bpf_verifier_env *env, u32 regno, int
ref_ptr = off_desc->flags & BPF_MAP_VALUE_OFF_F_REF;
percpu_ptr = off_desc->flags & BPF_MAP_VALUE_OFF_F_PERCPU;
+ user_ptr = off_desc->flags & BPF_MAP_VALUE_OFF_F_USER;
if (percpu_ptr)
reg_type = PTR_TO_PERCPU_BTF_ID;
+ else if (user_ptr)
+ reg_flags |= MEM_USER;
if (is_xchg_insn(insn)) {
/* We do checks and updates during register fill call for fetch case */
@@ -3623,7 +3632,7 @@ static int check_map_ptr_to_btf_id(struct bpf_verifier_env *env, u32 regno, int
}
/* val_reg might be NULL at this point */
mark_btf_ld_reg(env, cur_regs(env), value_regno, reg_type, off_desc->btf,
- off_desc->btf_id, PTR_MAYBE_NULL);
+ off_desc->btf_id, reg_flags);
/* __mark_ptr_or_null_regs needs ref_obj_id == id to clear
* reference state for ptr == NULL branch.
*/
@@ -3641,7 +3650,7 @@ static int check_map_ptr_to_btf_id(struct bpf_verifier_env *env, u32 regno, int
* value from map as PTR_TO_BTF_ID, with the correct type.
*/
mark_btf_ld_reg(env, cur_regs(env), value_regno, reg_type, off_desc->btf,
- off_desc->btf_id, PTR_MAYBE_NULL);
+ off_desc->btf_id, reg_flags);
val_reg->id = ++env->id_gen;
} else if (insn_class == BPF_STX) {
if (WARN_ON_ONCE(value_regno < 0))
--
2.35.1
next prev parent reply other threads:[~2022-02-20 13:48 UTC|newest]
Thread overview: 38+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-02-20 13:47 [PATCH bpf-next v1 00/15] Introduce typed pointer support in BPF maps Kumar Kartikeya Dwivedi
2022-02-20 13:47 ` [PATCH bpf-next v1 01/15] bpf: Factor out fd returning from bpf_btf_find_by_name_kind Kumar Kartikeya Dwivedi
2022-02-22 5:28 ` Alexei Starovoitov
2022-02-23 3:05 ` Kumar Kartikeya Dwivedi
2022-02-20 13:48 ` [PATCH bpf-next v1 02/15] bpf: Make btf_find_field more generic Kumar Kartikeya Dwivedi
2022-02-20 13:48 ` [PATCH bpf-next v1 03/15] bpf: Allow storing PTR_TO_BTF_ID in map Kumar Kartikeya Dwivedi
2022-02-22 6:46 ` Alexei Starovoitov
2022-02-23 3:09 ` Kumar Kartikeya Dwivedi
2022-02-23 21:46 ` Alexei Starovoitov
2022-02-20 13:48 ` [PATCH bpf-next v1 04/15] bpf: Allow storing referenced " Kumar Kartikeya Dwivedi
2022-02-22 6:53 ` Alexei Starovoitov
2022-02-22 7:10 ` Kumar Kartikeya Dwivedi
2022-02-22 16:20 ` Alexei Starovoitov
2022-02-23 3:04 ` Kumar Kartikeya Dwivedi
2022-02-23 21:52 ` Alexei Starovoitov
2022-02-24 8:43 ` Kumar Kartikeya Dwivedi
2022-02-20 13:48 ` [PATCH bpf-next v1 05/15] bpf: Allow storing PTR_TO_PERCPU_BTF_ID " Kumar Kartikeya Dwivedi
2022-02-20 20:40 ` kernel test robot
2022-02-20 13:48 ` Kumar Kartikeya Dwivedi [this message]
2022-02-20 13:48 ` [PATCH bpf-next v1 07/15] bpf: Prevent escaping of pointers loaded from maps Kumar Kartikeya Dwivedi
2022-02-20 13:48 ` [PATCH bpf-next v1 08/15] bpf: Adapt copy_map_value for multiple offset case Kumar Kartikeya Dwivedi
2022-02-22 7:04 ` Alexei Starovoitov
2022-02-23 3:13 ` Kumar Kartikeya Dwivedi
2022-02-23 21:41 ` Alexei Starovoitov
2022-02-20 13:48 ` [PATCH bpf-next v1 09/15] bpf: Populate pairs of btf_id and destructor kfunc in btf Kumar Kartikeya Dwivedi
2022-02-20 13:48 ` [PATCH bpf-next v1 10/15] bpf: Wire up freeing of referenced PTR_TO_BTF_ID in map Kumar Kartikeya Dwivedi
2022-02-20 21:43 ` kernel test robot
2022-02-20 22:55 ` kernel test robot
2022-02-21 0:39 ` kernel test robot
2022-02-20 13:48 ` [PATCH bpf-next v1 11/15] bpf: Teach verifier about kptr_get style kfunc helpers Kumar Kartikeya Dwivedi
2022-02-20 13:48 ` [PATCH bpf-next v1 12/15] net/netfilter: Add bpf_ct_kptr_get helper Kumar Kartikeya Dwivedi
2022-02-21 4:35 ` kernel test robot
2022-02-20 13:48 ` [PATCH bpf-next v1 13/15] libbpf: Add __kptr* macros to bpf_helpers.h Kumar Kartikeya Dwivedi
2022-02-20 13:48 ` [PATCH bpf-next v1 14/15] selftests/bpf: Add C tests for PTR_TO_BTF_ID in map Kumar Kartikeya Dwivedi
2022-02-20 13:48 ` [PATCH bpf-next v1 15/15] selftests/bpf: Add verifier " Kumar Kartikeya Dwivedi
2022-02-22 6:05 ` [PATCH bpf-next v1 00/15] Introduce typed pointer support in BPF maps Song Liu
2022-02-22 8:21 ` Kumar Kartikeya Dwivedi
2022-02-23 7:29 ` Song Liu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20220220134813.3411982-7-memxor@gmail.com \
--to=memxor@gmail.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=hawk@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=toke@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).