Merge branch 'bpf: Allow helpers access ptr_to_btf_id.'
Alexei Starovoitov says: ==================== From: Alexei Starovoitov <ast@kernel.org> Allow code like: bpf_strncmp(task->comm, 16, "foo"); ==================== Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
This commit is contained in:
Коммит
283b40c52d
|
@ -571,7 +571,7 @@ static const struct bpf_func_proto bpf_strncmp_proto = {
|
|||
.func = bpf_strncmp,
|
||||
.gpl_only = false,
|
||||
.ret_type = RET_INTEGER,
|
||||
.arg1_type = ARG_PTR_TO_MEM,
|
||||
.arg1_type = ARG_PTR_TO_MEM | MEM_RDONLY,
|
||||
.arg2_type = ARG_CONST_SIZE,
|
||||
.arg3_type = ARG_PTR_TO_CONST_STR,
|
||||
};
|
||||
|
|
|
@ -6303,6 +6303,9 @@ static int check_helper_mem_access(struct bpf_verifier_env *env, int regno,
|
|||
env,
|
||||
regno, reg->off, access_size,
|
||||
zero_size_allowed, ACCESS_HELPER, meta);
|
||||
case PTR_TO_BTF_ID:
|
||||
return check_ptr_to_btf_access(env, regs, regno, reg->off,
|
||||
access_size, BPF_READ, -1);
|
||||
case PTR_TO_CTX:
|
||||
/* in case the function doesn't know how to access the context,
|
||||
* (because we are in a program of type SYSCALL for example), we
|
||||
|
@ -7014,6 +7017,7 @@ static const struct bpf_reg_types mem_types = {
|
|||
PTR_TO_MEM,
|
||||
PTR_TO_MEM | MEM_RINGBUF,
|
||||
PTR_TO_BUF,
|
||||
PTR_TO_BTF_ID | PTR_TRUSTED,
|
||||
},
|
||||
};
|
||||
|
||||
|
@ -7145,6 +7149,17 @@ found:
|
|||
if (base_type(reg->type) != PTR_TO_BTF_ID)
|
||||
return 0;
|
||||
|
||||
if (compatible == &mem_types) {
|
||||
if (!(arg_type & MEM_RDONLY)) {
|
||||
verbose(env,
|
||||
"%s() may write into memory pointed by R%d type=%s\n",
|
||||
func_id_name(meta->func_id),
|
||||
regno, reg_type_str(env, reg->type));
|
||||
return -EACCES;
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
switch ((int)reg->type) {
|
||||
case PTR_TO_BTF_ID:
|
||||
case PTR_TO_BTF_ID | PTR_TRUSTED:
|
||||
|
|
|
@ -301,3 +301,39 @@ int BPF_PROG(task_kfunc_from_lsm_task_free, struct task_struct *task)
|
|||
bpf_task_release(acquired);
|
||||
return 0;
|
||||
}
|
||||
|
||||
SEC("tp_btf/task_newtask")
|
||||
__failure __msg("access beyond the end of member comm")
|
||||
int BPF_PROG(task_access_comm1, struct task_struct *task, u64 clone_flags)
|
||||
{
|
||||
bpf_strncmp(task->comm, 17, "foo");
|
||||
return 0;
|
||||
}
|
||||
|
||||
SEC("tp_btf/task_newtask")
|
||||
__failure __msg("access beyond the end of member comm")
|
||||
int BPF_PROG(task_access_comm2, struct task_struct *task, u64 clone_flags)
|
||||
{
|
||||
bpf_strncmp(task->comm + 1, 16, "foo");
|
||||
return 0;
|
||||
}
|
||||
|
||||
SEC("tp_btf/task_newtask")
|
||||
__failure __msg("write into memory")
|
||||
int BPF_PROG(task_access_comm3, struct task_struct *task, u64 clone_flags)
|
||||
{
|
||||
bpf_probe_read_kernel(task->comm, 16, task->comm);
|
||||
return 0;
|
||||
}
|
||||
|
||||
SEC("fentry/__set_task_comm")
|
||||
__failure __msg("R1 type=ptr_ expected")
|
||||
int BPF_PROG(task_access_comm4, struct task_struct *task, const char *buf, bool exec)
|
||||
{
|
||||
/*
|
||||
* task->comm is a legacy ptr_to_btf_id. The verifier cannot guarantee
|
||||
* its safety. Hence it cannot be accessed with normal load insns.
|
||||
*/
|
||||
bpf_strncmp(task->comm, 16, "foo");
|
||||
return 0;
|
||||
}
|
||||
|
|
|
@ -207,6 +207,10 @@ int BPF_PROG(test_task_from_pid_invalid, struct task_struct *task, u64 clone_fla
|
|||
if (!is_test_kfunc_task())
|
||||
return 0;
|
||||
|
||||
bpf_strncmp(task->comm, 12, "foo");
|
||||
bpf_strncmp(task->comm, 16, "foo");
|
||||
bpf_strncmp(&task->comm[8], 4, "foo");
|
||||
|
||||
if (is_pid_lookup_valid(-1)) {
|
||||
err = 1;
|
||||
return 0;
|
||||
|
|
Загрузка…
Ссылка в новой задаче