Merge branch 'bpf: Allow helpers access ptr_to_btf_id.'

Alexei Starovoitov says:

====================

From: Alexei Starovoitov <ast@kernel.org>

Allow code like:
bpf_strncmp(task->comm, 16, "foo");
====================

Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
This commit is contained in:
Martin KaFai Lau 2023-03-13 23:08:21 -07:00
Родитель b9fe8e8d03 f25fd60882
Коммит 283b40c52d
4 изменённых файлов: 56 добавлений и 1 удалений

Просмотреть файл

@ -571,7 +571,7 @@ static const struct bpf_func_proto bpf_strncmp_proto = {
.func = bpf_strncmp,
.gpl_only = false,
.ret_type = RET_INTEGER,
.arg1_type = ARG_PTR_TO_MEM,
.arg1_type = ARG_PTR_TO_MEM | MEM_RDONLY,
.arg2_type = ARG_CONST_SIZE,
.arg3_type = ARG_PTR_TO_CONST_STR,
};

Просмотреть файл

@ -6303,6 +6303,9 @@ static int check_helper_mem_access(struct bpf_verifier_env *env, int regno,
env,
regno, reg->off, access_size,
zero_size_allowed, ACCESS_HELPER, meta);
case PTR_TO_BTF_ID:
return check_ptr_to_btf_access(env, regs, regno, reg->off,
access_size, BPF_READ, -1);
case PTR_TO_CTX:
/* in case the function doesn't know how to access the context,
* (because we are in a program of type SYSCALL for example), we
@ -7014,6 +7017,7 @@ static const struct bpf_reg_types mem_types = {
PTR_TO_MEM,
PTR_TO_MEM | MEM_RINGBUF,
PTR_TO_BUF,
PTR_TO_BTF_ID | PTR_TRUSTED,
},
};
@ -7145,6 +7149,17 @@ found:
if (base_type(reg->type) != PTR_TO_BTF_ID)
return 0;
if (compatible == &mem_types) {
if (!(arg_type & MEM_RDONLY)) {
verbose(env,
"%s() may write into memory pointed by R%d type=%s\n",
func_id_name(meta->func_id),
regno, reg_type_str(env, reg->type));
return -EACCES;
}
return 0;
}
switch ((int)reg->type) {
case PTR_TO_BTF_ID:
case PTR_TO_BTF_ID | PTR_TRUSTED:

Просмотреть файл

@ -301,3 +301,39 @@ int BPF_PROG(task_kfunc_from_lsm_task_free, struct task_struct *task)
bpf_task_release(acquired);
return 0;
}
SEC("tp_btf/task_newtask")
__failure __msg("access beyond the end of member comm")
int BPF_PROG(task_access_comm1, struct task_struct *task, u64 clone_flags)
{
bpf_strncmp(task->comm, 17, "foo");
return 0;
}
SEC("tp_btf/task_newtask")
__failure __msg("access beyond the end of member comm")
int BPF_PROG(task_access_comm2, struct task_struct *task, u64 clone_flags)
{
bpf_strncmp(task->comm + 1, 16, "foo");
return 0;
}
SEC("tp_btf/task_newtask")
__failure __msg("write into memory")
int BPF_PROG(task_access_comm3, struct task_struct *task, u64 clone_flags)
{
bpf_probe_read_kernel(task->comm, 16, task->comm);
return 0;
}
SEC("fentry/__set_task_comm")
__failure __msg("R1 type=ptr_ expected")
int BPF_PROG(task_access_comm4, struct task_struct *task, const char *buf, bool exec)
{
/*
* task->comm is a legacy ptr_to_btf_id. The verifier cannot guarantee
* its safety. Hence it cannot be accessed with normal load insns.
*/
bpf_strncmp(task->comm, 16, "foo");
return 0;
}

Просмотреть файл

@ -207,6 +207,10 @@ int BPF_PROG(test_task_from_pid_invalid, struct task_struct *task, u64 clone_fla
if (!is_test_kfunc_task())
return 0;
bpf_strncmp(task->comm, 12, "foo");
bpf_strncmp(task->comm, 16, "foo");
bpf_strncmp(&task->comm[8], 4, "foo");
if (is_pid_lookup_valid(-1)) {
err = 1;
return 0;