Skip to content

Commit

Permalink
bpf: factor out fetching basic kfunc metadata
Browse files Browse the repository at this point in the history 
[ Upstream commit 07236ea ]

Factor out logic to fetch basic kfunc metadata based on struct bpf_insn.
This is not exactly short or trivial code to just copy/paste and this
information is sometimes necessary in other parts of the verifier logic.
Subsequent patches will rely on this to determine if an instruction is
a kfunc call to iterator next method.

No functional changes intended, including that verbose() warning
behavior when kfunc is not allowed for a particular program type.

Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/r/20230308184121.1165081-2-andrii@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Stable-dep-of: f6a6a5a ("bpf: Fix struct_meta lookup for bpf_obj_free_fields kfunc call")
Signed-off-by: Sasha Levin <sashal@kernel.org>
  • Loading branch information
@anakryiko @gregkh
anakryiko authored and gregkh committed May 11, 2023
1 parent 0354bce commit c079b05
Showing 1 changed file with 59 additions and 33 deletions.
92 changes: 59 additions & 33 deletions kernel/bpf/verifier.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -9788,24 +9788,21 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_
return 0;
}

static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
int *insn_idx_p)
static int fetch_kfunc_meta(struct bpf_verifier_env *env,
struct bpf_insn *insn,
struct bpf_kfunc_call_arg_meta *meta,
const char **kfunc_name)
{
const struct btf_type *t, *func, *func_proto, *ptr_type;
u32 i, nargs, func_id, ptr_type_id, release_ref_obj_id;
struct bpf_reg_state *regs = cur_regs(env);
const char *func_name, *ptr_type_name;
bool sleepable, rcu_lock, rcu_unlock;
struct bpf_kfunc_call_arg_meta meta;
int err, insn_idx = *insn_idx_p;
const struct btf_param *args;
const struct btf_type *ret_t;
const struct btf_type *func, *func_proto;
u32 func_id, *kfunc_flags;
const char *func_name;
struct btf *desc_btf;
u32 *kfunc_flags;

/* skip for now, but return error when we find this in fixup_kfunc_call */
if (kfunc_name)
*kfunc_name = NULL;

if (!insn->imm)
return 0;
return -EINVAL;

desc_btf = find_kfunc_desc_btf(env, insn->off);
if (IS_ERR(desc_btf))
Expand All @@ -9814,22 +9811,51 @@ static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
func_id = insn->imm;
func = btf_type_by_id(desc_btf, func_id);
func_name = btf_name_by_offset(desc_btf, func->name_off);
if (kfunc_name)
*kfunc_name = func_name;
func_proto = btf_type_by_id(desc_btf, func->type);

kfunc_flags = btf_kfunc_id_set_contains(desc_btf, resolve_prog_type(env->prog), func_id);
if (!kfunc_flags) {
verbose(env, "calling kernel function %s is not allowed\n",
func_name);
return -EACCES;
}

/* Prepare kfunc call metadata */
memset(&meta, 0, sizeof(meta));
meta.btf = desc_btf;
meta.func_id = func_id;
meta.kfunc_flags = *kfunc_flags;
meta.func_proto = func_proto;
meta.func_name = func_name;
memset(meta, 0, sizeof(*meta));
meta->btf = desc_btf;
meta->func_id = func_id;
meta->kfunc_flags = *kfunc_flags;
meta->func_proto = func_proto;
meta->func_name = func_name;

return 0;
}

static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
int *insn_idx_p)
{
const struct btf_type *t, *ptr_type;
u32 i, nargs, ptr_type_id, release_ref_obj_id;
struct bpf_reg_state *regs = cur_regs(env);
const char *func_name, *ptr_type_name;
bool sleepable, rcu_lock, rcu_unlock;
struct bpf_kfunc_call_arg_meta meta;
struct bpf_insn_aux_data *insn_aux;
int err, insn_idx = *insn_idx_p;
const struct btf_param *args;
const struct btf_type *ret_t;
struct btf *desc_btf;

/* skip for now, but return error when we find this in fixup_kfunc_call */
if (!insn->imm)
return 0;

err = fetch_kfunc_meta(env, insn, &meta, &func_name);
if (err == -EACCES && func_name)
verbose(env, "calling kernel function %s is not allowed\n", func_name);
if (err)
return err;
desc_btf = meta.btf;
insn_aux = &env->insn_aux_data[insn_idx];

if (is_kfunc_destructive(&meta) && !capable(CAP_SYS_BOOT)) {
verbose(env, "destructive kfunc calls require CAP_SYS_BOOT capability\n");
Expand Down Expand Up @@ -9886,7 +9912,7 @@ static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
err = release_reference(env, regs[meta.release_regno].ref_obj_id);
if (err) {
verbose(env, "kfunc %s#%d reference has not been acquired before\n",
func_name, func_id);
func_name, meta.func_id);
return err;
}
}
Expand All @@ -9898,14 +9924,14 @@ static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
err = ref_convert_owning_non_owning(env, release_ref_obj_id);
if (err) {
verbose(env, "kfunc %s#%d conversion of owning ref to non-owning failed\n",
func_name, func_id);
func_name, meta.func_id);
return err;
}

err = release_reference(env, release_ref_obj_id);
if (err) {
verbose(env, "kfunc %s#%d reference has not been acquired before\n",
func_name, func_id);
func_name, meta.func_id);
return err;
}
}
Expand All @@ -9915,7 +9941,7 @@ static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
set_rbtree_add_callback_state);
if (err) {
verbose(env, "kfunc %s#%d failed callback verification\n",
func_name, func_id);
func_name, meta.func_id);
return err;
}
}
Expand All @@ -9924,7 +9950,7 @@ static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
mark_reg_not_init(env, regs, caller_saved[i]);

/* Check return type */
t = btf_type_skip_modifiers(desc_btf, func_proto->type, NULL);
t = btf_type_skip_modifiers(desc_btf, meta.func_proto->type, NULL);

if (is_kfunc_acquire(&meta) && !btf_type_is_struct_ptr(meta.btf, t)) {
/* Only exception is bpf_obj_new_impl */
Expand Down Expand Up @@ -9973,11 +9999,11 @@ static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
regs[BPF_REG_0].btf = ret_btf;
regs[BPF_REG_0].btf_id = ret_btf_id;

env->insn_aux_data[insn_idx].obj_new_size = ret_t->size;
env->insn_aux_data[insn_idx].kptr_struct_meta =
insn_aux->obj_new_size = ret_t->size;
insn_aux->kptr_struct_meta =
btf_find_struct_meta(ret_btf, ret_btf_id);
} else if (meta.func_id == special_kfunc_list[KF_bpf_obj_drop_impl]) {
env->insn_aux_data[insn_idx].kptr_struct_meta =
insn_aux->kptr_struct_meta =
btf_find_struct_meta(meta.arg_obj_drop.btf,
meta.arg_obj_drop.btf_id);
} else if (meta.func_id == special_kfunc_list[KF_bpf_list_pop_front] ||
Expand Down Expand Up @@ -10066,8 +10092,8 @@ static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
regs[BPF_REG_0].id = ++env->id_gen;
} /* else { add_kfunc_call() ensures it is btf_type_is_void(t) } */

nargs = btf_type_vlen(func_proto);
args = (const struct btf_param *)(func_proto + 1);
nargs = btf_type_vlen(meta.func_proto);
args = (const struct btf_param *)(meta.func_proto + 1);
for (i = 0; i < nargs; i++) {
u32 regno = i + 1;

Expand Down

0 comments on commit c079b05

Please sign in to comment.