Commit 8c1b6e69 authored by Alexei Starovoitov's avatar Alexei Starovoitov Committed by Daniel Borkmann
Browse files

bpf: Compare BTF types of functions arguments with actual types 



Make the verifier check that BTF types of function arguments match actual types
passed into top-level BPF program and into BPF-to-BPF calls. If types match
such BPF programs and sub-programs will have full support of BPF trampoline. If
types mismatch the trampoline has to be conservative. It has to save/restore
five program arguments and assume 64-bit scalars.

Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
Acked-by: default avatarSong Liu <songliubraving@fb.com>
Acked-by: default avatarAndrii Nakryiko <andriin@fb.com>
Link: https://lore.kernel.org/bpf/20191114185720.1641606-17-ast@kernel.org
parent 91cc1a99

include/linux/bpf.h

+8 −0
Original line number Diff line number Diff line
@@ -480,6 +480,10 @@ static inline int bpf_trampoline_unlink_prog(struct bpf_prog *prog) 
static inline void bpf_trampoline_put(struct bpf_trampoline *tr) {}

#endif



struct bpf_func_info_aux {

	bool unreliable;

};



struct bpf_prog_aux {

	atomic_t refcnt;

	u32 used_map_cnt;
@@ -494,6 +498,7 @@ struct bpf_prog_aux { 
	bool verifier_zext; /* Zero extensions has been inserted by verifier. */

	bool offload_requested;

	bool attach_btf_trace; /* true if attaching to BTF-enabled raw tp */

	bool func_proto_unreliable;

	enum bpf_tramp_prog_type trampoline_prog_type;

	struct bpf_trampoline *trampoline;

	struct hlist_node tramp_hlist;
@@ -518,6 +523,7 @@ struct bpf_prog_aux { 
	struct bpf_prog_offload *offload;

	struct btf *btf;

	struct bpf_func_info *func_info;

	struct bpf_func_info_aux *func_info_aux;

	/* bpf_line_info loaded from userspace.  linfo->insn_off

	 * has the xlated insn offset.

	 * Both the main and sub prog share the same linfo.
@@ -890,6 +896,8 @@ int btf_distill_func_proto(struct bpf_verifier_log *log, 
			   const char *func_name,

			   struct btf_func_model *m);



int btf_check_func_arg_match(struct bpf_verifier_env *env, int subprog);



#else /* !CONFIG_BPF_SYSCALL */

static inline struct bpf_prog *bpf_prog_get(u32 ufd)

{

include/linux/bpf_verifier.h

+1 −0
Original line number Diff line number Diff line
@@ -343,6 +343,7 @@ static inline bool bpf_verifier_log_needed(const struct bpf_verifier_log *log) 
#define BPF_MAX_SUBPROGS 256



struct bpf_subprog_info {

	/* 'start' has to be the first field otherwise find_subprog() won't work */

	u32 start; /* insn idx of function entry point */

	u32 linfo_idx; /* The idx to the main_prog->aux->linfo */

	u16 stack_depth; /* max. stack depth used by this function */

kernel/bpf/btf.c

+82 −0
Original line number Diff line number Diff line
@@ -3985,6 +3985,88 @@ int btf_distill_func_proto(struct bpf_verifier_log *log, 
	return 0;

}



int btf_check_func_arg_match(struct bpf_verifier_env *env, int subprog)

{

	struct bpf_verifier_state *st = env->cur_state;

	struct bpf_func_state *func = st->frame[st->curframe];

	struct bpf_reg_state *reg = func->regs;

	struct bpf_verifier_log *log = &env->log;

	struct bpf_prog *prog = env->prog;

	struct btf *btf = prog->aux->btf;

	const struct btf_param *args;

	const struct btf_type *t;

	u32 i, nargs, btf_id;

	const char *tname;



	if (!prog->aux->func_info)

		return 0;



	btf_id = prog->aux->func_info[subprog].type_id;

	if (!btf_id)

		return 0;



	if (prog->aux->func_info_aux[subprog].unreliable)

		return 0;



	t = btf_type_by_id(btf, btf_id);

	if (!t || !btf_type_is_func(t)) {

		bpf_log(log, "BTF of subprog %d doesn't point to KIND_FUNC\n",

			subprog);

		return -EINVAL;

	}

	tname = btf_name_by_offset(btf, t->name_off);



	t = btf_type_by_id(btf, t->type);

	if (!t || !btf_type_is_func_proto(t)) {

		bpf_log(log, "Invalid type of func %s\n", tname);

		return -EINVAL;

	}

	args = (const struct btf_param *)(t + 1);

	nargs = btf_type_vlen(t);

	if (nargs > 5) {

		bpf_log(log, "Function %s has %d > 5 args\n", tname, nargs);

		goto out;

	}

	/* check that BTF function arguments match actual types that the

	 * verifier sees.

	 */

	for (i = 0; i < nargs; i++) {

		t = btf_type_by_id(btf, args[i].type);

		while (btf_type_is_modifier(t))

			t = btf_type_by_id(btf, t->type);

		if (btf_type_is_int(t) || btf_type_is_enum(t)) {

			if (reg[i + 1].type == SCALAR_VALUE)

				continue;

			bpf_log(log, "R%d is not a scalar\n", i + 1);

			goto out;

		}

		if (btf_type_is_ptr(t)) {

			if (reg[i + 1].type == SCALAR_VALUE) {

				bpf_log(log, "R%d is not a pointer\n", i + 1);

				goto out;

			}

			/* If program is passing PTR_TO_CTX into subprogram

			 * check that BTF type matches.

			 */

			if (reg[i + 1].type == PTR_TO_CTX &&

			    !btf_get_prog_ctx_type(log, btf, t, prog->type))

				goto out;

			/* All other pointers are ok */

			continue;

		}

		bpf_log(log, "Unrecognized argument type %s\n",

			btf_kind_str[BTF_INFO_KIND(t->info)]);

		goto out;

	}

	return 0;

out:

	/* LLVM optimizations can remove arguments from static functions. */

	bpf_log(log,

		"Type info disagrees with actual arguments due to compiler optimizations\n");

	prog->aux->func_info_aux[subprog].unreliable = true;

	return 0;

}



void btf_type_seq_show(const struct btf *btf, u32 type_id, void *obj,

		       struct seq_file *m)

{

kernel/bpf/syscall.c

+1 −0
Original line number Diff line number Diff line
@@ -1328,6 +1328,7 @@ static void __bpf_prog_put_rcu(struct rcu_head *rcu) 
	struct bpf_prog_aux *aux = container_of(rcu, struct bpf_prog_aux, rcu);



	kvfree(aux->func_info);

	kfree(aux->func_info_aux);

	free_used_maps(aux);

	bpf_prog_uncharge_memlock(aux->prog);

	security_bpf_prog_free(aux);

kernel/bpf/verifier.c

+15 −3
Original line number Diff line number Diff line
@@ -3970,6 +3970,9 @@ static int check_func_call(struct bpf_verifier_env *env, struct bpf_insn *insn, 
	/* only increment it after check_reg_arg() finished */

	state->curframe++;



	if (btf_check_func_arg_match(env, subprog))

		return -EINVAL;



	/* and go analyze first insn of the callee */

	*insn_idx = target_insn;
@@ -6564,6 +6567,7 @@ static int check_btf_func(struct bpf_verifier_env *env, 
	u32 i, nfuncs, urec_size, min_size;

	u32 krec_size = sizeof(struct bpf_func_info);

	struct bpf_func_info *krecord;

	struct bpf_func_info_aux *info_aux = NULL;

	const struct btf_type *type;

	struct bpf_prog *prog;

	const struct btf *btf;
@@ -6597,6 +6601,9 @@ static int check_btf_func(struct bpf_verifier_env *env, 
	krecord = kvcalloc(nfuncs, krec_size, GFP_KERNEL | __GFP_NOWARN);

	if (!krecord)

		return -ENOMEM;

	info_aux = kcalloc(nfuncs, sizeof(*info_aux), GFP_KERNEL | __GFP_NOWARN);

	if (!info_aux)

		goto err_free;



	for (i = 0; i < nfuncs; i++) {

		ret = bpf_check_uarg_tail_zero(urecord, krec_size, urec_size);
@@ -6648,29 +6655,31 @@ static int check_btf_func(struct bpf_verifier_env *env, 
			ret = -EINVAL;

			goto err_free;

		}



		prev_offset = krecord[i].insn_off;

		urecord += urec_size;

	}



	prog->aux->func_info = krecord;

	prog->aux->func_info_cnt = nfuncs;

	prog->aux->func_info_aux = info_aux;

	return 0;



err_free:

	kvfree(krecord);

	kfree(info_aux);

	return ret;

}



static void adjust_btf_func(struct bpf_verifier_env *env)

{

	struct bpf_prog_aux *aux = env->prog->aux;

	int i;



	if (!env->prog->aux->func_info)

	if (!aux->func_info)

		return;



	for (i = 0; i < env->subprog_cnt; i++)

		env->prog->aux->func_info[i].insn_off = env->subprog_info[i].start;

		aux->func_info[i].insn_off = env->subprog_info[i].start;

}



#define MIN_BPF_LINEINFO_SIZE	(offsetof(struct bpf_line_info, line_col) + \
@@ -7651,6 +7660,9 @@ static int do_check(struct bpf_verifier_env *env) 
			0 /* frameno */,

			0 /* subprogno, zero == main subprog */);



	if (btf_check_func_arg_match(env, 0))

		return -EINVAL;



	for (;;) {

		struct bpf_insn *insn;

		u8 class;

CRA Git | Maintained and supported by SUSTech CRA and CCSE