Commit 9436ef6e authored by Lorenz Bauer's avatar Lorenz Bauer Committed by Alexei Starovoitov
Browse files

bpf: Allow specifying a BTF ID per argument in function protos 



Function prototypes using ARG_PTR_TO_BTF_ID currently use two ways to signal
which BTF IDs are acceptable. First, bpf_func_proto.btf_id is an array of
IDs, one for each argument. This array is only accessed up to the highest
numbered argument that uses ARG_PTR_TO_BTF_ID and may therefore be less than
five arguments long. It usually points at a BTF_ID_LIST. Second, check_btf_id
is a function pointer that is called by the verifier if present. It gets the
actual BTF ID of the register, and the argument number we're currently checking.
It turns out that the only user check_arg_btf_id ignores the argument, and is
simply used to check whether the BTF ID has a struct sock_common at it's start.

Replace both of these mechanisms with an explicit BTF ID for each argument
in a function proto. Thanks to btf_struct_ids_match this is very flexible:
check_arg_btf_id can be replaced by requiring struct sock_common.

Signed-off-by: default avatarLorenz Bauer <lmb@cloudflare.com>
Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
Acked-by: default avatarMartin KaFai Lau <kafai@fb.com>
Link: https://lore.kernel.org/bpf/20200921121227.255763-5-lmb@cloudflare.com
parent 27774b70

include/linux/bpf.h

+10 −8
Original line number Diff line number Diff line
@@ -326,12 +326,16 @@ struct bpf_func_proto { 
		};

		enum bpf_arg_type arg_type[5];

	};

	int *btf_id; /* BTF ids of arguments */

	bool (*check_btf_id)(u32 btf_id, u32 arg); /* if the argument btf_id is

						    * valid. Often used if more

						    * than one btf id is permitted

						    * for this argument.

						    */

	union {

		struct {

			u32 *arg1_btf_id;

			u32 *arg2_btf_id;

			u32 *arg3_btf_id;

			u32 *arg4_btf_id;

			u32 *arg5_btf_id;

		};

		u32 *arg_btf_id[5];

	};

	int *ret_btf_id; /* return value btf_id */

	bool (*allowed)(const struct bpf_prog *prog);

};
@@ -1385,8 +1389,6 @@ int btf_struct_access(struct bpf_verifier_log *log, 
		      u32 *next_btf_id);

bool btf_struct_ids_match(struct bpf_verifier_log *log,

			  int off, u32 id, u32 need_type_id);

int btf_resolve_helper_id(struct bpf_verifier_log *log,

			  const struct bpf_func_proto *fn, int);



int btf_distill_func_proto(struct bpf_verifier_log *log,

			   struct btf *btf,

kernel/bpf/bpf_inode_storage.c

+3 −5
Original line number Diff line number Diff line
@@ -249,9 +249,7 @@ const struct bpf_map_ops inode_storage_map_ops = { 
	.map_owner_storage_ptr = inode_storage_ptr,

};



BTF_ID_LIST(bpf_inode_storage_btf_ids)

BTF_ID_UNUSED

BTF_ID(struct, inode)

BTF_ID_LIST_SINGLE(bpf_inode_storage_btf_ids, struct, inode)



const struct bpf_func_proto bpf_inode_storage_get_proto = {

	.func		= bpf_inode_storage_get,
@@ -259,9 +257,9 @@ const struct bpf_func_proto bpf_inode_storage_get_proto = { 
	.ret_type	= RET_PTR_TO_MAP_VALUE_OR_NULL,

	.arg1_type	= ARG_CONST_MAP_PTR,

	.arg2_type	= ARG_PTR_TO_BTF_ID,

	.arg2_btf_id	= &bpf_inode_storage_btf_ids[0],

	.arg3_type	= ARG_PTR_TO_MAP_VALUE_OR_NULL,

	.arg4_type	= ARG_ANYTHING,

	.btf_id		= bpf_inode_storage_btf_ids,

};



const struct bpf_func_proto bpf_inode_storage_delete_proto = {
@@ -270,5 +268,5 @@ const struct bpf_func_proto bpf_inode_storage_delete_proto = { 
	.ret_type	= RET_INTEGER,

	.arg1_type	= ARG_CONST_MAP_PTR,

	.arg2_type	= ARG_PTR_TO_BTF_ID,

	.btf_id		= bpf_inode_storage_btf_ids,

	.arg2_btf_id	= &bpf_inode_storage_btf_ids[0],

};

kernel/bpf/btf.c

+0 −13
Original line number Diff line number Diff line
@@ -4193,19 +4193,6 @@ again: 
	return true;

}



int btf_resolve_helper_id(struct bpf_verifier_log *log,

			  const struct bpf_func_proto *fn, int arg)

{

	int id;



	if (fn->arg_type[arg] != ARG_PTR_TO_BTF_ID || !btf_vmlinux)

		return -EINVAL;

	id = fn->btf_id[arg];

	if (!id || id > btf_vmlinux->nr_types)

		return -EINVAL;

	return id;

}



static int __get_type_size(struct btf *btf, u32 btf_id,

			   const struct btf_type **bad_type)

{

kernel/bpf/stackmap.c

+2 −3
Original line number Diff line number Diff line
@@ -665,18 +665,17 @@ BPF_CALL_4(bpf_get_task_stack, struct task_struct *, task, void *, buf, 
	return __bpf_get_stack(regs, task, NULL, buf, size, flags);

}



BTF_ID_LIST(bpf_get_task_stack_btf_ids)

BTF_ID(struct, task_struct)

BTF_ID_LIST_SINGLE(bpf_get_task_stack_btf_ids, struct, task_struct)



const struct bpf_func_proto bpf_get_task_stack_proto = {

	.func		= bpf_get_task_stack,

	.gpl_only	= false,

	.ret_type	= RET_INTEGER,

	.arg1_type	= ARG_PTR_TO_BTF_ID,

	.arg1_btf_id	= &bpf_get_task_stack_btf_ids[0],

	.arg2_type	= ARG_PTR_TO_UNINIT_MEM,

	.arg3_type	= ARG_CONST_SIZE_OR_ZERO,

	.arg4_type	= ARG_ANYTHING,

	.btf_id		= bpf_get_task_stack_btf_ids,

};



BPF_CALL_4(bpf_get_stack_pe, struct bpf_perf_event_data_kern *, ctx,

kernel/bpf/verifier.c

+22 −22
Original line number Diff line number Diff line
@@ -238,7 +238,6 @@ struct bpf_call_arg_meta { 
	u64 msize_max_value;

	int ref_obj_id;

	int func_id;

	u32 btf_id;

};



struct btf *btf_vmlinux;
@@ -4049,29 +4048,23 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg, 
				goto err_type;

		}

	} else if (arg_type == ARG_PTR_TO_BTF_ID) {

		bool ids_match = false;

		const u32 *btf_id = fn->arg_btf_id[arg];



		expected_type = PTR_TO_BTF_ID;

		if (type != expected_type)

			goto err_type;

		if (!fn->check_btf_id) {

			if (reg->btf_id != meta->btf_id) {

				ids_match = btf_struct_ids_match(&env->log, reg->off, reg->btf_id,

								 meta->btf_id);

				if (!ids_match) {

					verbose(env, "Helper has type %s got %s in R%d\n",

						kernel_type_name(meta->btf_id),

						kernel_type_name(reg->btf_id), regno);

					return -EACCES;

				}



		if (!btf_id) {

			verbose(env, "verifier internal error: missing BTF ID\n");

			return -EFAULT;

		}

		} else if (!fn->check_btf_id(reg->btf_id, arg)) {

			verbose(env, "Helper does not support %s in R%d\n",

				kernel_type_name(reg->btf_id), regno);



		if (!btf_struct_ids_match(&env->log, reg->off, reg->btf_id, *btf_id)) {

			verbose(env, "R%d is of type %s but %s is expected\n",

				regno, kernel_type_name(reg->btf_id), kernel_type_name(*btf_id));

			return -EACCES;

		}

		if ((reg->off && !ids_match) || !tnum_is_const(reg->var_off) || reg->var_off.value) {

		if (!tnum_is_const(reg->var_off) || reg->var_off.value) {

			verbose(env, "R%d is a pointer to in-kernel struct with non-zero offset\n",

				regno);

			return -EACCES;
@@ -4545,10 +4538,22 @@ static bool check_refcount_ok(const struct bpf_func_proto *fn, int func_id) 
	return count <= 1;

}



static bool check_btf_id_ok(const struct bpf_func_proto *fn)

{

	int i;



	for (i = 0; i < ARRAY_SIZE(fn->arg_type); i++)

		if (fn->arg_type[i] == ARG_PTR_TO_BTF_ID && !fn->arg_btf_id[i])

			return false;



	return true;

}



static int check_func_proto(const struct bpf_func_proto *fn, int func_id)

{

	return check_raw_mode_ok(fn) &&

	       check_arg_pair_ok(fn) &&

	       check_btf_id_ok(fn) &&

	       check_refcount_ok(fn, func_id) ? 0 : -EINVAL;

}
@@ -4944,11 +4949,6 @@ static int check_helper_call(struct bpf_verifier_env *env, int func_id, int insn 
	meta.func_id = func_id;

	/* check args */

	for (i = 0; i < 5; i++) {

		if (!fn->check_btf_id) {

			err = btf_resolve_helper_id(&env->log, fn, i);

			if (err > 0)

				meta.btf_id = err;

		}

		err = check_func_arg(env, i, &meta, fn);

		if (err)

			return err;

CRA Git | Maintained and supported by SUSTech CRA and CCSE