mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-30 13:23:02 -04:00
Code Issues Packages Projects Releases Wiki Activity

bpf: Correct kfunc argument diagnostics

Browse Source 
The Call Type Safety diagnostics mishandle three kfunc argument classes.

BTF type ID 0 represents void, but btf_show_name() also uses zero to end
type traversal. A pointer that resolves to void therefore loses its pointee
name and is rendered as "()". End traversal directly for concrete terminal
types, but resolve referenced types before testing for ID zero, and name the
void terminal type explicitly. Format the complete parameter pointer type
for nullable kfunc arguments, so void pointers are reported as (void *).

Also add the missing structured report when an __szk memory-size argument is
not a verifier-known constant. Describe the generic bpf_refcount_acquire()
contract without deriving an object type from its void pointer prototype.

Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/bpf/668871823f90f69896d3db27b56db2f53e481162.camel@gmail.com
Link: https://lore.kernel.org/bpf/20260816015746.2632990-7-memxor@gmail.com
This commit is contained in:
Kumar Kartikeya Dwivedi
2026-08-16 03:57:34 +02:00
parent 09a0c2d678
commit cc782c7ad0
2 changed files with 17 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
kernel/bpf/btf.c
View File

@@ -1169,19 +1169,19 @@ static const char *btf_show_name(struct btf_show *show)
id = t->type;
break;
default:
id = 0;
break;
goto resolved;
}
t = btf_type_skip_qualifiers(show->btf, id);
if (!id)
break;
t = btf_type_skip_qualifiers(show->btf, id);
}
/* We may not be able to represent this type; bail to be safe */
if (i == BTF_SHOW_MAX_ITER)
return "";
resolved:
if (!name)
name = btf_name_by_offset(show->btf, t->name_off);
name = btf_type_is_void(t) ? "void" : btf_name_by_offset(show->btf, t->name_off);
switch (BTF_INFO_KIND(t->info)) {
case BTF_KIND_STRUCT:

22
kernel/bpf/verifier.c
View File

@@ -12616,12 +12616,12 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_call_arg_me
!type_may_be_null(kf_arg_type)) {
const char *expected_type;
expected_type = bpf_diag_fmt_btf_type(env, btf, ref_id);
expected_type = bpf_diag_fmt_btf_type(env, btf, args[i].type);
verbose(env, "Possibly NULL pointer passed to trusted %s\n",
reg_arg_name(env, argno));
bpf_diag_call_arg_fmt(env, insn_idx, argno, func_name,
"Add a NULL check and call the kfunc only on the non-NULL path.",
"the pointer may be NULL, but this kfunc requires a non-NULL pointer to %s",
"the pointer may be NULL, but this kfunc requires a non-NULL value of type %s",
expected_type);
return -EACCES;
}
@@ -13058,8 +13058,14 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_call_arg_me
break;
case KF_ARG_CONST_MEM_SIZE:
ret = process_const_arg(env, reg, argno, meta);
if (ret < 0)
if (ret < 0) {
if (ret == -EINVAL)
bpf_diag_call_arg_fmt(env, insn_idx, argno, func_name,
"Pass a compile-time constant or a value the verifier can prove is constant at this call.",
"the kfunc requires this memory size to be a verifier-known constant, but %s is variable on this path",
reg_arg_name(env, argno));
return ret;
}
fallthrough;
case KF_ARG_MEM_SIZE:
{
@@ -13123,15 +13129,13 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_call_arg_me
break;
case KF_ARG_PTR_TO_REFCOUNTED_KPTR:
if (!type_is_ptr_alloc_obj(reg->type)) {
const char *expected_type;
expected_type = bpf_diag_fmt_btf_type(env, btf, ref_id);
verbose(env, "%s is neither owning or non-owning ref\n",
reg_arg_name(env, argno));
bpf_diag_call_arg_fmt(env, insn_idx, argno, func_name,
"Pass a pointer returned by the matching BPF object allocation or lookup operation for this kfunc.",
"the kfunc expects a pointer to BPF-managed refcounted object type %s, but this argument is not such an object pointer",
expected_type);
"Pass an owning or non-owning pointer to a BPF-managed object containing a bpf_refcount field.",
"the kfunc expects a pointer to a BPF-managed refcounted object, but %s is %s",
reg_arg_name(env, argno),
bpf_diag_reg_type_plain(env, reg->type));
return -EINVAL;
}
if (!type_is_non_owning_ref(reg->type))