mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-30 13:23:02 -04:00
Code Issues Packages Projects Releases Wiki Activity

bpf: Check helper and kfunc mem+size arguments identically

Browse Source 
Helper ARG_CONST_SIZE and kfunc KF_ARG_PTR_TO_MEM_SIZE memory arguments
already share check_mem_size_reg(), but the kfunc path reached it
through a thin wrapper, check_kfunc_mem_size_reg(). The wrapper existed
only to invoke check_mem_size_reg() twice. Once for BPF_READ and once for
BPF_WRITE because a kfunc mem argument may be both read and written,
whereas a helper argument carries a single access direction.

Let check_mem_size_reg() take a bitmask of access directions (widening
access_type to u32) and perform each requested access, then pass
BPF_READ | BPF_WRITE from the kfunc call site. This removes the
check_kfunc_mem_size_reg() wrapper so helper and kfunc mem+size arguments
run through exactly the same code.

Signed-off-by: Amery Hung <ameryhung@gmail.com>
Reviewed-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/bpf/20260801074633.1595644-7-ameryhung@gmail.com
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
This commit is contained in:
Amery Hung
2026-08-01 00:46:21 -07:00
committed by Kumar Kartikeya Dwivedi
parent 341d227fa5
commit d4e7fb59c0
1 changed files with 13 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

31
kernel/bpf/verifier.c
View File

@@ -6871,11 +6871,11 @@ static int check_helper_mem_access(struct bpf_verifier_env *env, struct bpf_reg_
static int check_mem_size_reg(struct bpf_verifier_env *env,
struct bpf_reg_state *mem_reg,
struct bpf_reg_state *size_reg, argno_t mem_argno,
argno_t size_argno, enum bpf_access_type access_type,
argno_t size_argno, u32 access_type,
bool zero_size_allowed,
struct bpf_call_arg_meta *meta)
{
int err;
int err = 0;
/* This is used to refine r0 return value bounds for helpers
* that enforce this value as an upper bound on return values.
@@ -6912,8 +6912,14 @@ static int check_mem_size_reg(struct bpf_verifier_env *env,
reg_arg_name(env, size_argno));
return -EACCES;
}
err = check_helper_mem_access(env, mem_reg, mem_argno, reg_umax(size_reg),
access_type, zero_size_allowed, meta);
if (access_type & BPF_READ)
err = check_helper_mem_access(env, mem_reg, mem_argno, reg_umax(size_reg),
BPF_READ, zero_size_allowed, meta);
if (!err && access_type & BPF_WRITE)
err = check_helper_mem_access(env, mem_reg, mem_argno, reg_umax(size_reg),
BPF_WRITE, zero_size_allowed, meta);
if (!err) {
int regno = reg_from_argno(size_argno);
@@ -6922,6 +6928,7 @@ static int check_mem_size_reg(struct bpf_verifier_env *env,
else
err = mark_stack_arg_precision(env, arg_idx_from_argno(size_argno));
}
return err;
}
@@ -6981,18 +6988,6 @@ static int process_const_alloc_mem_size(struct bpf_verifier_env *env, struct bpf
return 0;
}
static int check_kfunc_mem_size_reg(struct bpf_verifier_env *env, struct bpf_reg_state *mem_reg,
struct bpf_reg_state *size_reg, argno_t mem_argno,
argno_t size_argno, struct bpf_call_arg_meta *meta)
{
int err;
err = check_mem_size_reg(env, mem_reg, size_reg, mem_argno, size_argno, BPF_READ, true, meta);
err = err ?: check_mem_size_reg(env, mem_reg, size_reg, mem_argno, size_argno, BPF_WRITE, true, meta);
return err;
}
enum {
PROCESS_SPIN_LOCK = (1 << 0),
PROCESS_RES_LOCK = (1 << 1),
@@ -12397,8 +12392,8 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_call_arg_me
argno_t next_argno = argno_from_arg(i + 2);
if (!bpf_register_is_null(buff_reg) || !is_kfunc_arg_nullable(meta->btf, buff_arg)) {
ret = check_kfunc_mem_size_reg(env, buff_reg, size_reg,
argno, next_argno, meta);
ret = check_mem_size_reg(env, buff_reg, size_reg, argno, next_argno,
BPF_READ | BPF_WRITE, true, meta);
if (ret < 0) {
verbose(env, "%s and ", reg_arg_name(env, argno));
verbose(env, "%s memory, len pair leads to invalid memory access\n",