Skip to content

Commit 216e3cd

Browse files
haoluo1022Alexei Starovoitov
haoluo1022
authored and
Alexei Starovoitov
committed
bpf: Add MEM_RDONLY for helper args that are pointers to rdonly mem.
Some helper functions may modify its arguments, for example, bpf_d_path, bpf_get_stack etc. Previously, their argument types were marked as ARG_PTR_TO_MEM, which is compatible with read-only mem types, such as PTR_TO_RDONLY_BUF. Therefore it's legitimate, but technically incorrect, to modify a read-only memory by passing it into one of such helper functions. This patch tags the bpf_args compatible with immutable memory with MEM_RDONLY flag. The arguments that don't have this flag will be only compatible with mutable memory types, preventing the helper from modifying a read-only memory. The bpf_args that have MEM_RDONLY are compatible with both mutable memory and immutable memory. Signed-off-by: Hao Luo <[email protected]> Signed-off-by: Alexei Starovoitov <[email protected]> Link: https://lore.kernel.org/bpf/[email protected]
1 parent 34d3a78 commit 216e3cd

File tree

9 files changed

+73
-57
lines changed

9 files changed

+73
-57
lines changed

‎include/linux/bpf.h

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -311,7 +311,9 @@ enum bpf_type_flag {
311311
/* PTR may be NULL. */
312312
PTR_MAYBE_NULL = BIT(0 + BPF_BASE_TYPE_BITS),
313313

314-
/* MEM is read-only. */
314+
/* MEM is read-only. When applied on bpf_arg, it indicates the arg is
315+
* compatible with both mutable and immutable memory.
316+
*/
315317
MEM_RDONLY = BIT(1 + BPF_BASE_TYPE_BITS),
316318

317319
__BPF_TYPE_LAST_FLAG = MEM_RDONLY,

‎kernel/bpf/btf.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6353,7 +6353,7 @@ const struct bpf_func_proto bpf_btf_find_by_name_kind_proto = {
63536353
.func = bpf_btf_find_by_name_kind,
63546354
.gpl_only = false,
63556355
.ret_type = RET_INTEGER,
6356-
.arg1_type = ARG_PTR_TO_MEM,
6356+
.arg1_type = ARG_PTR_TO_MEM | MEM_RDONLY,
63576357
.arg2_type = ARG_CONST_SIZE,
63586358
.arg3_type = ARG_ANYTHING,
63596359
.arg4_type = ARG_ANYTHING,

‎kernel/bpf/cgroup.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1789,7 +1789,7 @@ static const struct bpf_func_proto bpf_sysctl_set_new_value_proto = {
17891789
.gpl_only = false,
17901790
.ret_type = RET_INTEGER,
17911791
.arg1_type = ARG_PTR_TO_CTX,
1792-
.arg2_type = ARG_PTR_TO_MEM,
1792+
.arg2_type = ARG_PTR_TO_MEM | MEM_RDONLY,
17931793
.arg3_type = ARG_CONST_SIZE,
17941794
};
17951795

‎kernel/bpf/helpers.c

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -531,7 +531,7 @@ const struct bpf_func_proto bpf_strtol_proto = {
531531
.func = bpf_strtol,
532532
.gpl_only = false,
533533
.ret_type = RET_INTEGER,
534-
.arg1_type = ARG_PTR_TO_MEM,
534+
.arg1_type = ARG_PTR_TO_MEM | MEM_RDONLY,
535535
.arg2_type = ARG_CONST_SIZE,
536536
.arg3_type = ARG_ANYTHING,
537537
.arg4_type = ARG_PTR_TO_LONG,
@@ -559,7 +559,7 @@ const struct bpf_func_proto bpf_strtoul_proto = {
559559
.func = bpf_strtoul,
560560
.gpl_only = false,
561561
.ret_type = RET_INTEGER,
562-
.arg1_type = ARG_PTR_TO_MEM,
562+
.arg1_type = ARG_PTR_TO_MEM | MEM_RDONLY,
563563
.arg2_type = ARG_CONST_SIZE,
564564
.arg3_type = ARG_ANYTHING,
565565
.arg4_type = ARG_PTR_TO_LONG,
@@ -645,7 +645,7 @@ const struct bpf_func_proto bpf_event_output_data_proto = {
645645
.arg1_type = ARG_PTR_TO_CTX,
646646
.arg2_type = ARG_CONST_MAP_PTR,
647647
.arg3_type = ARG_ANYTHING,
648-
.arg4_type = ARG_PTR_TO_MEM,
648+
.arg4_type = ARG_PTR_TO_MEM | MEM_RDONLY,
649649
.arg5_type = ARG_CONST_SIZE_OR_ZERO,
650650
};
651651

@@ -1026,7 +1026,7 @@ const struct bpf_func_proto bpf_snprintf_proto = {
10261026
.arg1_type = ARG_PTR_TO_MEM_OR_NULL,
10271027
.arg2_type = ARG_CONST_SIZE_OR_ZERO,
10281028
.arg3_type = ARG_PTR_TO_CONST_STR,
1029-
.arg4_type = ARG_PTR_TO_MEM_OR_NULL,
1029+
.arg4_type = ARG_PTR_TO_MEM | PTR_MAYBE_NULL | MEM_RDONLY,
10301030
.arg5_type = ARG_CONST_SIZE_OR_ZERO,
10311031
};
10321032

‎kernel/bpf/ringbuf.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -444,7 +444,7 @@ const struct bpf_func_proto bpf_ringbuf_output_proto = {
444444
.func = bpf_ringbuf_output,
445445
.ret_type = RET_INTEGER,
446446
.arg1_type = ARG_CONST_MAP_PTR,
447-
.arg2_type = ARG_PTR_TO_MEM,
447+
.arg2_type = ARG_PTR_TO_MEM | MEM_RDONLY,
448448
.arg3_type = ARG_CONST_SIZE_OR_ZERO,
449449
.arg4_type = ARG_ANYTHING,
450450
};

‎kernel/bpf/syscall.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4773,7 +4773,7 @@ static const struct bpf_func_proto bpf_sys_bpf_proto = {
47734773
.gpl_only = false,
47744774
.ret_type = RET_INTEGER,
47754775
.arg1_type = ARG_ANYTHING,
4776-
.arg2_type = ARG_PTR_TO_MEM,
4776+
.arg2_type = ARG_PTR_TO_MEM | MEM_RDONLY,
47774777
.arg3_type = ARG_CONST_SIZE,
47784778
};
47794779

‎kernel/bpf/verifier.c

Lines changed: 17 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5113,7 +5113,6 @@ static const struct bpf_reg_types mem_types = {
51135113
PTR_TO_MAP_VALUE,
51145114
PTR_TO_MEM,
51155115
PTR_TO_BUF,
5116-
PTR_TO_BUF | MEM_RDONLY,
51175116
},
51185117
};
51195118

@@ -5183,6 +5182,21 @@ static int check_reg_type(struct bpf_verifier_env *env, u32 regno,
51835182
return -EFAULT;
51845183
}
51855184

5185+
/* ARG_PTR_TO_MEM + RDONLY is compatible with PTR_TO_MEM and PTR_TO_MEM + RDONLY,
5186+
* but ARG_PTR_TO_MEM is compatible only with PTR_TO_MEM and NOT with PTR_TO_MEM + RDONLY
5187+
*
5188+
* Same for MAYBE_NULL:
5189+
*
5190+
* ARG_PTR_TO_MEM + MAYBE_NULL is compatible with PTR_TO_MEM and PTR_TO_MEM + MAYBE_NULL,
5191+
* but ARG_PTR_TO_MEM is compatible only with PTR_TO_MEM but NOT with PTR_TO_MEM + MAYBE_NULL
5192+
*
5193+
* Therefore we fold these flags depending on the arg_type before comparison.
5194+
*/
5195+
if (arg_type & MEM_RDONLY)
5196+
type &= ~MEM_RDONLY;
5197+
if (arg_type & PTR_MAYBE_NULL)
5198+
type &= ~PTR_MAYBE_NULL;
5199+
51865200
for (i = 0; i < ARRAY_SIZE(compatible->types); i++) {
51875201
expected = compatible->types[i];
51885202
if (expected == NOT_INIT)
@@ -5192,14 +5206,14 @@ static int check_reg_type(struct bpf_verifier_env *env, u32 regno,
51925206
goto found;
51935207
}
51945208

5195-
verbose(env, "R%d type=%s expected=", regno, reg_type_str(env, type));
5209+
verbose(env, "R%d type=%s expected=", regno, reg_type_str(env, reg->type));
51965210
for (j = 0; j + 1 < i; j++)
51975211
verbose(env, "%s, ", reg_type_str(env, compatible->types[j]));
51985212
verbose(env, "%s\n", reg_type_str(env, compatible->types[j]));
51995213
return -EACCES;
52005214

52015215
found:
5202-
if (type == PTR_TO_BTF_ID) {
5216+
if (reg->type == PTR_TO_BTF_ID) {
52035217
if (!arg_btf_id) {
52045218
if (!compatible->btf_id) {
52055219
verbose(env, "verifier internal error: missing arg compatible BTF ID\n");

‎kernel/trace/bpf_trace.c

Lines changed: 13 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -345,7 +345,7 @@ static const struct bpf_func_proto bpf_probe_write_user_proto = {
345345
.gpl_only = true,
346346
.ret_type = RET_INTEGER,
347347
.arg1_type = ARG_ANYTHING,
348-
.arg2_type = ARG_PTR_TO_MEM,
348+
.arg2_type = ARG_PTR_TO_MEM | MEM_RDONLY,
349349
.arg3_type = ARG_CONST_SIZE,
350350
};
351351

@@ -394,7 +394,7 @@ static const struct bpf_func_proto bpf_trace_printk_proto = {
394394
.func = bpf_trace_printk,
395395
.gpl_only = true,
396396
.ret_type = RET_INTEGER,
397-
.arg1_type = ARG_PTR_TO_MEM,
397+
.arg1_type = ARG_PTR_TO_MEM | MEM_RDONLY,
398398
.arg2_type = ARG_CONST_SIZE,
399399
};
400400

@@ -450,9 +450,9 @@ static const struct bpf_func_proto bpf_trace_vprintk_proto = {
450450
.func = bpf_trace_vprintk,
451451
.gpl_only = true,
452452
.ret_type = RET_INTEGER,
453-
.arg1_type = ARG_PTR_TO_MEM,
453+
.arg1_type = ARG_PTR_TO_MEM | MEM_RDONLY,
454454
.arg2_type = ARG_CONST_SIZE,
455-
.arg3_type = ARG_PTR_TO_MEM_OR_NULL,
455+
.arg3_type = ARG_PTR_TO_MEM | PTR_MAYBE_NULL | MEM_RDONLY,
456456
.arg4_type = ARG_CONST_SIZE_OR_ZERO,
457457
};
458458

@@ -492,9 +492,9 @@ static const struct bpf_func_proto bpf_seq_printf_proto = {
492492
.ret_type = RET_INTEGER,
493493
.arg1_type = ARG_PTR_TO_BTF_ID,
494494
.arg1_btf_id = &btf_seq_file_ids[0],
495-
.arg2_type = ARG_PTR_TO_MEM,
495+
.arg2_type = ARG_PTR_TO_MEM | MEM_RDONLY,
496496
.arg3_type = ARG_CONST_SIZE,
497-
.arg4_type = ARG_PTR_TO_MEM_OR_NULL,
497+
.arg4_type = ARG_PTR_TO_MEM | PTR_MAYBE_NULL | MEM_RDONLY,
498498
.arg5_type = ARG_CONST_SIZE_OR_ZERO,
499499
};
500500

@@ -509,7 +509,7 @@ static const struct bpf_func_proto bpf_seq_write_proto = {
509509
.ret_type = RET_INTEGER,
510510
.arg1_type = ARG_PTR_TO_BTF_ID,
511511
.arg1_btf_id = &btf_seq_file_ids[0],
512-
.arg2_type = ARG_PTR_TO_MEM,
512+
.arg2_type = ARG_PTR_TO_MEM | MEM_RDONLY,
513513
.arg3_type = ARG_CONST_SIZE_OR_ZERO,
514514
};
515515

@@ -533,7 +533,7 @@ static const struct bpf_func_proto bpf_seq_printf_btf_proto = {
533533
.ret_type = RET_INTEGER,
534534
.arg1_type = ARG_PTR_TO_BTF_ID,
535535
.arg1_btf_id = &btf_seq_file_ids[0],
536-
.arg2_type = ARG_PTR_TO_MEM,
536+
.arg2_type = ARG_PTR_TO_MEM | MEM_RDONLY,
537537
.arg3_type = ARG_CONST_SIZE_OR_ZERO,
538538
.arg4_type = ARG_ANYTHING,
539539
};
@@ -694,7 +694,7 @@ static const struct bpf_func_proto bpf_perf_event_output_proto = {
694694
.arg1_type = ARG_PTR_TO_CTX,
695695
.arg2_type = ARG_CONST_MAP_PTR,
696696
.arg3_type = ARG_ANYTHING,
697-
.arg4_type = ARG_PTR_TO_MEM,
697+
.arg4_type = ARG_PTR_TO_MEM | MEM_RDONLY,
698698
.arg5_type = ARG_CONST_SIZE_OR_ZERO,
699699
};
700700

@@ -1004,7 +1004,7 @@ const struct bpf_func_proto bpf_snprintf_btf_proto = {
10041004
.ret_type = RET_INTEGER,
10051005
.arg1_type = ARG_PTR_TO_MEM,
10061006
.arg2_type = ARG_CONST_SIZE,
1007-
.arg3_type = ARG_PTR_TO_MEM,
1007+
.arg3_type = ARG_PTR_TO_MEM | MEM_RDONLY,
10081008
.arg4_type = ARG_CONST_SIZE,
10091009
.arg5_type = ARG_ANYTHING,
10101010
};
@@ -1334,7 +1334,7 @@ static const struct bpf_func_proto bpf_perf_event_output_proto_tp = {
13341334
.arg1_type = ARG_PTR_TO_CTX,
13351335
.arg2_type = ARG_CONST_MAP_PTR,
13361336
.arg3_type = ARG_ANYTHING,
1337-
.arg4_type = ARG_PTR_TO_MEM,
1337+
.arg4_type = ARG_PTR_TO_MEM | MEM_RDONLY,
13381338
.arg5_type = ARG_CONST_SIZE_OR_ZERO,
13391339
};
13401340

@@ -1556,7 +1556,7 @@ static const struct bpf_func_proto bpf_perf_event_output_proto_raw_tp = {
15561556
.arg1_type = ARG_PTR_TO_CTX,
15571557
.arg2_type = ARG_CONST_MAP_PTR,
15581558
.arg3_type = ARG_ANYTHING,
1559-
.arg4_type = ARG_PTR_TO_MEM,
1559+
.arg4_type = ARG_PTR_TO_MEM | MEM_RDONLY,
15601560
.arg5_type = ARG_CONST_SIZE_OR_ZERO,
15611561
};
15621562

@@ -1610,7 +1610,7 @@ static const struct bpf_func_proto bpf_get_stack_proto_raw_tp = {
16101610
.gpl_only = true,
16111611
.ret_type = RET_INTEGER,
16121612
.arg1_type = ARG_PTR_TO_CTX,
1613-
.arg2_type = ARG_PTR_TO_MEM,
1613+
.arg2_type = ARG_PTR_TO_MEM | MEM_RDONLY,
16141614
.arg3_type = ARG_CONST_SIZE_OR_ZERO,
16151615
.arg4_type = ARG_ANYTHING,
16161616
};

0 commit comments

Comments
 (0)