@@ -475,14 +475,9 @@ static bool arg_type_may_be_refcounted(enum bpf_arg_type type)
475
475
return type == ARG_PTR_TO_SOCK_COMMON ;
476
476
}
477
477
478
- static bool arg_type_may_be_null ( enum bpf_arg_type type )
478
+ static bool type_may_be_null ( u32 type )
479
479
{
480
- return type == ARG_PTR_TO_MAP_VALUE_OR_NULL ||
481
- type == ARG_PTR_TO_MEM_OR_NULL ||
482
- type == ARG_PTR_TO_CTX_OR_NULL ||
483
- type == ARG_PTR_TO_SOCKET_OR_NULL ||
484
- type == ARG_PTR_TO_ALLOC_MEM_OR_NULL ||
485
- type == ARG_PTR_TO_STACK_OR_NULL ;
480
+ return type & PTR_MAYBE_NULL ;
486
481
}
487
482
488
483
/* Determine whether the function releases some resources allocated by another
@@ -5016,9 +5011,8 @@ static int process_timer_func(struct bpf_verifier_env *env, int regno,
5016
5011
5017
5012
static bool arg_type_is_mem_ptr (enum bpf_arg_type type )
5018
5013
{
5019
- return type == ARG_PTR_TO_MEM ||
5020
- type == ARG_PTR_TO_MEM_OR_NULL ||
5021
- type == ARG_PTR_TO_UNINIT_MEM ;
5014
+ return base_type (type ) == ARG_PTR_TO_MEM ||
5015
+ base_type (type ) == ARG_PTR_TO_UNINIT_MEM ;
5022
5016
}
5023
5017
5024
5018
static bool arg_type_is_mem_size (enum bpf_arg_type type )
@@ -5155,31 +5149,26 @@ static const struct bpf_reg_types *compatible_reg_types[__BPF_ARG_TYPE_MAX] = {
5155
5149
[ARG_PTR_TO_MAP_KEY ] = & map_key_value_types ,
5156
5150
[ARG_PTR_TO_MAP_VALUE ] = & map_key_value_types ,
5157
5151
[ARG_PTR_TO_UNINIT_MAP_VALUE ] = & map_key_value_types ,
5158
- [ARG_PTR_TO_MAP_VALUE_OR_NULL ] = & map_key_value_types ,
5159
5152
[ARG_CONST_SIZE ] = & scalar_types ,
5160
5153
[ARG_CONST_SIZE_OR_ZERO ] = & scalar_types ,
5161
5154
[ARG_CONST_ALLOC_SIZE_OR_ZERO ] = & scalar_types ,
5162
5155
[ARG_CONST_MAP_PTR ] = & const_map_ptr_types ,
5163
5156
[ARG_PTR_TO_CTX ] = & context_types ,
5164
- [ARG_PTR_TO_CTX_OR_NULL ] = & context_types ,
5165
5157
[ARG_PTR_TO_SOCK_COMMON ] = & sock_types ,
5166
5158
#ifdef CONFIG_NET
5167
5159
[ARG_PTR_TO_BTF_ID_SOCK_COMMON ] = & btf_id_sock_common_types ,
5168
5160
#endif
5169
5161
[ARG_PTR_TO_SOCKET ] = & fullsock_types ,
5170
- [ARG_PTR_TO_SOCKET_OR_NULL ] = & fullsock_types ,
5171
5162
[ARG_PTR_TO_BTF_ID ] = & btf_ptr_types ,
5172
5163
[ARG_PTR_TO_SPIN_LOCK ] = & spin_lock_types ,
5173
5164
[ARG_PTR_TO_MEM ] = & mem_types ,
5174
- [ARG_PTR_TO_MEM_OR_NULL ] = & mem_types ,
5175
5165
[ARG_PTR_TO_UNINIT_MEM ] = & mem_types ,
5176
5166
[ARG_PTR_TO_ALLOC_MEM ] = & alloc_mem_types ,
5177
- [ARG_PTR_TO_ALLOC_MEM_OR_NULL ] = & alloc_mem_types ,
5178
5167
[ARG_PTR_TO_INT ] = & int_ptr_types ,
5179
5168
[ARG_PTR_TO_LONG ] = & int_ptr_types ,
5180
5169
[ARG_PTR_TO_PERCPU_BTF_ID ] = & percpu_btf_ptr_types ,
5181
5170
[ARG_PTR_TO_FUNC ] = & func_ptr_types ,
5182
- [ARG_PTR_TO_STACK_OR_NULL ] = & stack_ptr_types ,
5171
+ [ARG_PTR_TO_STACK ] = & stack_ptr_types ,
5183
5172
[ARG_PTR_TO_CONST_STR ] = & const_str_ptr_types ,
5184
5173
[ARG_PTR_TO_TIMER ] = & timer_types ,
5185
5174
};
@@ -5193,7 +5182,7 @@ static int check_reg_type(struct bpf_verifier_env *env, u32 regno,
5193
5182
const struct bpf_reg_types * compatible ;
5194
5183
int i , j ;
5195
5184
5196
- compatible = compatible_reg_types [arg_type ];
5185
+ compatible = compatible_reg_types [base_type ( arg_type ) ];
5197
5186
if (!compatible ) {
5198
5187
verbose (env , "verifier internal error: unsupported arg type %d\n" , arg_type );
5199
5188
return - EFAULT ;
@@ -5274,15 +5263,14 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
5274
5263
return - EACCES ;
5275
5264
}
5276
5265
5277
- if (arg_type == ARG_PTR_TO_MAP_VALUE ||
5278
- arg_type == ARG_PTR_TO_UNINIT_MAP_VALUE ||
5279
- arg_type == ARG_PTR_TO_MAP_VALUE_OR_NULL ) {
5266
+ if (base_type (arg_type ) == ARG_PTR_TO_MAP_VALUE ||
5267
+ base_type (arg_type ) == ARG_PTR_TO_UNINIT_MAP_VALUE ) {
5280
5268
err = resolve_map_arg_type (env , meta , & arg_type );
5281
5269
if (err )
5282
5270
return err ;
5283
5271
}
5284
5272
5285
- if (register_is_null (reg ) && arg_type_may_be_null (arg_type ))
5273
+ if (register_is_null (reg ) && type_may_be_null (arg_type ))
5286
5274
/* A NULL register has a SCALAR_VALUE type, so skip
5287
5275
* type checking.
5288
5276
*/
@@ -5351,10 +5339,11 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
5351
5339
err = check_helper_mem_access (env , regno ,
5352
5340
meta -> map_ptr -> key_size , false,
5353
5341
NULL );
5354
- } else if (arg_type == ARG_PTR_TO_MAP_VALUE ||
5355
- (arg_type == ARG_PTR_TO_MAP_VALUE_OR_NULL &&
5356
- !register_is_null (reg )) ||
5357
- arg_type == ARG_PTR_TO_UNINIT_MAP_VALUE ) {
5342
+ } else if (base_type (arg_type ) == ARG_PTR_TO_MAP_VALUE ||
5343
+ base_type (arg_type ) == ARG_PTR_TO_UNINIT_MAP_VALUE ) {
5344
+ if (type_may_be_null (arg_type ) && register_is_null (reg ))
5345
+ return 0 ;
5346
+
5358
5347
/* bpf_map_xxx(..., map_ptr, ..., value) call:
5359
5348
* check [value, value + map->value_size) validity
5360
5349
*/
0 commit comments