mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2026-08-09 06:14:34 +02:00
Amery HungandKumar Kartikeya Dwivedi
31f61ac330
Redefine dynptr mutability and fix inconsistency in the verifier and kfunc signatures. Dynptr mutability is at two levels. The first is the bpf_dynptr structure and the second is the memory the dynptr points to. The verifer currently tracks the mutability of the bpf_dynptr struct through helper and kfunc prototypes, where "const struct bpf_dynptr *" means the structure itself is immutable. The second level is tracked in upper bit of bpf_dynptr->size in runtime and is not changed in this patch. There are two type of inconsistency in the verfier regarding the mutability of the bpf_dynptr struct. First, there are many existing kfuncs whose prototypes are wrong. For example, bpf_dynptr_adjust() mutates a dynptr's start and offset but marks the argument as a const pointer. At the same time many other kfuncs that does not mutate the dynptr but mark themselves as mutable. Second, the verifier currently does not honor the const qualifier in kfunc prototypes as it determines whether tagging the arg_type with MEM_RDONLY or not based on the register state. Since all the verifier care is to prevent CONST_PTR_TO_DYNPTR from being destroyed in callback and global subprogram, redefine the mutability at the bpf_dynptr level to just bpf_dynptr_kern->data. Then, explicitly prohibit passing CONST_PTR_TO_DYNPTR to an argument tagged with MEM_UNINIT or OBJ_RELEASE. The mutability of a dynptr's view is not really interesting so drop MEM_RDONLY annotation for dynptr from the helpers and kfuncs. Plus, if the mutability of the entire bpf_dynptr were to be done correctly, it would kill the bpf_dynptr_adjust() usage in callback and global subporgram. Implementation wise - First, make sure all kfunc arg are correctly tagged: Tag the dynptr argument of bpf_dynptr_file_discard() with OBJ_RELEASE. - Then, in process_dynptr_func(), make sure CONST_PTR_TO_DYNPTR cannot be passed to argument tagged with MEM_UNINIT or OBJ_RELEASE. For MEM_UNINIT, it is already checked by is_dynptr_reg_valid_uninit(). For OBJ_RELEASE, check against OBJ_RELEASE instead of MEM_RDONLY and drop a now identical check in unmark_stack_slots_dynptr(). - Remove the mutual exclusive check between MEM_UNINIT and MEM_RDONLY, but don't add a MEM_UNINIT and OBJ_RELEASE version as it is obviously wrong. Note that while this patch stops following the C semantic for the mutability of bpf_dynptr, the prototype of kfuncs are still fixed to maintain the correct C semantics in the implementation. Adding or removing the const qualifier does not break backward compatibility. In addition, fix kfuncs dropping the const qualifier when casting the opaque bpf_dynptr to bpf_dynptr_kern. In test_kfunc_dynptr_param.c, initialize dynptr to 0 to avoid -Wuninitialized-const-pointer warning. Signed-off-by: Amery Hung <ameryhung@gmail.com> Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Link: https://lore.kernel.org/bpf/20260414191014.1218567-1-ameryhung@gmail.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
96 lines
3.4 KiB
C
96 lines
3.4 KiB
C
#ifndef __BPF_KFUNCS__
|
|
#define __BPF_KFUNCS__
|
|
|
|
struct bpf_sock_addr_kern;
|
|
|
|
/* Description
|
|
* Initializes an skb-type dynptr
|
|
* Returns
|
|
* Error code
|
|
*/
|
|
extern int bpf_dynptr_from_skb(struct __sk_buff *skb, __u64 flags,
|
|
struct bpf_dynptr *ptr__uninit) __ksym __weak;
|
|
|
|
/* Description
|
|
* Initializes an xdp-type dynptr
|
|
* Returns
|
|
* Error code
|
|
*/
|
|
extern int bpf_dynptr_from_xdp(struct xdp_md *xdp, __u64 flags,
|
|
struct bpf_dynptr *ptr__uninit) __ksym __weak;
|
|
|
|
extern int bpf_dynptr_from_skb_meta(struct __sk_buff *skb, __u64 flags,
|
|
struct bpf_dynptr *ptr__uninit) __ksym __weak;
|
|
|
|
/* Description
|
|
* Obtain a read-only pointer to the dynptr's data
|
|
* Returns
|
|
* Either a direct pointer to the dynptr data or a pointer to the user-provided
|
|
* buffer if unable to obtain a direct pointer
|
|
*/
|
|
extern void *bpf_dynptr_slice(const struct bpf_dynptr *ptr, __u64 offset,
|
|
void *buffer, __u64 buffer__szk) __ksym __weak;
|
|
|
|
/* Description
|
|
* Obtain a read-write pointer to the dynptr's data
|
|
* Returns
|
|
* Either a direct pointer to the dynptr data or a pointer to the user-provided
|
|
* buffer if unable to obtain a direct pointer
|
|
*/
|
|
extern void *bpf_dynptr_slice_rdwr(const struct bpf_dynptr *ptr, __u64 offset, void *buffer,
|
|
__u64 buffer__szk) __ksym __weak;
|
|
|
|
extern int bpf_dynptr_adjust(struct bpf_dynptr *ptr, __u64 start, __u64 end) __ksym __weak;
|
|
extern bool bpf_dynptr_is_null(const struct bpf_dynptr *ptr) __ksym __weak;
|
|
extern bool bpf_dynptr_is_rdonly(const struct bpf_dynptr *ptr) __ksym __weak;
|
|
extern __u64 bpf_dynptr_size(const struct bpf_dynptr *ptr) __ksym __weak;
|
|
extern int bpf_dynptr_clone(const struct bpf_dynptr *ptr, struct bpf_dynptr *clone__init) __ksym __weak;
|
|
|
|
/* Description
|
|
* Modify the address of a AF_UNIX sockaddr.
|
|
* Returns
|
|
* -EINVAL if the address size is too big or, 0 if the sockaddr was successfully modified.
|
|
*/
|
|
extern int bpf_sock_addr_set_sun_path(struct bpf_sock_addr_kern *sa_kern,
|
|
const __u8 *sun_path, __u32 sun_path__sz) __ksym;
|
|
|
|
/* Description
|
|
* Allocate and configure a reqsk and link it with a listener and skb.
|
|
* Returns
|
|
* Error code
|
|
*/
|
|
struct sock;
|
|
struct bpf_tcp_req_attrs;
|
|
extern int bpf_sk_assign_tcp_reqsk(struct __sk_buff *skb, struct sock *sk,
|
|
struct bpf_tcp_req_attrs *attrs, int attrs__sz) __ksym;
|
|
|
|
void *bpf_cast_to_kern_ctx(void *) __ksym;
|
|
|
|
extern void *bpf_rdonly_cast(const void *obj, __u32 btf_id) __ksym __weak;
|
|
|
|
extern int bpf_get_file_xattr(struct file *file, const char *name,
|
|
struct bpf_dynptr *value_ptr) __ksym;
|
|
extern int bpf_get_fsverity_digest(struct file *file, const struct bpf_dynptr *digest_ptr) __ksym;
|
|
|
|
extern struct bpf_key *bpf_lookup_user_key(__s32 serial, __u64 flags) __ksym;
|
|
extern struct bpf_key *bpf_lookup_system_key(__u64 id) __ksym;
|
|
extern void bpf_key_put(struct bpf_key *key) __ksym;
|
|
extern int bpf_verify_pkcs7_signature(const struct bpf_dynptr *data_ptr,
|
|
const struct bpf_dynptr *sig_ptr,
|
|
struct bpf_key *trusted_keyring) __ksym;
|
|
|
|
struct dentry;
|
|
/* Description
|
|
* Returns xattr of a dentry
|
|
* Returns
|
|
* Error code
|
|
*/
|
|
extern int bpf_get_dentry_xattr(struct dentry *dentry, const char *name,
|
|
struct bpf_dynptr *value_ptr) __ksym __weak;
|
|
|
|
extern int bpf_set_dentry_xattr(struct dentry *dentry, const char *name__str,
|
|
const struct bpf_dynptr *value_p, int flags) __ksym __weak;
|
|
extern int bpf_remove_dentry_xattr(struct dentry *dentry, const char *name__str) __ksym __weak;
|
|
|
|
#endif
|