On Mon, Mar 18, 2024 at 10:59 PM Eduard Zingerman <eddyz87@xxxxxxxxx> wrote:
>
> On Fri, 2024-03-15 at 15:29 +0100, Benjamin Tissoires wrote:
> [...]
>
> > @@ -12021,6 +12034,12 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_
> > if (ret)
> > return ret;
> > break;
> > + case KF_ARG_PTR_TO_TIMER:
> > + if (reg->type != PTR_TO_MAP_VALUE) {
> > + verbose(env, "arg#%d doesn't point to a map value\n", i);
> > + return -EINVAL;
> > + }
> > + break;
>
> I think that pointer offset has to be checked as well,
> otherwise the following program verifies w/o error:
I initially thought it would be harder than it actually was.
Fixed (with the new test below) in v5.
Cheers,
Benjamin
>
> --- 8< ----------------------------
>
> #include <linux/bpf.h>
> #include <time.h>
> #include <errno.h>
> #include <bpf/bpf_helpers.h>
> #include "bpf_tcp_helpers.h"
>
> extern int bpf_timer_set_sleepable_cb_impl(struct bpf_timer *timer,
> int (callback_fn)(void *map, int *key, struct bpf_timer *timer), void *aux__ign) __ksym;
>
> #define bpf_timer_set_sleepable_cb(timer, cb) \
> bpf_timer_set_sleepable_cb_impl(timer, cb, NULL)
>
> struct elem {
> struct bpf_timer t;
> };
>
> struct {
> __uint(type, BPF_MAP_TYPE_ARRAY);
> __uint(max_entries, 2);
> __type(key, int);
> __type(value, struct elem);
> } array SEC(".maps");
>
> static int cb_sleepable(void *map, int *key, struct bpf_timer *timer)
> {
> return 0;
> }
>
> SEC("fentry/bpf_fentry_test5")
> int BPF_PROG2(test_sleepable, int, a)
> {
> struct bpf_timer *arr_timer;
> int array_key = 1;
>
> arr_timer = bpf_map_lookup_elem(&array, &array_key);
> if (!arr_timer)
> return 0;
> bpf_timer_init(arr_timer, &array, CLOCK_MONOTONIC);
> bpf_timer_set_sleepable_cb((void *)arr_timer + 1, // <-- note incorrect offset
> cb_sleepable);
> bpf_timer_start(arr_timer, 0, 0);
> return 0;
> }
>
> char _license[] SEC("license") = "GPL";
>
> ---------------------------- >8 ---
>
