On Tue, 2024-04-09 at 17:41 -0700, Kui-Feng Lee wrote:
> Previously, check_map_kptr_access() assumed that the accessed offset was
> identical to the offset in the btf_field. However, once field array is
> supported, the accessed offset no longer matches the offset in the
> bpf_field. It may refer to an element in an array while the offset in the
> bpf_field refers to the beginning of the array.
>
> To handle arrays, it computes the offset from the reg state instead.
>
> Signed-off-by: Kui-Feng Lee <thinker.li@xxxxxxxxx>
> ---
Acked-by: Eduard Zingerman <eddyz87@xxxxxxxxx>
> kernel/bpf/verifier.c | 15 +++++++++------
> 1 file changed, 9 insertions(+), 6 deletions(-)
>
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 86adacc5f76c..34e43220c6f0 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -5349,18 +5349,19 @@ static u32 btf_ld_kptr_type(struct bpf_verifier_env *env, struct btf_field *kptr
> }
>
> static int check_map_kptr_access(struct bpf_verifier_env *env, u32 regno,
> - int value_regno, int insn_idx,
> + u32 offset, int value_regno, int insn_idx,
> struct btf_field *kptr_field)
> {
> struct bpf_insn *insn = &env->prog->insnsi[insn_idx];
> int class = BPF_CLASS(insn->code);
> - struct bpf_reg_state *val_reg;
> + struct bpf_reg_state *val_reg, *reg;
>
> /* Things we already checked for in check_map_access and caller:
Nit: at the moment when this patch is applied check_map_access is not
yet modified.
> * - Reject cases where variable offset may touch kptr
> * - size of access (must be BPF_DW)
> * - tnum_is_const(reg->var_off)
> - * - kptr_field->offset == off + reg->var_off.value
> + * - kptr_field->offset + kptr_field->size * i / kptr_field->nelems
> + * == off + reg->var_off.value where n is an index into the array
^^^ nit: this should be 'i'
> */
> /* Only BPF_[LDX,STX,ST] | BPF_MEM | BPF_DW is supported */
> if (BPF_MODE(insn->code) != BPF_MEM) {
[...]
