Currently the non-zero offset pointer constraint for KF_TRUSTED_ARGS
kfuncs has been relaxed in commit 605c96997d89 ("bpf: relax zero fixed
offset constraint on KF_TRUSTED_ARGS/KF_RCU"), which means that non-zero
offset does not affect whether a pointer is valid.
But currently we still cannot pass non-zero offset pointers to
KF_ACQUIRE kfuncs. This is because KF_ACQUIRE kfuncs requires strict
type matching, but non-zero offset does not change the type of pointer,
which causes the ebpf program to be rejected by the verifier.
This can cause some problems, one example is that bpf_skb_peek_tail
kfunc [0] cannot be implemented by just passing in non-zero offset
pointers.
This patch makes KF_ACQUIRE kfuncs not require strict type matching
on non-zero offset pointers.
[0]: https://lore.kernel.org/bpf/AM6PR03MB5848CA39CB4B7A4397D380B099B12@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/
Signed-off-by: Juntong Deng <juntong.deng@xxxxxxxxxxx>
---
kernel/bpf/verifier.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index ebec74c28ae3..3a14002d24a0 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -11484,7 +11484,7 @@ static int process_kf_arg_ptr_to_btf_id(struct bpf_verifier_env *env,
* btf_struct_ids_match() to walk the struct at the 0th offset, and
* resolve types.
*/
- if (is_kfunc_acquire(meta) ||
+ if ((is_kfunc_acquire(meta) && !reg->off) ||
(is_kfunc_release(meta) && reg->ref_obj_id) ||
btf_type_ids_nocast_alias(&env->log, reg_btf, reg_ref_id, meta->btf, ref_id))
strict_type_match = true;
--
2.39.2
