Jiri Olsa wrote:
> When accessing the context we allow access to arguments with
> scalar type and pointer to struct. But we omit pointer to scalar
> type, which is the case for many functions and same case as
> when accessing scalar.
>
> Adding the check if the pointer is to scalar type and allow it.
>
> Signed-off-by: Jiri Olsa <jolsa@xxxxxxxxxx>
> ---
> kernel/bpf/btf.c | 13 ++++++++++++-
> 1 file changed, 12 insertions(+), 1 deletion(-)
>
> diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
> index 832b5d7fd892..207ae554e0ce 100644
> --- a/kernel/bpf/btf.c
> +++ b/kernel/bpf/btf.c
> @@ -3668,7 +3668,7 @@ bool btf_ctx_access(int off, int size, enum bpf_access_type type,
> const struct bpf_prog *prog,
> struct bpf_insn_access_aux *info)
> {
> - const struct btf_type *t = prog->aux->attach_func_proto;
> + const struct btf_type *tp, *t = prog->aux->attach_func_proto;
> struct bpf_prog *tgt_prog = prog->aux->linked_prog;
> struct btf *btf = bpf_prog_get_target_btf(prog);
> const char *tname = prog->aux->attach_func_name;
> @@ -3730,6 +3730,17 @@ bool btf_ctx_access(int off, int size, enum bpf_access_type type,
> */
> return true;
>
> + tp = btf_type_by_id(btf, t->type);
> + /* skip modifiers */
> + while (btf_type_is_modifier(tp))
> + tp = btf_type_by_id(btf, tp->type);
> +
> + if (btf_type_is_int(tp) || btf_type_is_enum(tp))
> + /* This is a pointer scalar.
> + * It is the same as scalar from the verifier safety pov.
> + */
> + return true;
> +
> /* this is a pointer to another type */
> info->reg_type = PTR_TO_BTF_ID;
>
Acked-by: John Fastabend <john.fastabend@xxxxxxxxx>
