Currently, bpf_dynptr_from_mem() only allows creating dynptr from local
memory of reg type PTR_TO_MAP_VALUE, specifically ringbuf. This patch
futher supports PTR_TO_MEM as a valid source of data.
For a reg to be PTR_TO_MEM in the verifier:
- read map value with special field BPF_UPTR
- ld_imm64 kfunc (MEM_RDONLY)
- ld_imm64 other non-struct ksyms (MEM_RDONLY)
- return from helper with RET_PTR_TO_MEM: ringbuf_reserve (MEM_RINGBUF)
and dynptr_from_data
- return from helper with RET_PTR_TO_MEM_OR_BTF_ID: this_cpu_ptr,
per_cpu_ptr and the return type is not struct (both MEM_RDONLY)
- return from special kfunc: dynptr_slice (MEM_RDONLY), dynptr_slice_rdwr
- return from non-special kfunc that returns non-struct pointer:
hid_bpf_get_data
Since this patch only allows PTR_TO_MEM without any flags, so only uptr,
global subprog argument, non-special kfunc that returns non-struct ptr,
return of bpf_dynptr_slice_rdwr() and bpf_dynptr_data() will be allowed
additionally.
The last two will allow creating dynptr from dynptr data. Will they create
any problem?
Signed-off-by: Amery Hung <ameryhung@xxxxxxxxx>
---
include/uapi/linux/bpf.h | 4 +++-
kernel/bpf/verifier.c | 3 ++-
2 files changed, 5 insertions(+), 2 deletions(-)
diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index beac5cdf2d2c..2b1335fa1173 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -5562,7 +5562,9 @@ union bpf_attr {
* Description
* Get a dynptr to local memory *data*.
*
- * *data* must be a ptr to a map value.
+ * *data* must be a ptr to valid local memory such as a map value, a uptr,
+ * a null-checked non-void pointer pass to a global subprogram, and allocated
+ * memory returned by a kfunc such as hid_bpf_get_data(),
* The maximum *size* supported is DYNPTR_MAX_SIZE.
* *flags* is currently unused.
* Return
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 22c4edc8695c..d22310d1642c 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -11307,7 +11307,8 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn
}
break;
case BPF_FUNC_dynptr_from_mem:
- if (regs[BPF_REG_1].type != PTR_TO_MAP_VALUE) {
+ if (regs[BPF_REG_1].type != PTR_TO_MAP_VALUE &&
+ regs[BPF_REG_1].type != PTR_TO_MEM) {
verbose(env, "Unsupported reg type %s for bpf_dynptr_from_mem data\n",
reg_type_str(env, regs[BPF_REG_1].type));
return -EACCES;
--
2.47.1
