On 2/8/21 11:47 AM, Hangbin Liu wrote:
Add a new bpf argument type ARG_CONST_MAP_PTR_OR_NULL which could be
used when we want to allow NULL pointer for map parameter. The bpf helper
need to take care and check if the map is NULL when use this type.
Acked-by: Toke Høiland-Jørgensen <toke@xxxxxxxxxx>
Acked-by: John Fastabend <john.fastabend@xxxxxxxxx>
Signed-off-by: Hangbin Liu <liuhangbin@xxxxxxxxx>
[...]
@@ -4259,9 +4261,9 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
meta->ref_obj_id = reg->ref_obj_id;
}
- if (arg_type == ARG_CONST_MAP_PTR) {
- /* bpf_map_xxx(map_ptr) call: remember that map_ptr */
- meta->map_ptr = reg->map_ptr;
+ if (arg_type == ARG_CONST_MAP_PTR ||
+ arg_type == ARG_CONST_MAP_PTR_OR_NULL) {
+ meta->map_ptr = register_is_null(reg) ? NULL : reg->map_ptr;
Sorry, but after re-reading this is unfortunately still broken :( Looking at your
helper func proto:
+static const struct bpf_func_proto bpf_xdp_redirect_map_multi_proto = {
+ .func = bpf_xdp_redirect_map_multi,
+ .gpl_only = false,
+ .ret_type = RET_INTEGER,
+ .arg1_type = ARG_CONST_MAP_PTR,
+ .arg2_type = ARG_CONST_MAP_PTR_OR_NULL,
+ .arg3_type = ARG_ANYTHING,
+};
So in check_helper_call() first meta->map_ptr is set to arg1 map, then when
checking arg2 map it can either be const NULL or a valid map ptr, but then
later on in check_map_func_compatibility() we only end up checking compatibility
of the /2nd/ map (e.g. on !meta->map_ptr we just return 0). This means, we
can pass whatever map type as arg1 map and it will pass the verifier just fine.
