On Mon, Nov 1, 2021 at 8:20 PM Alexei Starovoitov <alexei.starovoitov@xxxxxxxxx> wrote: > > On Mon, Nov 1, 2021 at 8:16 PM Andrii Nakryiko > <andrii.nakryiko@xxxxxxxxx> wrote: > > > > > > > > FILE *vm_file = vma->vm_file; /* no checking is needed, vma from > > > > parameter which is not NULL */ > > > > if (vm_file) > > > > bpf_d_path(&vm_file->f_path, path, sizeof(path)); > > > > > > That should work. > > > The verifier can achieve that by marking certain fields as PTR_TO_BTF_ID_OR_NULL > > > instead of PTR_TO_BTF_ID while walking such pointers. > > > And then disallow pointer arithmetic on PTR_TO_BTF_ID_OR_NULL until it > > > goes through 'if (Rx == NULL)' check inside the program and gets converted to > > > PTR_TO_BTF_ID. > > > Initially we can hard code such fields via BTF_ID(struct, file) macro.' > > > So any pointer that results into a 'struct file' pointer will be > > > PTR_TO_BTF_ID_OR_NULL. > > > > Can we just require all helpers to check NULL if they accept > > PTR_TO_BTF_ID? It's always been a case that PTR_TO_BTF_ID can be null. > > We should audit all the helpers with ARG_PTR_TO_BTF_ID and ensure they > > do proper validation, of course. > > > > Or am I missing the essence of the issue? > > It's not a pointer dereference. It's math on the pointer. The > &vm_file->f_path part. Ah, I see... Makes sense now. > The helper can check that it's [0, few_pages] and declare it's bad. That's basically what happens with direct memory reads, so I guess it would be fine. > I guess we can do that and only do what I proposed for "more than a page" > math on the pointer. Or even disallow "add more than a page offset to > PTR_TO_BTF_ID" > for now, since it will cover 99% of the cases.
