On Thu, Apr 21, 2022 at 09:49:54AM IST, Alexei Starovoitov wrote:
> On Fri, Apr 15, 2022 at 09:33:45PM +0530, Kumar Kartikeya Dwivedi wrote:
> > Add a new type flag for bpf_arg_type that when set tells verifier that
> > for a release function, that argument's register will be the one for
> > which meta.ref_obj_id will be set, and which will then be released
> > using release_reference. To capture the regno, introduce a new field
> > release_regno in bpf_call_arg_meta.
> >
> > This would be required in the next patch, where we may either pass NULL
> > or a refcounted pointer as an argument to the release function
> > bpf_kptr_xchg. Just releasing only when meta.ref_obj_id is set is not
> > enough, as there is a case where the type of argument needed matches,
> > but the ref_obj_id is set to 0. Hence, we must enforce that whenever
> > meta.ref_obj_id is zero, the register that is to be released can only
> > be NULL for a release function.
> >
> > Since we now indicate whether an argument is to be released in
> > bpf_func_proto itself, is_release_function helper has lost its utitlity,
> > hence refactor code to work without it, and just rely on
> > meta.release_regno to know when to release state for a ref_obj_id.
> > Still, the restriction of one release argument and only one ref_obj_id
> > passed to BPF helper or kfunc remains. This may be lifted in the future.
> >
> > Signed-off-by: Kumar Kartikeya Dwivedi <memxor@xxxxxxxxx>
> > ---
> > include/linux/bpf.h | 5 +-
> > include/linux/bpf_verifier.h | 3 +-
> > kernel/bpf/btf.c | 9 ++-
> > kernel/bpf/ringbuf.c | 4 +-
> > kernel/bpf/verifier.c | 76 +++++++++++--------
> > net/core/filter.c | 2 +-
> > .../selftests/bpf/verifier/ref_tracking.c | 2 +-
> > tools/testing/selftests/bpf/verifier/sock.c | 6 +-
> > 8 files changed, 60 insertions(+), 47 deletions(-)
> >
> > diff --git a/include/linux/bpf.h b/include/linux/bpf.h
> > index ab86f4675db2..f73a3f10e654 100644
> > --- a/include/linux/bpf.h
> > +++ b/include/linux/bpf.h
> > @@ -366,7 +366,10 @@ enum bpf_type_flag {
> > */
> > MEM_PERCPU = BIT(4 + BPF_BASE_TYPE_BITS),
> >
> > - __BPF_TYPE_LAST_FLAG = MEM_PERCPU,
> > + /* Indicates that the pointer argument will be released. */
> > + PTR_RELEASE = BIT(5 + BPF_BASE_TYPE_BITS),
>
> I think OBJ_RELEASE as Joanne did it in her patch is a better name.
>
> "pointer release" is not quite correct.
> It's an object that pointer is pointing to will be released.
>
Ok, will rename.
> > +
> > + __BPF_TYPE_LAST_FLAG = PTR_RELEASE,
> > };
> >
> > /* Max number of base types. */
> > diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h
> > index 3a9d2d7cc6b7..1f1e7f2ea967 100644
> > --- a/include/linux/bpf_verifier.h
> > +++ b/include/linux/bpf_verifier.h
> > @@ -523,8 +523,7 @@ int check_ptr_off_reg(struct bpf_verifier_env *env,
> > const struct bpf_reg_state *reg, int regno);
> > int check_func_arg_reg_off(struct bpf_verifier_env *env,
> > const struct bpf_reg_state *reg, int regno,
> > - enum bpf_arg_type arg_type,
> > - bool is_release_func);
> > + enum bpf_arg_type arg_type);
> > int check_kfunc_mem_size_reg(struct bpf_verifier_env *env, struct bpf_reg_state *reg,
> > u32 regno);
> > int check_mem_reg(struct bpf_verifier_env *env, struct bpf_reg_state *reg,
> > diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
> > index be191df76ea4..7227a77a02f7 100644
> > --- a/kernel/bpf/btf.c
> > +++ b/kernel/bpf/btf.c
> > @@ -5993,6 +5993,7 @@ static int btf_check_func_arg_match(struct bpf_verifier_env *env,
> > * verifier sees.
> > */
> > for (i = 0; i < nargs; i++) {
> > + enum bpf_arg_type arg_type = ARG_DONTCARE;
> > u32 regno = i + 1;
> > struct bpf_reg_state *reg = ®s[regno];
> >
> > @@ -6013,7 +6014,9 @@ static int btf_check_func_arg_match(struct bpf_verifier_env *env,
> > ref_t = btf_type_skip_modifiers(btf, t->type, &ref_id);
> > ref_tname = btf_name_by_offset(btf, ref_t->name_off);
> >
> > - ret = check_func_arg_reg_off(env, reg, regno, ARG_DONTCARE, rel);
> > + if (rel && reg->ref_obj_id)
> > + arg_type |= PTR_RELEASE;
>
> Don't get it. Why ?
>
It uses arg_type_is_release_ptr, so to indicate this is release argument we set
this flag.
> > + ret = check_func_arg_reg_off(env, reg, regno, arg_type);
> > if (ret < 0)
> > return ret;
> >
> > @@ -6046,9 +6049,7 @@ static int btf_check_func_arg_match(struct bpf_verifier_env *env,
> > reg_btf = reg->btf;
> > reg_ref_id = reg->btf_id;
> > /* Ensure only one argument is referenced
> > - * PTR_TO_BTF_ID, check_func_arg_reg_off relies
> > - * on only one referenced register being allowed
> > - * for kfuncs.
> > + * PTR_TO_BTF_ID.
>
> /* Ensure only one argument is referenced PTR_TO_BTF_ID.
>
Ok.
> > */
> > if (reg->ref_obj_id) {
> > if (ref_obj_id) {
> > diff --git a/kernel/bpf/ringbuf.c b/kernel/bpf/ringbuf.c
> > index 710ba9de12ce..a22c21c0a7ef 100644
> > --- a/kernel/bpf/ringbuf.c
> > +++ b/kernel/bpf/ringbuf.c
> > @@ -404,7 +404,7 @@ BPF_CALL_2(bpf_ringbuf_submit, void *, sample, u64, flags)
> > const struct bpf_func_proto bpf_ringbuf_submit_proto = {
> > .func = bpf_ringbuf_submit,
> > .ret_type = RET_VOID,
> > - .arg1_type = ARG_PTR_TO_ALLOC_MEM,
> > + .arg1_type = ARG_PTR_TO_ALLOC_MEM | PTR_RELEASE,
> > .arg2_type = ARG_ANYTHING,
> > };
> >
> > @@ -417,7 +417,7 @@ BPF_CALL_2(bpf_ringbuf_discard, void *, sample, u64, flags)
> > const struct bpf_func_proto bpf_ringbuf_discard_proto = {
> > .func = bpf_ringbuf_discard,
> > .ret_type = RET_VOID,
> > - .arg1_type = ARG_PTR_TO_ALLOC_MEM,
> > + .arg1_type = ARG_PTR_TO_ALLOC_MEM | PTR_RELEASE,
> > .arg2_type = ARG_ANYTHING,
> > };
> >
> > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> > index c802e51c4e18..97f88d06f848 100644
> > --- a/kernel/bpf/verifier.c
> > +++ b/kernel/bpf/verifier.c
> > @@ -245,6 +245,7 @@ struct bpf_call_arg_meta {
> > struct bpf_map *map_ptr;
> > bool raw_mode;
> > bool pkt_access;
> > + u8 release_regno;
> > int regno;
>
> release_regno and regno are always equal.
> Why go with u8 instead of bool flag?
>
Didn't realise that. I will change it.
> > int access_size;
> > int mem_size;
> > @@ -471,17 +472,6 @@ static bool type_may_be_null(u32 type)
> > return type & PTR_MAYBE_NULL;
> > }
> >
> > -/* Determine whether the function releases some resources allocated by another
> > - * function call. The first reference type argument will be assumed to be
> > - * released by release_reference().
> > - */
> > -static bool is_release_function(enum bpf_func_id func_id)
> > -{
> > - return func_id == BPF_FUNC_sk_release ||
> > - func_id == BPF_FUNC_ringbuf_submit ||
> > - func_id == BPF_FUNC_ringbuf_discard;
> > -}
> > -
> > static bool may_be_acquire_function(enum bpf_func_id func_id)
> > {
> > return func_id == BPF_FUNC_sk_lookup_tcp ||
> > @@ -5304,6 +5294,11 @@ static bool arg_type_is_int_ptr(enum bpf_arg_type type)
> > type == ARG_PTR_TO_LONG;
> > }
> >
> > +static bool arg_type_is_release_ptr(enum bpf_arg_type type)
>
> arg_type_is_relase() ?
>
Ok.
> > +{
> > + return type & PTR_RELEASE;
> > +}
> > +
> > static int int_ptr_type_to_size(enum bpf_arg_type type)
> > {
> > if (type == ARG_PTR_TO_INT)
> > @@ -5514,11 +5509,10 @@ static int check_reg_type(struct bpf_verifier_env *env, u32 regno,
> >
> > int check_func_arg_reg_off(struct bpf_verifier_env *env,
> > const struct bpf_reg_state *reg, int regno,
> > - enum bpf_arg_type arg_type,
> > - bool is_release_func)
> > + enum bpf_arg_type arg_type)
> > {
> > - bool fixed_off_ok = false, release_reg;
> > enum bpf_reg_type type = reg->type;
> > + bool fixed_off_ok = false;
> >
> > switch ((u32)type) {
> > case SCALAR_VALUE:
> > @@ -5536,7 +5530,7 @@ int check_func_arg_reg_off(struct bpf_verifier_env *env,
> > /* Some of the argument types nevertheless require a
> > * zero register offset.
> > */
> > - if (arg_type != ARG_PTR_TO_ALLOC_MEM)
> > + if (base_type(arg_type) != ARG_PTR_TO_ALLOC_MEM)
> > return 0;
> > break;
> > /* All the rest must be rejected, except PTR_TO_BTF_ID which allows
> > @@ -5544,19 +5538,17 @@ int check_func_arg_reg_off(struct bpf_verifier_env *env,
> > */
> > case PTR_TO_BTF_ID:
> > /* When referenced PTR_TO_BTF_ID is passed to release function,
> > - * it's fixed offset must be 0. We rely on the property that
> > - * only one referenced register can be passed to BPF helpers and
> > - * kfuncs. In the other cases, fixed offset can be non-zero.
> > + * it's fixed offset must be 0. In the other cases, fixed offset
> > + * can be non-zero.
> > */
> > - release_reg = is_release_func && reg->ref_obj_id;
> > - if (release_reg && reg->off) {
> > + if (arg_type_is_release_ptr(arg_type) && reg->off) {
> > verbose(env, "R%d must have zero offset when passed to release func\n",
> > regno);
> > return -EINVAL;
> > }
> > - /* For release_reg == true, fixed_off_ok must be false, but we
> > - * already checked and rejected reg->off != 0 above, so set to
> > - * true to allow fixed offset for all other cases.
> > + /* For arg is release pointer, fixed_off_ok must be false, but
> > + * we already checked and rejected reg->off != 0 above, so set
> > + * to true to allow fixed offset for all other cases.
> > */
> > fixed_off_ok = true;
> > break;
> > @@ -5615,14 +5607,24 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
> > if (err)
> > return err;
> >
> > - err = check_func_arg_reg_off(env, reg, regno, arg_type, is_release_function(meta->func_id));
> > + err = check_func_arg_reg_off(env, reg, regno, arg_type);
> > if (err)
> > return err;
> >
> > skip_type_check:
> > - /* check_func_arg_reg_off relies on only one referenced register being
> > - * allowed for BPF helpers.
> > - */
> > + if (arg_type_is_release_ptr(arg_type)) {
> > + if (!reg->ref_obj_id && !register_is_null(reg)) {
> > + verbose(env, "R%d must be referenced when passed to release function\n",
> > + regno);
> > + return -EINVAL;
> > + }
> > + if (meta->release_regno) {
> > + verbose(env, "verifier internal error: more than one release argument\n");
> > + return -EFAULT;
> > + }
> > + meta->release_regno = regno;
> > + }
> > +
> > if (reg->ref_obj_id) {
> > if (meta->ref_obj_id) {
> > verbose(env, "verifier internal error: more than one arg with ref_obj_id R%d %u %u\n",
> > @@ -6129,7 +6131,8 @@ static bool check_btf_id_ok(const struct bpf_func_proto *fn)
> > return true;
> > }
> >
> > -static int check_func_proto(const struct bpf_func_proto *fn, int func_id)
> > +static int check_func_proto(const struct bpf_func_proto *fn, int func_id,
> > + struct bpf_call_arg_meta *meta)
> > {
> > return check_raw_mode_ok(fn) &&
> > check_arg_pair_ok(fn) &&
> > @@ -6813,7 +6816,7 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn
> > memset(&meta, 0, sizeof(meta));
> > meta.pkt_access = fn->pkt_access;
> >
> > - err = check_func_proto(fn, func_id);
> > + err = check_func_proto(fn, func_id, &meta);
> > if (err) {
> > verbose(env, "kernel subsystem misconfigured func %s#%d\n",
> > func_id_name(func_id), func_id);
> > @@ -6846,8 +6849,17 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn
> > return err;
> > }
> >
> > - if (is_release_function(func_id)) {
> > - err = release_reference(env, meta.ref_obj_id);
> > + regs = cur_regs(env);
> > +
> > + if (meta.release_regno) {
> > + err = -EINVAL;
> > + if (meta.ref_obj_id)
> > + err = release_reference(env, meta.ref_obj_id);
> > + /* meta.ref_obj_id can only be 0 if register that is meant to be
> > + * released is NULL, which must be > R0.
> > + */
> > + else if (register_is_null(®s[meta.release_regno]))
> > + err = 0;
> > if (err) {
> > verbose(env, "func %s#%d reference has not been acquired before\n",
> > func_id_name(func_id), func_id);
> > @@ -6855,8 +6867,6 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn
> > }
> > }
> >
> > - regs = cur_regs(env);
> > -
> > switch (func_id) {
> > case BPF_FUNC_tail_call:
> > err = check_reference_leak(env);
> > diff --git a/net/core/filter.c b/net/core/filter.c
> > index 143f442a9505..8eb01a997476 100644
> > --- a/net/core/filter.c
> > +++ b/net/core/filter.c
> > @@ -6621,7 +6621,7 @@ static const struct bpf_func_proto bpf_sk_release_proto = {
> > .func = bpf_sk_release,
> > .gpl_only = false,
> > .ret_type = RET_INTEGER,
> > - .arg1_type = ARG_PTR_TO_BTF_ID_SOCK_COMMON,
> > + .arg1_type = ARG_PTR_TO_BTF_ID_SOCK_COMMON | PTR_RELEASE,
> > };
> >
> > BPF_CALL_5(bpf_xdp_sk_lookup_udp, struct xdp_buff *, ctx,
> > diff --git a/tools/testing/selftests/bpf/verifier/ref_tracking.c b/tools/testing/selftests/bpf/verifier/ref_tracking.c
> > index fbd682520e47..57a83d763ec1 100644
> > --- a/tools/testing/selftests/bpf/verifier/ref_tracking.c
> > +++ b/tools/testing/selftests/bpf/verifier/ref_tracking.c
> > @@ -796,7 +796,7 @@
> > },
> > .prog_type = BPF_PROG_TYPE_SCHED_CLS,
> > .result = REJECT,
> > - .errstr = "reference has not been acquired before",
> > + .errstr = "R1 must be referenced when passed to release function",
> > },
> > {
> > /* !bpf_sk_fullsock(sk) is checked but !bpf_tcp_sock(sk) is not checked */
> > diff --git a/tools/testing/selftests/bpf/verifier/sock.c b/tools/testing/selftests/bpf/verifier/sock.c
> > index 86b24cad27a7..d11d0b28be41 100644
> > --- a/tools/testing/selftests/bpf/verifier/sock.c
> > +++ b/tools/testing/selftests/bpf/verifier/sock.c
> > @@ -417,7 +417,7 @@
> > },
> > .prog_type = BPF_PROG_TYPE_SCHED_CLS,
> > .result = REJECT,
> > - .errstr = "reference has not been acquired before",
> > + .errstr = "R1 must be referenced when passed to release function",
> > },
> > {
> > "bpf_sk_release(bpf_sk_fullsock(skb->sk))",
> > @@ -436,7 +436,7 @@
> > },
> > .prog_type = BPF_PROG_TYPE_SCHED_CLS,
> > .result = REJECT,
> > - .errstr = "reference has not been acquired before",
> > + .errstr = "R1 must be referenced when passed to release function",
> > },
> > {
> > "bpf_sk_release(bpf_tcp_sock(skb->sk))",
> > @@ -455,7 +455,7 @@
> > },
> > .prog_type = BPF_PROG_TYPE_SCHED_CLS,
> > .result = REJECT,
> > - .errstr = "reference has not been acquired before",
> > + .errstr = "R1 must be referenced when passed to release function",
> > },
> > {
> > "sk_storage_get(map, skb->sk, NULL, 0): value == NULL",
> > --
> > 2.35.1
> >
--
Kartikeya
