On Mon, 12 Sept 2022 at 17:45, Dave Marchevsky <davemarchevsky@xxxxxx> wrote:
>
> BPF_PTR_POISON was added in commit c0a5a21c25f37 ("bpf: Allow storing
> referenced kptr in map") to denote a bpf_func_proto btf_id which the
> verifier will replace with a dynamically-determined btf_id at verification
> time.
>
> This patch adds verifier 'poison' functionality to BPF_PTR_POISON in
> order to prepare for expanded use of the value to poison ret- and
> arg-btf_id in ongoing work, namely rbtree and linked list patchsets
> [0, 1]. Specifically, when the verifier checks helper calls, it assumes
> that BPF_PTR_POISON'ed ret type will be replaced with a valid type before
> - or in lieu of - the default ret_btf_id logic. Similarly for arg btf_id.
>
> If poisoned btf_id reaches default handling block for either, consider
> this a verifier internal error and fail verification. Otherwise a helper
> w/ poisoned btf_id but no verifier logic replacing the type will cause a
> crash as the invalid pointer is dereferenced.
>
> Also move BPF_PTR_POISON to existing include/linux/posion.h header and
> remove unnecessary shift.
>
> [0]: lore.kernel.org/bpf/20220830172759.4069786-1-davemarchevsky@xxxxxx
> [1]: lore.kernel.org/bpf/20220904204145.3089-1-memxor@xxxxxxxxx
>
> Signed-off-by: Dave Marchevsky <davemarchevsky@xxxxxx>
> ---
Acked-by: Kumar Kartikeya Dwivedi <memxor@xxxxxxxxx>
