On Fri, Feb 17, 2023 at 10:15 AM Joanne Koong <joannelkoong@xxxxxxxxx> wrote:
>
> On Fri, Feb 17, 2023 at 1:06 AM Jiri Olsa <olsajiri@xxxxxxxxx> wrote:
> >
> > On Thu, Feb 16, 2023 at 04:54:51PM -0800, Joanne Koong wrote:
> > > This change refactors check_mem_access() to check against the base type of
> > > the register, and uses switch case checking instead of if / else if
> > > checks. This change also uses the existing clear_called_saved_regs()
> > > function for resetting caller saved regs in check_helper_call().
> > >
> > > Signed-off-by: Joanne Koong <joannelkoong@xxxxxxxxx>
> > > ---
> > > kernel/bpf/verifier.c | 67 +++++++++++++++++++++++++++++--------------
> > > 1 file changed, 46 insertions(+), 21 deletions(-)
> > >
> > > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> > > index 272563a0b770..b40165be2943 100644
> > > --- a/kernel/bpf/verifier.c
> > > +++ b/kernel/bpf/verifier.c
> > > @@ -5317,7 +5317,8 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
> > > /* for access checks, reg->off is just part of off */
> > > off += reg->off;
> > >
> > > - if (reg->type == PTR_TO_MAP_KEY) {
> > > + switch (base_type(reg->type)) {
> > > + case PTR_TO_MAP_KEY:
> > > if (t == BPF_WRITE) {
> > > verbose(env, "write to change key R%d not allowed\n", regno);
> > > return -EACCES;
> > > @@ -5329,7 +5330,10 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
> > > return err;
> > > if (value_regno >= 0)
> > > mark_reg_unknown(env, regs, value_regno);
> > > - } else if (reg->type == PTR_TO_MAP_VALUE) {
> > > +
> > > + break;
> > > + case PTR_TO_MAP_VALUE:
> > > + {
> >
> > I'm getting failure in this test:
> > #92/1 jeq_infer_not_null/jeq_infer_not_null_ptr_to_btfid:FAIL
> >
> > I wonder with this change we execute this case even if there's PTR_MAYBE_NULL set,
> > which we did not do before, so the test won't fail now as expected
>
> Thanks for reviewing this, I will investigate this test failure!
I'm going to abandon this patch, on a closer look I don't think it's
accurate. For most of these matches, it needs to be a strict match (eg
reg->type should be exactly PTR_TO_MAP_KEY) and any type modifiers
should fail (eg PTR_MAYBE_NULL)
>
> >
> > > struct btf_field *kptr_field = NULL;
> > >
> > > if (t == BPF_WRITE && value_regno >= 0 &&
> > > @@ -5369,7 +5373,10 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
> > > mark_reg_unknown(env, regs, value_regno);
> > > }
> > > }
> > > - } else if (base_type(reg->type) == PTR_TO_MEM) {
> > > + break;
> > > + }
> >
> > SNIP
> >
> > > @@ -5521,7 +5539,17 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
> > >
> > > if (!err && value_regno >= 0 && (rdonly_mem || t == BPF_READ))
> > > mark_reg_unknown(env, regs, value_regno);
> > > - } else {
> > > + break;
> > > + }
> > > + case PTR_TO_BTF_ID:
> > > + if (!type_may_be_null(reg->type)) {
> > > + err = check_ptr_to_btf_access(env, regs, regno, off, size, t,
> > > + value_regno);
> > > + break;
> > > + } else {
> > > + fallthrough;
> > > + }
> >
> > nit, no need for the else branch, just use fallthrough directly
> >
> > > + default:
> > > verbose(env, "R%d invalid mem access '%s'\n", regno,
> > > reg_type_str(env, reg->type));
> > > return -EACCES;
> > > @@ -8377,10 +8405,7 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn
> > > return err;
> > >
> > > /* reset caller saved regs */
> >
> > nit, we could remove the comment as well, the function name says it all
> >
> > jirka
> >
> > > - for (i = 0; i < CALLER_SAVED_REGS; i++) {
> > > - mark_reg_not_init(env, regs, caller_saved[i]);
> > > - check_reg_arg(env, caller_saved[i], DST_OP_NO_MARK);
> > > - }
> > > + clear_caller_saved_regs(env, regs);
> > >
> > > /* helper call returns 64-bit value. */
> > > regs[BPF_REG_0].subreg_def = DEF_NOT_SUBREG;
> > > --
> > > 2.30.2
> > >
