• Benjamin Tissoires's avatar
    bpf: split btf_check_subprog_arg_match in two · 95f2f26f
    Benjamin Tissoires authored
    btf_check_subprog_arg_match() was used twice in verifier.c:
    - when checking for the type mismatches between a (sub)prog declaration
      and BTF
    - when checking the call of a subprog to see if the provided arguments
      are correct and valid
    
    This is problematic when we check if the first argument of a program
    (pointer to ctx) is correctly accessed:
    To be able to ensure we access a valid memory in the ctx, the verifier
    assumes the pointer to context is not null.
    This has the side effect of marking the program accessing the entire
    context, even if the context is never dereferenced.
    
    For example, by checking the context access with the current code, the
    following eBPF program would fail with -EINVAL if the ctx is set to null
    from the userspace:
    
    ```
    SEC("syscall")
    int prog(struct my_ctx *args) {
      return 0;
    }
    ```
    
    In that particular case, we do not want to actually check that the memory
    is correct while checking for the BTF validity, but we just want to
    ensure that the (sub)prog definition matches the BTF we have.
    
    So split btf_check_subprog_arg_match() in two so we can actually check
    for the memory used when in a call, and ignore that part when not.
    
    Note that a further patch is in preparation to disentangled
    btf_check_func_arg_match() from these two purposes, and so right now we
    just add a new hack around that by adding a boolean to this function.
    Signed-off-by: default avatarBenjamin Tissoires <benjamin.tissoires@redhat.com>
    Acked-by: default avatarKumar Kartikeya Dwivedi <memxor@gmail.com>
    Link: https://lore.kernel.org/r/20220906151303.2780789-3-benjamin.tissoires@redhat.comSigned-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
    95f2f26f
verifier.c 436 KB