• Dave Marchevsky's avatar
    bpf: Loosen alloc obj test in verifier's reg_btf_record · d8939cb0
    Dave Marchevsky authored
    btf->struct_meta_tab is populated by btf_parse_struct_metas in btf.c.
    There, a BTF record is created for any type containing a spin_lock or
    any next-gen datastructure node/head.
    
    Currently, for non-MAP_VALUE types, reg_btf_record will only search for
    a record using struct_meta_tab if the reg->type exactly matches
    (PTR_TO_BTF_ID | MEM_ALLOC). This exact match is too strict: an
    "allocated obj" type - returned from bpf_obj_new - might pick up other
    flags while working its way through the program.
    
    Loosen the check to be exact for base_type and just use MEM_ALLOC mask
    for type_flag.
    
    This patch is marked Fixes as the original intent of reg_btf_record was
    unlikely to have been to fail finding btf_record for valid alloc obj
    types with additional flags, some of which (e.g. PTR_UNTRUSTED)
    are valid register type states for alloc obj independent of this series.
    However, I didn't find a specific broken repro case outside of this
    series' added functionality, so it's possible that nothing was
    triggering this logic error before.
    Signed-off-by: default avatarDave Marchevsky <davemarchevsky@fb.com>
    cc: Kumar Kartikeya Dwivedi <memxor@gmail.com>
    Fixes: 4e814da0 ("bpf: Allow locking bpf_spin_lock in allocated objects")
    Link: https://lore.kernel.org/r/20221206231000.3180914-2-davemarchevsky@fb.comSigned-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
    d8939cb0
verifier.c 488 KB