• Kumar Kartikeya Dwivedi's avatar
    bpf: Invalidate slices on destruction of dynptrs on stack · f8064ab9
    Kumar Kartikeya Dwivedi authored
    The previous commit implemented destroy_if_dynptr_stack_slot. It
    destroys the dynptr which given spi belongs to, but still doesn't
    invalidate the slices that belong to such a dynptr. While for the case
    of referenced dynptr, we don't allow their overwrite and return an error
    early, we still allow it and destroy the dynptr for unreferenced dynptr.
    
    To be able to enable precise and scoped invalidation of dynptr slices in
    this case, we must be able to associate the source dynptr of slices that
    have been obtained using bpf_dynptr_data. When doing destruction, only
    slices belonging to the dynptr being destructed should be invalidated,
    and nothing else. Currently, dynptr slices belonging to different
    dynptrs are indistinguishible.
    
    Hence, allocate a unique id to each dynptr (CONST_PTR_TO_DYNPTR and
    those on stack). This will be stored as part of reg->id. Whenever using
    bpf_dynptr_data, transfer this unique dynptr id to the returned
    PTR_TO_MEM_OR_NULL slice pointer, and store it in a new per-PTR_TO_MEM
    dynptr_id register state member.
    
    Finally, after establishing such a relationship between dynptrs and
    their slices, implement precise invalidation logic that only invalidates
    slices belong to the destroyed dynptr in destroy_if_dynptr_stack_slot.
    Acked-by: default avatarJoanne Koong <joannelkoong@gmail.com>
    Signed-off-by: default avatarKumar Kartikeya Dwivedi <memxor@gmail.com>
    Link: https://lore.kernel.org/r/20230121002241.2113993-5-memxor@gmail.comSigned-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
    f8064ab9
verifier.c 503 KB