Commit 12659d28 authored by Tao Lyu's avatar Tao Lyu Committed by Alexei Starovoitov
Browse files

bpf: Ensure reg is PTR_TO_STACK in process_iter_arg 



Currently, KF_ARG_PTR_TO_ITER handling missed checking the reg->type and
ensuring it is PTR_TO_STACK. Instead of enforcing this in the caller of
process_iter_arg, move the check into it instead so that all callers
will gain the check by default. This is similar to process_dynptr_func.

An existing selftest in verifier_bits_iter.c fails due to this change,
but it's because it was passing a NULL pointer into iter_next helper and
getting an error further down the checks, but probably meant to pass an
uninitialized iterator on the stack (as is done in the subsequent test
below it). We will gain coverage for non-PTR_TO_STACK arguments in later
patches hence just change the declaration to zero-ed stack object.

Fixes: 06accc87 ("bpf: add support for open-coded iterator loops")
Suggested-by: default avatarAndrii Nakryiko <andrii@kernel.org>
Signed-off-by: default avatarTao Lyu <tao.lyu@epfl.ch>
[ Kartikeya: move check into process_iter_arg, rewrite commit log ]
Signed-off-by: default avatarKumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/r/20241203000238.3602922-2-memxor@gmail.com


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent 537a2525

kernel/bpf/verifier.c

+5 −0
Original line number Diff line number Diff line
@@ -8189,6 +8189,11 @@ static int process_iter_arg(struct bpf_verifier_env *env, int regno, int insn_id 
	const struct btf_type *t;

	int spi, err, i, nr_slots, btf_id;









	if (reg->type != PTR_TO_STACK) {









		verbose(env, "arg#%d expected pointer to an iterator on stack\n", regno - 1);









		return -EINVAL;









	}

















	/* For iter_{new,next,destroy} functions, btf_check_iter_kfuncs()









	 * ensures struct convention, so we wouldn't need to do any BTF









	 * validation here. But given iter state can be passed as a parameter
































tools/testing/selftests/bpf/progs/verifier_bits_iter.c



+2
−2






























Original line number
Diff line number
Diff line







@@ -35,9 +35,9 @@ __description("uninitialized iter in ->next()")







__failure __msg("expected an initialized iter_bits as arg #1")









int BPF_PROG(next_uninit, struct bpf_iter_meta *meta, struct cgroup *cgrp)









{









	struct bpf_iter_bits *it = NULL;









	struct bpf_iter_bits it = {};



















	bpf_iter_bits_next(it);









	bpf_iter_bits_next(&it);









	return 0;









}