Commit 53ee0d66 authored by Ihor Solodrai's avatar Ihor Solodrai Committed by Andrii Nakryiko
Browse files

bpf: Allow kind_flag for BTF type and decl tags 



BTF type tags and decl tags now may have info->kflag set to 1,
changing the semantics of the tag.

Change BTF verification to permit BTF that makes use of this feature:
  * remove kflag check in btf_decl_tag_check_meta(), as both values
    are valid
  * allow kflag to be set for BTF_KIND_TYPE_TAG type in
    btf_ref_type_check_meta()

Make sure kind_flag is NOT set when checking for specific BTF tags,
such as "kptr", "user" etc.

Modify a selftest checking for kflag in decl_tag accordingly.

Signed-off-by: default avatarIhor Solodrai <ihor.solodrai@linux.dev>
Signed-off-by: default avatarAndrii Nakryiko <andrii@kernel.org>
Acked-by: default avatarEduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/bpf/20250130201239.1429648-6-ihor.solodrai@linux.dev
parent 6c2d2a05

kernel/bpf/btf.c

+12 −14
Original line number Diff line number Diff line
@@ -2575,7 +2575,7 @@ static int btf_ref_type_check_meta(struct btf_verifier_env *env, 
		return -EINVAL;

	}



	if (btf_type_kflag(t)) {

	if (btf_type_kflag(t) && !btf_type_is_type_tag(t)) {

		btf_verifier_log_type(env, t, "Invalid btf_info kind_flag");

		return -EINVAL;

	}
@@ -3332,6 +3332,8 @@ static int btf_find_kptr(const struct btf *btf, const struct btf_type *t, 
			 u32 off, int sz, struct btf_field_info *info, u32 field_mask)

{

	enum btf_field_type type;

	const char *tag_value;

	bool is_type_tag;

	u32 res_id;



	/* Permit modifiers on the pointer itself */
@@ -3341,19 +3343,20 @@ static int btf_find_kptr(const struct btf *btf, const struct btf_type *t, 
	if (!btf_type_is_ptr(t))

		return BTF_FIELD_IGNORE;

	t = btf_type_by_id(btf, t->type);



	if (!btf_type_is_type_tag(t))

	is_type_tag = btf_type_is_type_tag(t) && !btf_type_kflag(t);

	if (!is_type_tag)

		return BTF_FIELD_IGNORE;

	/* Reject extra tags */

	if (btf_type_is_type_tag(btf_type_by_id(btf, t->type)))

		return -EINVAL;

	if (!strcmp("kptr_untrusted", __btf_name_by_offset(btf, t->name_off)))

	tag_value = __btf_name_by_offset(btf, t->name_off);

	if (!strcmp("kptr_untrusted", tag_value))

		type = BPF_KPTR_UNREF;

	else if (!strcmp("kptr", __btf_name_by_offset(btf, t->name_off)))

	else if (!strcmp("kptr", tag_value))

		type = BPF_KPTR_REF;

	else if (!strcmp("percpu_kptr", __btf_name_by_offset(btf, t->name_off)))

	else if (!strcmp("percpu_kptr", tag_value))

		type = BPF_KPTR_PERCPU;

	else if (!strcmp("uptr", __btf_name_by_offset(btf, t->name_off)))

	else if (!strcmp("uptr", tag_value))

		type = BPF_UPTR;

	else

		return -EINVAL;
@@ -4944,11 +4947,6 @@ static s32 btf_decl_tag_check_meta(struct btf_verifier_env *env, 
		return -EINVAL;

	}



	if (btf_type_kflag(t)) {

		btf_verifier_log_type(env, t, "Invalid btf_info kind_flag");

		return -EINVAL;

	}



	component_idx = btf_type_decl_tag(t)->component_idx;

	if (component_idx < -1) {

		btf_verifier_log_type(env, t, "Invalid component_idx");
@@ -6743,7 +6741,7 @@ bool btf_ctx_access(int off, int size, enum bpf_access_type type, 
	info->btf_id = t->type;

	t = btf_type_by_id(btf, t->type);



	if (btf_type_is_type_tag(t)) {

	if (btf_type_is_type_tag(t) && !btf_type_kflag(t)) {

		tag_value = __btf_name_by_offset(btf, t->name_off);

		if (strcmp(tag_value, "user") == 0)

			info->reg_type |= MEM_USER;
@@ -7002,7 +7000,7 @@ static int btf_struct_walk(struct bpf_verifier_log *log, const struct btf *btf, 


			/* check type tag */

			t = btf_type_by_id(btf, mtype->type);

			if (btf_type_is_type_tag(t)) {

			if (btf_type_is_type_tag(t) && !btf_type_kflag(t)) {

				tag_value = __btf_name_by_offset(btf, t->name_off);

				/* check __user tag */

				if (strcmp(tag_value, "user") == 0)

tools/testing/selftests/bpf/prog_tests/btf.c

+1 −3
Original line number Diff line number Diff line
@@ -3866,7 +3866,7 @@ static struct btf_raw_test raw_tests[] = { 
	.err_str = "vlen != 0",

},

{

	.descr = "decl_tag test #8, invalid kflag",

	.descr = "decl_tag test #8, tag with kflag",

	.raw_types = {

		BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4),	/* [1] */

		BTF_VAR_ENC(NAME_TBD, 1, 0),			/* [2] */
@@ -3881,8 +3881,6 @@ static struct btf_raw_test raw_tests[] = { 
	.key_type_id = 1,

	.value_type_id = 1,

	.max_entries = 1,

	.btf_load_err = true,

	.err_str = "Invalid btf_info kind_flag",

},

{

	.descr = "decl_tag test #9, var, invalid component_idx",