Commit 8aeaed21 authored by Philo Lu's avatar Philo Lu Committed by Martin KaFai Lau
Browse files

bpf: Support __nullable argument suffix for tp_btf 



Pointers passed to tp_btf were trusted to be valid, but some tracepoints
do take NULL pointer as input, such as trace_tcp_send_reset(). Then the
invalid memory access cannot be detected by verifier.

This patch fix it by add a suffix "__nullable" to the unreliable
argument. The suffix is shown in btf, and PTR_MAYBE_NULL will be added
to nullable arguments. Then users must check the pointer before use it.

A problem here is that we use "btf_trace_##call" to search func_proto.
As it is a typedef, argument names as well as the suffix are not
recorded. To solve this, I use bpf_raw_event_map to find
"__bpf_trace##template" from "btf_trace_##call", and then we can see the
suffix.

Suggested-by: default avatarAlexei Starovoitov <ast@kernel.org>
Signed-off-by: default avatarPhilo Lu <lulie@linux.alibaba.com>
Link: https://lore.kernel.org/r/20240911033719.91468-2-lulie@linux.alibaba.com


Signed-off-by: default avatarMartin KaFai Lau <martin.lau@kernel.org>
parent 23dc9867

kernel/bpf/btf.c

+3 −0
Original line number Diff line number Diff line
@@ -6523,6 +6523,9 @@ bool btf_ctx_access(int off, int size, enum bpf_access_type type, 
	if (prog_args_trusted(prog))

		info->reg_type |= PTR_TRUSTED;



	if (btf_param_match_suffix(btf, &args[arg], "__nullable"))

		info->reg_type |= PTR_MAYBE_NULL;



	if (tgt_prog) {

		enum bpf_prog_type tgt_type;

kernel/bpf/verifier.c

+32 −4
Original line number Diff line number Diff line
@@ -28,6 +28,8 @@ 
#include <linux/cpumask.h>

#include <linux/bpf_mem_alloc.h>

#include <net/xdp.h>

#include <linux/trace_events.h>

#include <linux/kallsyms.h>









#include "disasm.h"
















@@ -21154,11 +21156,13 @@ int bpf_check_attach_target(struct bpf_verifier_log *log,







{









	bool prog_extension = prog->type == BPF_PROG_TYPE_EXT;









	bool prog_tracing = prog->type == BPF_PROG_TYPE_TRACING;









	char trace_symbol[KSYM_SYMBOL_LEN];









	const char prefix[] = "btf_trace_";









	struct bpf_raw_event_map *btp;









	int ret = 0, subprog = -1, i;









	const struct btf_type *t;









	bool conservative = true;









	const char *tname;









	const char *tname, *fname;









	struct btf *btf;









	long addr = 0;









	struct module *mod = NULL;








@@ -21289,10 +21293,34 @@ int bpf_check_attach_target(struct bpf_verifier_log *log,







			return -EINVAL;









		}









		tname += sizeof(prefix) - 1;

















		/* The func_proto of "btf_trace_##tname" is generated from typedef without argument









		 * names. Thus using bpf_raw_event_map to get argument names.









		 */









		btp = bpf_get_raw_tracepoint(tname);









		if (!btp)









			return -EINVAL;









		fname = kallsyms_lookup((unsigned long)btp->bpf_func, NULL, NULL, NULL,









					trace_symbol);









		bpf_put_raw_tracepoint(btp);

















		if (fname)









			ret = btf_find_by_name_kind(btf, fname, BTF_KIND_FUNC);

















		if (!fname || ret < 0) {









			bpf_log(log, "Cannot find btf of tracepoint template, fall back to %s%s.\n",









				prefix, tname);









			t = btf_type_by_id(btf, t->type);









			if (!btf_type_is_ptr(t))









				/* should never happen in valid vmlinux build */









				return -EINVAL;









		} else {









			t = btf_type_by_id(btf, ret);









			if (!btf_type_is_func(t))









				/* should never happen in valid vmlinux build */









				return -EINVAL;









		}

















		t = btf_type_by_id(btf, t->type);









		if (!btf_type_is_func_proto(t))









			/* should never happen in valid vmlinux build */