Commit 98c4fd29 authored by Mykyta Yatsenko's avatar Mykyta Yatsenko Committed by Alexei Starovoitov
Browse files

bpf: Introduce struct bpf_map_desc in verifier 



Introduce struct bpf_map_desc to hold bpf_map pointer and map uid. Use
this struct in both bpf_call_arg_meta and bpf_kfunc_call_arg_meta
instead of having different representations:
 - bpf_call_arg_meta had separate map_ptr and map_uid fields
 - bpf_kfunc_call_arg_meta had an anonymous inline struct

This unifies the map fields layout across both metadata structures,
making the code more consistent and preparing for further refactoring of
map field pointer validation.

Acked-by: default avatarEduard Zingerman <eddyz87@gmail.com>
Signed-off-by: default avatarMykyta Yatsenko <yatsenko@meta.com>
Link: https://lore.kernel.org/r/20260130-verif_special_fields-v2-1-2c59e637da7d@meta.com


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent c7fbf8d9

kernel/bpf/verifier.c

+40 −39
Original line number Diff line number Diff line
@@ -272,8 +272,13 @@ static bool bpf_pseudo_kfunc_call(const struct bpf_insn *insn) 
	       insn->src_reg == BPF_PSEUDO_KFUNC_CALL;

}









struct bpf_map_desc {









	struct bpf_map *ptr;









	int uid;









};

















struct bpf_call_arg_meta {









	struct bpf_map *map_ptr;









	struct bpf_map_desc map;









	bool raw_mode;









	bool pkt_access;









	u8 release_regno;








@@ -283,7 +288,6 @@ struct bpf_call_arg_meta {







	u64 msize_max_value;









	int ref_obj_id;









	int dynptr_id;









	int map_uid;









	int func_id;









	struct btf *btf;









	u32 btf_id;








@@ -351,10 +355,7 @@ struct bpf_kfunc_call_arg_meta {







		u8 spi;









		u8 frameno;









	} iter;









	struct {









		struct bpf_map *ptr;









		int uid;









	} map;









	struct bpf_map_desc map;









	u64 mem_size;









};
















@@ -8666,7 +8667,7 @@ static int process_timer_func(struct bpf_verifier_env *env, int regno,







	if (err)









		return err;

















	if (meta->map_ptr) {









	if (meta->map.ptr) {









		verifier_bug(env, "Two map pointers in a timer helper");









		return -EFAULT;









	}








@@ -8674,8 +8675,8 @@ static int process_timer_func(struct bpf_verifier_env *env, int regno,







		verbose(env, "bpf_timer cannot be used for PREEMPT_RT.\n");









		return -EOPNOTSUPP;









	}









	meta->map_uid = reg->map_uid;









	meta->map_ptr = map;









	meta->map.uid = reg->map_uid;









	meta->map.ptr = map;









	return 0;









}
















@@ -8739,7 +8740,7 @@ static int process_kptr_func(struct bpf_verifier_env *env, int regno,







			return -EINVAL;









		}









		rec = map_ptr->record;









		meta->map_ptr = map_ptr;









		meta->map.ptr = map_ptr;









	}

















	if (!tnum_is_const(reg->var_off)) {








@@ -9246,13 +9247,13 @@ static int resolve_map_arg_type(struct bpf_verifier_env *env,







				 const struct bpf_call_arg_meta *meta,









				 enum bpf_arg_type *arg_type)









{









	if (!meta->map_ptr) {









	if (!meta->map.ptr) {









		/* kernel subsystem misconfigured verifier */









		verifier_bug(env, "invalid map_ptr to access map->type");









		return -EFAULT;









	}

















	switch (meta->map_ptr->map_type) {









	switch (meta->map.ptr->map_type) {









	case BPF_MAP_TYPE_SOCKMAP:









	case BPF_MAP_TYPE_SOCKHASH:









		if (*arg_type == ARG_PTR_TO_MAP_VALUE) {








@@ -9906,7 +9907,7 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,







	switch (base_type(arg_type)) {









	case ARG_CONST_MAP_PTR:









		/* bpf_map_xxx(map_ptr) call: remember that map_ptr */









		if (meta->map_ptr) {









		if (meta->map.ptr) {









			/* Use map_uid (which is unique id of inner map) to reject:









			 * inner_map1 = bpf_map_lookup_elem(outer_map, key1)









			 * inner_map2 = bpf_map_lookup_elem(outer_map, key2)








@@ -9919,23 +9920,23 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,







			 *









			 * Comparing map_ptr is enough to distinguish normal and outer maps.









			 */









			if (meta->map_ptr != reg->map_ptr ||









			    meta->map_uid != reg->map_uid) {









			if (meta->map.ptr != reg->map_ptr ||









			    meta->map.uid != reg->map_uid) {









				verbose(env,









					"timer pointer in R1 map_uid=%d doesn't match map pointer in R2 map_uid=%d\n",









					meta->map_uid, reg->map_uid);









					meta->map.uid, reg->map_uid);









				return -EINVAL;









			}









		}









		meta->map_ptr = reg->map_ptr;









		meta->map_uid = reg->map_uid;









		meta->map.ptr = reg->map_ptr;









		meta->map.uid = reg->map_uid;









		break;









	case ARG_PTR_TO_MAP_KEY:









		/* bpf_map_xxx(..., map_ptr, ..., key) call:









		 * check that [key, key + map->key_size) are within









		 * stack limits and initialized









		 */









		if (!meta->map_ptr) {









		if (!meta->map.ptr) {









			/* in function declaration map_ptr must come before









			 * map_key, so that it's verified and known before









			 * we have to check map_key here. Otherwise it means








@@ -9944,11 +9945,11 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,







			verifier_bug(env, "invalid map_ptr to access map->key");









			return -EFAULT;









		}









		key_size = meta->map_ptr->key_size;









		key_size = meta->map.ptr->key_size;









		err = check_helper_mem_access(env, regno, key_size, BPF_READ, false, NULL);









		if (err)









			return err;









		if (can_elide_value_nullness(meta->map_ptr->map_type)) {









		if (can_elide_value_nullness(meta->map.ptr->map_type)) {









			err = get_constant_map_key(env, reg, key_size, &meta->const_map_key);









			if (err < 0) {









				meta->const_map_key = -1;








@@ -9966,13 +9967,13 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,







		/* bpf_map_xxx(..., map_ptr, ..., value) call:









		 * check [value, value + map->value_size) validity









		 */









		if (!meta->map_ptr) {









		if (!meta->map.ptr) {









			/* kernel subsystem misconfigured verifier */









			verifier_bug(env, "invalid map_ptr to access map->value");









			return -EFAULT;









		}









		meta->raw_mode = arg_type & MEM_UNINIT;









		err = check_helper_mem_access(env, regno, meta->map_ptr->value_size,









		err = check_helper_mem_access(env, regno, meta->map.ptr->value_size,









					      arg_type & MEM_WRITE ? BPF_WRITE : BPF_READ,









					      false, meta);









		break;








@@ -11310,7 +11311,7 @@ record_func_map(struct bpf_verifier_env *env, struct bpf_call_arg_meta *meta,







		int func_id, int insn_idx)









{









	struct bpf_insn_aux_data *aux = &env->insn_aux_data[insn_idx];









	struct bpf_map *map = meta->map_ptr;









	struct bpf_map *map = meta->map.ptr;

















	if (func_id != BPF_FUNC_tail_call &&









	    func_id != BPF_FUNC_map_lookup_elem &&








@@ -11343,11 +11344,11 @@ record_func_map(struct bpf_verifier_env *env, struct bpf_call_arg_meta *meta,







	}

















	if (!aux->map_ptr_state.map_ptr)









		bpf_map_ptr_store(aux, meta->map_ptr,









				  !meta->map_ptr->bypass_spec_v1, false);









	else if (aux->map_ptr_state.map_ptr != meta->map_ptr)









		bpf_map_ptr_store(aux, meta->map_ptr,









				  !meta->map_ptr->bypass_spec_v1, true);









		bpf_map_ptr_store(aux, meta->map.ptr,









				  !meta->map.ptr->bypass_spec_v1, false);









	else if (aux->map_ptr_state.map_ptr != meta->map.ptr)









		bpf_map_ptr_store(aux, meta->map.ptr,









				  !meta->map.ptr->bypass_spec_v1, true);









	return 0;









}
















@@ -11357,7 +11358,7 @@ record_func_key(struct bpf_verifier_env *env, struct bpf_call_arg_meta *meta,







{









	struct bpf_insn_aux_data *aux = &env->insn_aux_data[insn_idx];









	struct bpf_reg_state *reg;









	struct bpf_map *map = meta->map_ptr;









	struct bpf_map *map = meta->map.ptr;









	u64 val, max;









	int err;
















@@ -11913,22 +11914,22 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn







		 * can check 'value_size' boundary of memory access









		 * to map element returned from bpf_map_lookup_elem()









		 */









		if (meta.map_ptr == NULL) {









		if (meta.map.ptr == NULL) {









			verifier_bug(env, "unexpected null map_ptr");









			return -EFAULT;









		}

















		if (func_id == BPF_FUNC_map_lookup_elem &&









		    can_elide_value_nullness(meta.map_ptr->map_type) &&









		    can_elide_value_nullness(meta.map.ptr->map_type) &&









		    meta.const_map_key >= 0 &&









		    meta.const_map_key < meta.map_ptr->max_entries)









		    meta.const_map_key < meta.map.ptr->max_entries)









			ret_flag &= ~PTR_MAYBE_NULL;

















		regs[BPF_REG_0].map_ptr = meta.map_ptr;









		regs[BPF_REG_0].map_uid = meta.map_uid;









		regs[BPF_REG_0].map_ptr = meta.map.ptr;









		regs[BPF_REG_0].map_uid = meta.map.uid;









		regs[BPF_REG_0].type = PTR_TO_MAP_VALUE | ret_flag;









		if (!type_may_be_null(ret_flag) &&









		    btf_record_has_field(meta.map_ptr->record, BPF_SPIN_LOCK | BPF_RES_SPIN_LOCK)) {









		    btf_record_has_field(meta.map.ptr->record, BPF_SPIN_LOCK | BPF_RES_SPIN_LOCK)) {









			regs[BPF_REG_0].id = ++env->id_gen;









		}









		break;








@@ -12031,7 +12032,7 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn







	if (type_may_be_null(regs[BPF_REG_0].type))









		regs[BPF_REG_0].id = ++env->id_gen;

















	if (helper_multiple_ref_obj_use(func_id, meta.map_ptr)) {









	if (helper_multiple_ref_obj_use(func_id, meta.map.ptr)) {









		verifier_bug(env, "func %s#%d sets ref_obj_id more than once",









			     func_id_name(func_id), func_id);









		return -EFAULT;








@@ -12043,7 +12044,7 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn







	if (is_ptr_cast_function(func_id) || is_dynptr_ref_function(func_id)) {









		/* For release_reference() */









		regs[BPF_REG_0].ref_obj_id = meta.ref_obj_id;









	} else if (is_acquire_function(func_id, meta.map_ptr)) {









	} else if (is_acquire_function(func_id, meta.map.ptr)) {









		int id = acquire_reference(env, insn_idx);

















		if (id < 0)








@@ -12058,7 +12059,7 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn







	if (err)









		return err;

















	err = check_map_func_compatibility(env, meta.map_ptr, func_id);









	err = check_map_func_compatibility(env, meta.map.ptr, func_id);









	if (err)









		return err;