Commit b183c012 authored May 05, 2025 by Martin KaFai Lau Committed by Alexei Starovoitov May 06, 2025

bpf: Check KF_bpf_rbtree_add_impl for the "case KF_ARG_PTR_TO_RB_NODE"



In a later patch, two new kfuncs will take the bpf_rb_node pointer arg.

struct bpf_rb_node *bpf_rbtree_left(struct bpf_rb_root *root,
				    struct bpf_rb_node *node);
struct bpf_rb_node *bpf_rbtree_right(struct bpf_rb_root *root,
				     struct bpf_rb_node *node);

In the check_kfunc_call, there is a "case KF_ARG_PTR_TO_RB_NODE"
to check if the reg->type should be an allocated pointer or should be
a non_owning_ref.

The later patch will need to ensure that the bpf_rb_node pointer passing
to the new bpf_rbtree_{left,right} must be a non_owning_ref. This
should be the same requirement as the existing bpf_rbtree_remove.

This patch swaps the current "if else" statement. Instead of checking
the bpf_rbtree_remove, it checks the bpf_rbtree_add. Then the new
bpf_rbtree_{left,right} will fall into the "else" case to make
the later patch simpler. bpf_rbtree_add should be the only
one that needs an allocated pointer.

This should be a no-op change considering there are only two kfunc(s)
taking bpf_rb_node pointer arg, rbtree_add and rbtree_remove.

Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Link: https://lore.kernel.org/r/20250506015857.817950-2-martin.lau@linux.dev


Signed-off-by: Alexei Starovoitov <ast@kernel.org>

parent 62e23f18

kernel/bpf/verifier.c

+9 −9

Original line number	Diff line number	Diff line
		@@ -13200,22 +13200,22 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_
		return ret;
		break;
		case KF_ARG_PTR_TO_RB_NODE:
		if (meta->func_id == special_kfunc_list[KF_bpf_rbtree_remove]) {
		if (!type_is_non_owning_ref(reg->type) \|\| reg->ref_obj_id) {
		verbose(env, "rbtree_remove node input must be non-owning ref\n");
		if (meta->func_id == special_kfunc_list[KF_bpf_rbtree_add_impl]) {
		if (reg->type != (PTR_TO_BTF_ID \| MEM_ALLOC)) {
		verbose(env, "arg#%d expected pointer to allocated object\n", i);
		return -EINVAL;
		}
		if (in_rbtree_lock_required_cb(env)) {
		verbose(env, "rbtree_remove not allowed in rbtree cb\n");
		if (!reg->ref_obj_id) {
		verbose(env, "allocated object must be referenced\n");
		return -EINVAL;
		}
		} else {
		if (reg->type != (PTR_TO_BTF_ID \| MEM_ALLOC)) {
		verbose(env, "arg#%d expected pointer to allocated object\n", i);
		if (!type_is_non_owning_ref(reg->type) \|\| reg->ref_obj_id) {
		verbose(env, "rbtree_remove node input must be non-owning ref\n");
		return -EINVAL;
		}
		if (!reg->ref_obj_id) {
		verbose(env, "allocated object must be referenced\n");
		if (in_rbtree_lock_required_cb(env)) {
		verbose(env, "rbtree_remove not allowed in rbtree cb\n");
		return -EINVAL;
		}
		}