Commit cb3ecf79 authored by Chuyi Zhou's avatar Chuyi Zhou Committed by Alexei Starovoitov
Browse files

bpf: Let bpf_iter_task_new accept null task ptr 



When using task_iter to iterate all threads of a specific task, we enforce
that the user must pass a valid task pointer to ensure safety. However,
when iterating all threads/process in the system, BPF verifier still
require a valid ptr instead of "nullable" pointer, even though it's
pointless, which is a kind of surprising from usability standpoint. It
would be nice if we could let that kfunc accept a explicit null pointer
when we are using BPF_TASK_ITER_ALL_{PROCS, THREADS} and a valid pointer
when using BPF_TASK_ITER_THREAD.

Given a trival kfunc:
	__bpf_kfunc void FN(struct TYPE_A *obj);

BPF Prog would reject a nullptr for obj. The error info is:
"arg#x pointer type xx xx must point to scalar, or struct with scalar"
reported by get_kfunc_ptr_arg_type(). The reg->type is SCALAR_VALUE and
the btf type of ref_t is not scalar or scalar_struct which leads to the
rejection of get_kfunc_ptr_arg_type.

This patch add "__nullable" annotation:
	__bpf_kfunc void FN(struct TYPE_A *obj__nullable);
Here __nullable indicates obj can be optional, user can pass a explicit
nullptr or a normal TYPE_A pointer. In get_kfunc_ptr_arg_type(), we will
detect whether the current arg is optional and register is null, If so,
return a new kfunc_ptr_arg_type KF_ARG_PTR_TO_NULL and skip to the next
arg in check_kfunc_args().

Signed-off-by: default avatarChuyi Zhou <zhouchuyi@bytedance.com>
Acked-by: default avatarAndrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/r/20231018061746.111364-7-zhouchuyi@bytedance.com


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent dfab99df

kernel/bpf/task_iter.c

+5 −2
Original line number Diff line number Diff line
@@ -976,7 +976,7 @@ __diag_ignore_all("-Wmissing-prototypes", 
		  "Global functions as their definitions will be in vmlinux BTF");



__bpf_kfunc int bpf_iter_task_new(struct bpf_iter_task *it,

		struct task_struct *task, unsigned int flags)

		struct task_struct *task__nullable, unsigned int flags)

{

	struct bpf_iter_task_kern *kit = (void *)it;
@@ -988,14 +988,17 @@ __bpf_kfunc int bpf_iter_task_new(struct bpf_iter_task *it, 
	switch (flags) {

	case BPF_TASK_ITER_ALL_THREADS:

	case BPF_TASK_ITER_ALL_PROCS:

		break;

	case BPF_TASK_ITER_PROC_THREADS:

		if (!task__nullable)

			return -EINVAL;

		break;

	default:

		return -EINVAL;

	}



	if (flags == BPF_TASK_ITER_PROC_THREADS)

		kit->task = task;

		kit->task = task__nullable;

	else

		kit->task = &init_task;

	kit->pos = kit->task;

kernel/bpf/verifier.c

+12 −1
Original line number Diff line number Diff line
@@ -10332,6 +10332,11 @@ static bool is_kfunc_arg_refcounted_kptr(const struct btf *btf, const struct btf 
	return __kfunc_param_match_suffix(btf, arg, "__refcounted_kptr");

}









static bool is_kfunc_arg_nullable(const struct btf *btf, const struct btf_param *arg)









{









	return __kfunc_param_match_suffix(btf, arg, "__nullable");









}

















static bool is_kfunc_arg_scalar_with_name(const struct btf *btf,









					  const struct btf_param *arg,









					  const char *name)








@@ -10474,6 +10479,7 @@ enum kfunc_ptr_arg_type {







	KF_ARG_PTR_TO_CALLBACK,









	KF_ARG_PTR_TO_RB_ROOT,









	KF_ARG_PTR_TO_RB_NODE,









	KF_ARG_PTR_TO_NULL,









};

















enum special_kfunc_type {








@@ -10630,6 +10636,8 @@ get_kfunc_ptr_arg_type(struct bpf_verifier_env *env,







	if (is_kfunc_arg_callback(env, meta->btf, &args[argno]))









		return KF_ARG_PTR_TO_CALLBACK;

















	if (is_kfunc_arg_nullable(meta->btf, &args[argno]) && register_is_null(reg))









		return KF_ARG_PTR_TO_NULL;

















	if (argno + 1 < nargs &&









	    (is_kfunc_arg_mem_size(meta->btf, &args[argno + 1], &regs[regno + 1]) ||








@@ -11180,7 +11188,8 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_







		}

















		if ((is_kfunc_trusted_args(meta) || is_kfunc_rcu(meta)) &&









		    (register_is_null(reg) || type_may_be_null(reg->type))) {









		    (register_is_null(reg) || type_may_be_null(reg->type)) &&









			!is_kfunc_arg_nullable(meta->btf, &args[i])) {









			verbose(env, "Possibly NULL pointer passed to trusted arg%d\n", i);









			return -EACCES;









		}








@@ -11205,6 +11214,8 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_







			return kf_arg_type;

















		switch (kf_arg_type) {









		case KF_ARG_PTR_TO_NULL:









			continue;









		case KF_ARG_PTR_TO_ALLOC_BTF_ID:









		case KF_ARG_PTR_TO_BTF_ID:









			if (!is_kfunc_trusted_args(meta) && !is_kfunc_rcu(meta))