Commit d940c9b9 authored by Benjamin Tissoires's avatar Benjamin Tissoires Committed by Alexei Starovoitov
Browse files

bpf: add support for KF_ARG_PTR_TO_WORKQUEUE 



Introduce support for KF_ARG_PTR_TO_WORKQUEUE. The kfuncs will use bpf_wq
as argument and that will be recognized as workqueue argument by verifier.
bpf_wq_kern casting can happen inside kfunc, but using bpf_wq in
argument makes life easier for users who work with non-kern type in BPF
progs.

Duplicate process_timer_func into process_wq_func.
meta argument is only needed to ensure bpf_wq_init's workqueue and map
arguments are coming from the same map (map_uid logic is necessary for
correct inner-map handling), so also amend check_kfunc_args() to
match what helpers functions check is doing.

Signed-off-by: default avatarBenjamin Tissoires <bentiss@kernel.org>
Link: https://lore.kernel.org/r/20240420-bpf_wq-v2-8-6c986a5a741f@kernel.org


Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent ad2c03e6

kernel/bpf/verifier.c

+65 −0
Original line number Diff line number Diff line
@@ -332,6 +332,10 @@ struct bpf_kfunc_call_arg_meta { 
		u8 spi;

		u8 frameno;

	} iter;

	struct {

		struct bpf_map *ptr;

		int uid;

	} map;

	u64 mem_size;

};








@@ -7598,6 +7602,23 @@ static int process_timer_func(struct bpf_verifier_env *env, int regno,







	return 0;









}

















static int process_wq_func(struct bpf_verifier_env *env, int regno,









			   struct bpf_kfunc_call_arg_meta *meta)









{









	struct bpf_reg_state *regs = cur_regs(env), *reg = &regs[regno];









	struct bpf_map *map = reg->map_ptr;









	u64 val = reg->var_off.value;

















	if (map->record->wq_off != val + reg->off) {









		verbose(env, "off %lld doesn't point to 'struct bpf_wq' that is at %d\n",









			val + reg->off, map->record->wq_off);









		return -EINVAL;









	}









	meta->map.uid = reg->map_uid;









	meta->map.ptr = map;









	return 0;









}

















static int process_kptr_func(struct bpf_verifier_env *env, int regno,









			     struct bpf_call_arg_meta *meta)









{








@@ -10843,6 +10864,7 @@ enum {







	KF_ARG_LIST_NODE_ID,









	KF_ARG_RB_ROOT_ID,









	KF_ARG_RB_NODE_ID,









	KF_ARG_WORKQUEUE_ID,









};

















BTF_ID_LIST(kf_arg_btf_ids)








@@ -10851,6 +10873,7 @@ BTF_ID(struct, bpf_list_head)







BTF_ID(struct, bpf_list_node)









BTF_ID(struct, bpf_rb_root)









BTF_ID(struct, bpf_rb_node)









BTF_ID(struct, bpf_wq)

















static bool __is_kfunc_ptr_arg_type(const struct btf *btf,









				    const struct btf_param *arg, int type)








@@ -10894,6 +10917,11 @@ static bool is_kfunc_arg_rbtree_node(const struct btf *btf, const struct btf_par







	return __is_kfunc_ptr_arg_type(btf, arg, KF_ARG_RB_NODE_ID);









}

















static bool is_kfunc_arg_wq(const struct btf *btf, const struct btf_param *arg)









{









	return __is_kfunc_ptr_arg_type(btf, arg, KF_ARG_WORKQUEUE_ID);









}

















static bool is_kfunc_arg_callback(struct bpf_verifier_env *env, const struct btf *btf,









				  const struct btf_param *arg)









{








@@ -10963,6 +10991,7 @@ enum kfunc_ptr_arg_type {







	KF_ARG_PTR_TO_NULL,









	KF_ARG_PTR_TO_CONST_STR,









	KF_ARG_PTR_TO_MAP,









	KF_ARG_PTR_TO_WORKQUEUE,









};

















enum special_kfunc_type {








@@ -11119,6 +11148,9 @@ get_kfunc_ptr_arg_type(struct bpf_verifier_env *env,







	if (is_kfunc_arg_map(meta->btf, &args[argno]))









		return KF_ARG_PTR_TO_MAP;

















	if (is_kfunc_arg_wq(meta->btf, &args[argno]))









		return KF_ARG_PTR_TO_WORKQUEUE;

















	if ((base_type(reg->type) == PTR_TO_BTF_ID || reg2btf_ids[base_type(reg->type)])) {









		if (!btf_type_is_struct(ref_t)) {









			verbose(env, "kernel function %s args#%d pointer type %s %s is not supported\n",








@@ -11724,6 +11756,29 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_







				verbose(env, "pointer in R%d isn't map pointer\n", regno);









				return -EINVAL;









			}









			if (meta->map.ptr && reg->map_ptr->record->wq_off >= 0) {









				/* Use map_uid (which is unique id of inner map) to reject:









				 * inner_map1 = bpf_map_lookup_elem(outer_map, key1)









				 * inner_map2 = bpf_map_lookup_elem(outer_map, key2)









				 * if (inner_map1 && inner_map2) {









				 *     wq = bpf_map_lookup_elem(inner_map1);









				 *     if (wq)









				 *         // mismatch would have been allowed









				 *         bpf_wq_init(wq, inner_map2);









				 * }









				 *









				 * Comparing map_ptr is enough to distinguish normal and outer maps.









				 */









				if (meta->map.ptr != reg->map_ptr ||









				    meta->map.uid != reg->map_uid) {









					verbose(env,









						"workqueue pointer in R1 map_uid=%d doesn't match map pointer in R2 map_uid=%d\n",









						meta->map.uid, reg->map_uid);









					return -EINVAL;









				}









			}









			meta->map.ptr = reg->map_ptr;









			meta->map.uid = reg->map_uid;









			fallthrough;









		case KF_ARG_PTR_TO_ALLOC_BTF_ID:









		case KF_ARG_PTR_TO_BTF_ID:








@@ -11757,6 +11812,7 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_







		case KF_ARG_PTR_TO_CALLBACK:









		case KF_ARG_PTR_TO_REFCOUNTED_KPTR:









		case KF_ARG_PTR_TO_CONST_STR:









		case KF_ARG_PTR_TO_WORKQUEUE:









			/* Trusted by default */









			break;









		default:








@@ -12043,6 +12099,15 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_







			if (ret)









				return ret;









			break;









		case KF_ARG_PTR_TO_WORKQUEUE:









			if (reg->type != PTR_TO_MAP_VALUE) {









				verbose(env, "arg#%d doesn't point to a map value\n", i);









				return -EINVAL;









			}









			ret = process_wq_func(env, regno, meta);









			if (ret < 0)









				return ret;









			break;









		}









	}