diff mbox series

[bpf-next,v2,08/11] bpf: set meta->raw_mode for pointers close to use

Message ID 20200909171155.256601-9-lmb@cloudflare.com
State Changes Requested
Delegated to: BPF Maintainers
Headers show
Series Make check_func_arg type checks table driven | expand

Commit Message

Lorenz Bauer Sept. 9, 2020, 5:11 p.m. UTC 
If we encounter a pointer to memory, we set meta->raw_mode depending
on the type of memory we point at. What isn't obvious is that this
information is only used when the next memory size argument is
encountered.

Move the assignment closer to where it's used, and add a comment that
explains what is going on.

Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
---
 kernel/bpf/verifier.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

Comments

Martin KaFai Lau Sept. 9, 2020, 9:04 p.m. UTC | #1 
On Wed, Sep 09, 2020 at 06:11:52PM +0100, Lorenz Bauer wrote:
> If we encounter a pointer to memory, we set meta->raw_mode depending
> on the type of memory we point at. What isn't obvious is that this
> information is only used when the next memory size argument is
> encountered.
> 
> Move the assignment closer to where it's used, and add a comment that
> explains what is going on.
Acked-by: Martin KaFai Lau <kafai@fb.com>
diff mbox series

Patch

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 41643e179e14..e0ab3b8c489d 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -4020,7 +4020,6 @@  static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
 			 type != PTR_TO_RDWR_BUF &&
 			 type != expected_type)
 			goto err_type;
-		meta->raw_mode = arg_type == ARG_PTR_TO_UNINIT_MEM;
 	} else if (arg_type_is_alloc_mem_ptr(arg_type)) {
 		expected_type = PTR_TO_MEM;
 		if (register_is_null(reg) &&
@@ -4109,6 +4108,11 @@  static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
 		err = check_helper_mem_access(env, regno,
 					      meta->map_ptr->value_size, false,
 					      meta);
+	} else if (arg_type_is_mem_ptr(arg_type)) {
+		/* The access to this pointer is only checked when we hit the
+		 * next is_mem_size argument below.
+		 */
+		meta->raw_mode = (arg_type == ARG_PTR_TO_UNINIT_MEM);
 	} else if (arg_type_is_mem_size(arg_type)) {
 		bool zero_size_allowed = (arg_type == ARG_CONST_SIZE_OR_ZERO);