Skip to content

Commit

Permalink
bpf: Refactor check_ctx_access()
Browse files Browse the repository at this point in the history 
Reduce the variable passing madness surrounding check_ctx_access().
Currently, check_mem_access() passes many pointers to local variables to
check_ctx_access(). They are used to initialize "struct
bpf_insn_access_aux info" in check_ctx_access() and then passed to
is_valid_access(). Then, check_ctx_access() takes the data our from
info and write them back the pointers to pass them back. This can be
simpilified by moving info up to check_mem_access().

No functional change.

Signed-off-by: Amery Hung <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Alexei Starovoitov <[email protected]>
  • Loading branch information
@ameryhung
ameryhung authored and Alexei Starovoitov committed Feb 23, 2025
1 parent 63817c7 commit 201b62c
Showing 1 changed file with 20 additions and 36 deletions.
56 changes: 20 additions & 36 deletions kernel/bpf/verifier.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -6051,42 +6051,26 @@ static int check_packet_access(struct bpf_verifier_env *env, u32 regno, int off,

/* check access to 'struct bpf_context' fields. Supports fixed offsets only */
static int check_ctx_access(struct bpf_verifier_env *env, int insn_idx, int off, int size,
enum bpf_access_type t, enum bpf_reg_type *reg_type,
struct btf **btf, u32 *btf_id, bool *is_retval, bool is_ldsx,
u32 *ref_obj_id)
enum bpf_access_type t, struct bpf_insn_access_aux *info)
{
struct bpf_insn_access_aux info = {
.reg_type = *reg_type,
.log = &env->log,
.is_retval = false,
.is_ldsx = is_ldsx,
};

if (env->ops->is_valid_access &&
env->ops->is_valid_access(off, size, t, env->prog, &info)) {
env->ops->is_valid_access(off, size, t, env->prog, info)) {
/* A non zero info.ctx_field_size indicates that this field is a
* candidate for later verifier transformation to load the whole
* field and then apply a mask when accessed with a narrower
* access than actual ctx access size. A zero info.ctx_field_size
* will only allow for whole field access and rejects any other
* type of narrower access.
*/
*reg_type = info.reg_type;
*is_retval = info.is_retval;

if (base_type(*reg_type) == PTR_TO_BTF_ID) {
if (info.ref_obj_id &&
!find_reference_state(env->cur_state, info.ref_obj_id)) {
if (base_type(info->reg_type) == PTR_TO_BTF_ID) {
if (info->ref_obj_id &&
!find_reference_state(env->cur_state, info->ref_obj_id)) {
verbose(env, "invalid bpf_context access off=%d. Reference may already be released\n",
off);
return -EACCES;
}

*btf = info.btf;
*btf_id = info.btf_id;
*ref_obj_id = info.ref_obj_id;
} else {
env->insn_aux_data[insn_idx].ctx_field_size = info.ctx_field_size;
env->insn_aux_data[insn_idx].ctx_field_size = info->ctx_field_size;
}
/* remember the offset of last byte accessed in ctx */
if (env->prog->aux->max_ctx_offset < off + size)
Expand Down Expand Up @@ -7443,11 +7427,12 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
if (!err && value_regno >= 0 && (t == BPF_READ || rdonly_mem))
mark_reg_unknown(env, regs, value_regno);
} else if (reg->type == PTR_TO_CTX) {
bool is_retval = false;
struct bpf_retval_range range;
enum bpf_reg_type reg_type = SCALAR_VALUE;
struct btf *btf = NULL;
u32 btf_id = 0, ref_obj_id = 0;
struct bpf_insn_access_aux info = {
.reg_type = SCALAR_VALUE,
.is_ldsx = is_ldsx,
.log = &env->log,
};

if (t == BPF_WRITE && value_regno >= 0 &&
is_pointer_value(env, value_regno)) {
Expand All @@ -7459,17 +7444,16 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
if (err < 0)
return err;

err = check_ctx_access(env, insn_idx, off, size, t, &reg_type, &btf,
&btf_id, &is_retval, is_ldsx, &ref_obj_id);
err = check_ctx_access(env, insn_idx, off, size, t, &info);
if (err)
verbose_linfo(env, insn_idx, "; ");
if (!err && t == BPF_READ && value_regno >= 0) {
/* ctx access returns either a scalar, or a
* PTR_TO_PACKET[_META,_END]. In the latter
* case, we know the offset is zero.
*/
if (reg_type == SCALAR_VALUE) {
if (is_retval && get_func_retval_range(env->prog, &range)) {
if (info.reg_type == SCALAR_VALUE) {
if (info.is_retval && get_func_retval_range(env->prog, &range)) {
err = __mark_reg_s32_range(env, regs, value_regno,
range.minval, range.maxval);
if (err)
Expand All @@ -7480,21 +7464,21 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn
} else {
mark_reg_known_zero(env, regs,
value_regno);
if (type_may_be_null(reg_type))
if (type_may_be_null(info.reg_type))
regs[value_regno].id = ++env->id_gen;
/* A load of ctx field could have different
* actual load size with the one encoded in the
* insn. When the dst is PTR, it is for sure not
* a sub-register.
*/
regs[value_regno].subreg_def = DEF_NOT_SUBREG;
if (base_type(reg_type) == PTR_TO_BTF_ID) {
regs[value_regno].btf = btf;
regs[value_regno].btf_id = btf_id;
regs[value_regno].ref_obj_id = ref_obj_id;
if (base_type(info.reg_type) == PTR_TO_BTF_ID) {
regs[value_regno].btf = info.btf;
regs[value_regno].btf_id = info.btf_id;
regs[value_regno].ref_obj_id = info.ref_obj_id;
}
}
regs[value_regno].type = reg_type;
regs[value_regno].type = info.reg_type;
}

} else if (reg->type == PTR_TO_STACK) {
Expand Down

0 comments on commit 201b62c

Please sign in to comment.