lkml.org 
[lkml]   [2024]   [Apr]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH bpf-next v2 08/16] bpf: add support for KF_ARG_PTR_TO_WORKQUEUE
    Introduce support for KF_ARG_PTR_TO_WORKQUEUE. The kfuncs will use bpf_wq
    as argument and that will be recognized as workqueue argument by verifier.
    bpf_wq_kern casting can happen inside kfunc, but using bpf_wq in
    argument makes life easier for users who work with non-kern type in BPF
    progs.

    Duplicate process_timer_func into process_wq_func.
    meta argument is only needed to ensure bpf_wq_init's workqueue and map
    arguments are coming from the same map (map_uid logic is necessary for
    correct inner-map handling), so also amend check_kfunc_args() to
    match what helpers functions check is doing.

    Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>

    ---

    changes in v2:
    - clean up already done checks in process_wq_func()
    - adjust comment
    - gate check_kfunc_args check with map->record->wq_off.
    ---
    kernel/bpf/verifier.c | 65 +++++++++++++++++++++++++++++++++++++++++++++++++++
    1 file changed, 65 insertions(+)

    diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
    index b95fd63864f1..5ff7b52d9032 100644
    --- a/kernel/bpf/verifier.c
    +++ b/kernel/bpf/verifier.c
    @@ -332,6 +332,10 @@ struct bpf_kfunc_call_arg_meta {
    u8 spi;
    u8 frameno;
    } iter;
    + struct {
    + struct bpf_map *ptr;
    + int uid;
    + } map;
    u64 mem_size;
    };

    @@ -7598,6 +7602,23 @@ static int process_timer_func(struct bpf_verifier_env *env, int regno,
    return 0;
    }

    +static int process_wq_func(struct bpf_verifier_env *env, int regno,
    + struct bpf_kfunc_call_arg_meta *meta)
    +{
    + struct bpf_reg_state *regs = cur_regs(env), *reg = &regs[regno];
    + struct bpf_map *map = reg->map_ptr;
    + u64 val = reg->var_off.value;
    +
    + if (map->record->wq_off != val + reg->off) {
    + verbose(env, "off %lld doesn't point to 'struct bpf_wq' that is at %d\n",
    + val + reg->off, map->record->wq_off);
    + return -EINVAL;
    + }
    + meta->map.uid = reg->map_uid;
    + meta->map.ptr = map;
    + return 0;
    +}
    +
    static int process_kptr_func(struct bpf_verifier_env *env, int regno,
    struct bpf_call_arg_meta *meta)
    {
    @@ -10843,6 +10864,7 @@ enum {
    KF_ARG_LIST_NODE_ID,
    KF_ARG_RB_ROOT_ID,
    KF_ARG_RB_NODE_ID,
    + KF_ARG_WORKQUEUE_ID,
    };

    BTF_ID_LIST(kf_arg_btf_ids)
    @@ -10851,6 +10873,7 @@ BTF_ID(struct, bpf_list_head)
    BTF_ID(struct, bpf_list_node)
    BTF_ID(struct, bpf_rb_root)
    BTF_ID(struct, bpf_rb_node)
    +BTF_ID(struct, bpf_wq)

    static bool __is_kfunc_ptr_arg_type(const struct btf *btf,
    const struct btf_param *arg, int type)
    @@ -10894,6 +10917,11 @@ static bool is_kfunc_arg_rbtree_node(const struct btf *btf, const struct btf_par
    return __is_kfunc_ptr_arg_type(btf, arg, KF_ARG_RB_NODE_ID);
    }

    +static bool is_kfunc_arg_wq(const struct btf *btf, const struct btf_param *arg)
    +{
    + return __is_kfunc_ptr_arg_type(btf, arg, KF_ARG_WORKQUEUE_ID);
    +}
    +
    static bool is_kfunc_arg_callback(struct bpf_verifier_env *env, const struct btf *btf,
    const struct btf_param *arg)
    {
    @@ -10963,6 +10991,7 @@ enum kfunc_ptr_arg_type {
    KF_ARG_PTR_TO_NULL,
    KF_ARG_PTR_TO_CONST_STR,
    KF_ARG_PTR_TO_MAP,
    + KF_ARG_PTR_TO_WORKQUEUE,
    };

    enum special_kfunc_type {
    @@ -11119,6 +11148,9 @@ get_kfunc_ptr_arg_type(struct bpf_verifier_env *env,
    if (is_kfunc_arg_map(meta->btf, &args[argno]))
    return KF_ARG_PTR_TO_MAP;

    + if (is_kfunc_arg_wq(meta->btf, &args[argno]))
    + return KF_ARG_PTR_TO_WORKQUEUE;
    +
    if ((base_type(reg->type) == PTR_TO_BTF_ID || reg2btf_ids[base_type(reg->type)])) {
    if (!btf_type_is_struct(ref_t)) {
    verbose(env, "kernel function %s args#%d pointer type %s %s is not supported\n",
    @@ -11724,6 +11756,29 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_
    verbose(env, "pointer in R%d isn't map pointer\n", regno);
    return -EINVAL;
    }
    + if (meta->map.ptr && reg->map_ptr->record->wq_off >= 0) {
    + /* Use map_uid (which is unique id of inner map) to reject:
    + * inner_map1 = bpf_map_lookup_elem(outer_map, key1)
    + * inner_map2 = bpf_map_lookup_elem(outer_map, key2)
    + * if (inner_map1 && inner_map2) {
    + * wq = bpf_map_lookup_elem(inner_map1);
    + * if (wq)
    + * // mismatch would have been allowed
    + * bpf_wq_init(wq, inner_map2);
    + * }
    + *
    + * Comparing map_ptr is enough to distinguish normal and outer maps.
    + */
    + if (meta->map.ptr != reg->map_ptr ||
    + meta->map.uid != reg->map_uid) {
    + verbose(env,
    + "workqueue pointer in R1 map_uid=%d doesn't match map pointer in R2 map_uid=%d\n",
    + meta->map.uid, reg->map_uid);
    + return -EINVAL;
    + }
    + }
    + meta->map.ptr = reg->map_ptr;
    + meta->map.uid = reg->map_uid;
    fallthrough;
    case KF_ARG_PTR_TO_ALLOC_BTF_ID:
    case KF_ARG_PTR_TO_BTF_ID:
    @@ -11757,6 +11812,7 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_
    case KF_ARG_PTR_TO_CALLBACK:
    case KF_ARG_PTR_TO_REFCOUNTED_KPTR:
    case KF_ARG_PTR_TO_CONST_STR:
    + case KF_ARG_PTR_TO_WORKQUEUE:
    /* Trusted by default */
    break;
    default:
    @@ -12043,6 +12099,15 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_
    if (ret)
    return ret;
    break;
    + case KF_ARG_PTR_TO_WORKQUEUE:
    + if (reg->type != PTR_TO_MAP_VALUE) {
    + verbose(env, "arg#%d doesn't point to a map value\n", i);
    + return -EINVAL;
    + }
    + ret = process_wq_func(env, regno, meta);
    + if (ret < 0)
    + return ret;
    + break;
    }
    }

    --
    2.44.0


    \
     
     \ /
      Last update: 2024-05-27 16:47    [W:4.909 / U:0.024 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site