Messages in this thread | ![/](/images/icornerl.gif) | | Subject | Re: [PATCH bpf-next v4 2/6] bpf/verifier: add bpf_timer as a kfunc capable type | From | Eduard Zingerman <> | Date | Mon, 18 Mar 2024 23:53:39 +0200 |
| |
On Fri, 2024-03-15 at 15:29 +0100, Benjamin Tissoires wrote: [...]
> @@ -12021,6 +12034,12 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_ > if (ret) > return ret; > break; > + case KF_ARG_PTR_TO_TIMER: > + if (reg->type != PTR_TO_MAP_VALUE) { > + verbose(env, "arg#%d doesn't point to a map value\n", i); > + return -EINVAL; > + } > + break;
I think that pointer offset has to be checked as well, otherwise the following program verifies w/o error:
--- 8< ----------------------------
#include <linux/bpf.h> #include <time.h> #include <errno.h> #include <bpf/bpf_helpers.h> #include "bpf_tcp_helpers.h"
extern int bpf_timer_set_sleepable_cb_impl(struct bpf_timer *timer, int (callback_fn)(void *map, int *key, struct bpf_timer *timer), void *aux__ign) __ksym;
#define bpf_timer_set_sleepable_cb(timer, cb) \ bpf_timer_set_sleepable_cb_impl(timer, cb, NULL)
struct elem { struct bpf_timer t; };
struct { __uint(type, BPF_MAP_TYPE_ARRAY); __uint(max_entries, 2); __type(key, int); __type(value, struct elem); } array SEC(".maps");
static int cb_sleepable(void *map, int *key, struct bpf_timer *timer) { return 0; }
SEC("fentry/bpf_fentry_test5") int BPF_PROG2(test_sleepable, int, a) { struct bpf_timer *arr_timer; int array_key = 1;
arr_timer = bpf_map_lookup_elem(&array, &array_key); if (!arr_timer) return 0; bpf_timer_init(arr_timer, &array, CLOCK_MONOTONIC); bpf_timer_set_sleepable_cb((void *)arr_timer + 1, // <-- note incorrect offset cb_sleepable); bpf_timer_start(arr_timer, 0, 0); return 0; }
char _license[] SEC("license") = "GPL";
---------------------------- >8 ---
| ![\](/images/icornerr.gif) |