| Message ID | 20230714142100.42265-2-aspsk@isovalent.com |
|---|---|
| State | New |
| Headers | show |
| Series | allow bpf_map_sum_elem_count for all program types | expand |
On Fri, Jul 14, 2023 at 10:56:00AM -0700, Alexei Starovoitov wrote: > On Fri, Jul 14, 2023 at 7:20 AM Anton Protopopov <aspsk@isovalent.com> wrote: > > > > Patch verifier to regard values of type CONST_PTR_TO_MAP as trusted > > pointers to struct bpf_map. This allows kfuncs to work with `struct > > bpf_map *` arguments. > > > > Save some bytes by defining btf_bpf_map_id as BTF_ID_LIST_GLOBAL_SINGLE > > (which is u32[1]), not as BTF_ID_LIST (which is u32[64]). > > > > Signed-off-by: Anton Protopopov <aspsk@isovalent.com> > > --- > > include/linux/btf_ids.h | 1 + > > kernel/bpf/map_iter.c | 3 +-- > > kernel/bpf/verifier.c | 5 ++++- > > 3 files changed, 6 insertions(+), 3 deletions(-) > > > > diff --git a/include/linux/btf_ids.h b/include/linux/btf_ids.h > > index 00950cc03bff..a3462a9b8e18 100644 > > --- a/include/linux/btf_ids.h > > +++ b/include/linux/btf_ids.h > > @@ -267,5 +267,6 @@ MAX_BTF_TRACING_TYPE, > > extern u32 btf_tracing_ids[]; > > extern u32 bpf_cgroup_btf_id[]; > > extern u32 bpf_local_storage_map_btf_id[]; > > +extern u32 btf_bpf_map_id[]; > > > > #endif > > diff --git a/kernel/bpf/map_iter.c b/kernel/bpf/map_iter.c > > index d06d3b7150e5..b67996147895 100644 > > --- a/kernel/bpf/map_iter.c > > +++ b/kernel/bpf/map_iter.c > > @@ -78,8 +78,7 @@ static const struct seq_operations bpf_map_seq_ops = { > > .show = bpf_map_seq_show, > > }; > > > > -BTF_ID_LIST(btf_bpf_map_id) > > -BTF_ID(struct, bpf_map) > > +BTF_ID_LIST_GLOBAL_SINGLE(btf_bpf_map_id, struct, bpf_map) > > > > static const struct bpf_iter_seq_info bpf_map_seq_info = { > > .seq_ops = &bpf_map_seq_ops, > > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c > > index 0b9da95331d7..5663f97ef292 100644 > > --- a/kernel/bpf/verifier.c > > +++ b/kernel/bpf/verifier.c > > @@ -5419,6 +5419,9 @@ static bool is_trusted_reg(const struct bpf_reg_state *reg) > > if (reg->ref_obj_id) > > return true; > > > > + if (reg->type == CONST_PTR_TO_MAP) > > + return true; > > + > > Overall it looks great. > Instead of above, how about the following instead: > > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c > index 0b9da95331d7..cd08167dc347 100644 > --- a/kernel/bpf/verifier.c > +++ b/kernel/bpf/verifier.c > @@ -10775,7 +10775,7 @@ static int check_kfunc_args(struct > bpf_verifier_env *env, struct bpf_kfunc_call_ > if (!is_kfunc_trusted_args(meta) && !is_kfunc_rcu(meta)) > break; > > - if (!is_trusted_reg(reg)) { > + if (!is_trusted_reg(reg) && > !reg2btf_ids[base_type(reg->type)]) { > > > This way we won't need to list every convertible type in is_trusted_reg. > > I'm a bit hesitant to put reg2btf_ids[] check directly into is_trusted_reg(). > Maybe it's ok, but it needs more analysis. I am not sure I see a difference in adding a check you proposed above and adding the reg2btf_ids[] check directly into the is_trusted_reg() function. Basically, we say "if type is in reg2btf_ids[], then consider it trusted" in both cases. AFAIS, currently the reg2btf_ids[] contains only trusted types, however, could it happen that we add a non-trusted type there? So, I would leave the patch as is (which also makes sense because the const-ptr-to-map is a special case), or add the "reg2btf_ids[] check" directly into the is_trusted_reg() function.
On Sun, Jul 16, 2023 at 12:49 AM Anton Protopopov <aspsk@isovalent.com> wrote: > > On Fri, Jul 14, 2023 at 10:56:00AM -0700, Alexei Starovoitov wrote: > > On Fri, Jul 14, 2023 at 7:20 AM Anton Protopopov <aspsk@isovalent.com> wrote: > > > > > > Patch verifier to regard values of type CONST_PTR_TO_MAP as trusted > > > pointers to struct bpf_map. This allows kfuncs to work with `struct > > > bpf_map *` arguments. > > > > > > Save some bytes by defining btf_bpf_map_id as BTF_ID_LIST_GLOBAL_SINGLE > > > (which is u32[1]), not as BTF_ID_LIST (which is u32[64]). > > > > > > Signed-off-by: Anton Protopopov <aspsk@isovalent.com> > > > --- > > > include/linux/btf_ids.h | 1 + > > > kernel/bpf/map_iter.c | 3 +-- > > > kernel/bpf/verifier.c | 5 ++++- > > > 3 files changed, 6 insertions(+), 3 deletions(-) > > > > > > diff --git a/include/linux/btf_ids.h b/include/linux/btf_ids.h > > > index 00950cc03bff..a3462a9b8e18 100644 > > > --- a/include/linux/btf_ids.h > > > +++ b/include/linux/btf_ids.h > > > @@ -267,5 +267,6 @@ MAX_BTF_TRACING_TYPE, > > > extern u32 btf_tracing_ids[]; > > > extern u32 bpf_cgroup_btf_id[]; > > > extern u32 bpf_local_storage_map_btf_id[]; > > > +extern u32 btf_bpf_map_id[]; > > > > > > #endif > > > diff --git a/kernel/bpf/map_iter.c b/kernel/bpf/map_iter.c > > > index d06d3b7150e5..b67996147895 100644 > > > --- a/kernel/bpf/map_iter.c > > > +++ b/kernel/bpf/map_iter.c > > > @@ -78,8 +78,7 @@ static const struct seq_operations bpf_map_seq_ops = { > > > .show = bpf_map_seq_show, > > > }; > > > > > > -BTF_ID_LIST(btf_bpf_map_id) > > > -BTF_ID(struct, bpf_map) > > > +BTF_ID_LIST_GLOBAL_SINGLE(btf_bpf_map_id, struct, bpf_map) > > > > > > static const struct bpf_iter_seq_info bpf_map_seq_info = { > > > .seq_ops = &bpf_map_seq_ops, > > > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c > > > index 0b9da95331d7..5663f97ef292 100644 > > > --- a/kernel/bpf/verifier.c > > > +++ b/kernel/bpf/verifier.c > > > @@ -5419,6 +5419,9 @@ static bool is_trusted_reg(const struct bpf_reg_state *reg) > > > if (reg->ref_obj_id) > > > return true; > > > > > > + if (reg->type == CONST_PTR_TO_MAP) > > > + return true; > > > + > > > > Overall it looks great. > > Instead of above, how about the following instead: > > > > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c > > index 0b9da95331d7..cd08167dc347 100644 > > --- a/kernel/bpf/verifier.c > > +++ b/kernel/bpf/verifier.c > > @@ -10775,7 +10775,7 @@ static int check_kfunc_args(struct > > bpf_verifier_env *env, struct bpf_kfunc_call_ > > if (!is_kfunc_trusted_args(meta) && !is_kfunc_rcu(meta)) > > break; > > > > - if (!is_trusted_reg(reg)) { > > + if (!is_trusted_reg(reg) && > > !reg2btf_ids[base_type(reg->type)]) { > > > > > > This way we won't need to list every convertible type in is_trusted_reg. > > > > I'm a bit hesitant to put reg2btf_ids[] check directly into is_trusted_reg(). > > Maybe it's ok, but it needs more analysis. > > I am not sure I see a difference in adding a check you proposed above and > adding the reg2btf_ids[] check directly into the is_trusted_reg() function. > Basically, we say "if type is in reg2btf_ids[], then consider it trusted" in > both cases. AFAIS, currently the reg2btf_ids[] contains only trusted types, > however, could it happen that we add a non-trusted type there? > > So, I would leave the patch as is (which also makes sense because the > const-ptr-to-map is a special case), or add the "reg2btf_ids[] check" > directly into the is_trusted_reg() function. Fair enough. Let's add reg2btf_ids[] to is_trusted_reg() directly.
On Tue, Jul 18, 2023 at 05:54:27PM -0700, Alexei Starovoitov wrote: > On Sun, Jul 16, 2023 at 12:49 AM Anton Protopopov <aspsk@isovalent.com> wrote: > > > > On Fri, Jul 14, 2023 at 10:56:00AM -0700, Alexei Starovoitov wrote: > > > On Fri, Jul 14, 2023 at 7:20 AM Anton Protopopov <aspsk@isovalent.com> wrote: > > > > > > > > Patch verifier to regard values of type CONST_PTR_TO_MAP as trusted > > > > pointers to struct bpf_map. This allows kfuncs to work with `struct > > > > bpf_map *` arguments. > > > > > > > > Save some bytes by defining btf_bpf_map_id as BTF_ID_LIST_GLOBAL_SINGLE > > > > (which is u32[1]), not as BTF_ID_LIST (which is u32[64]). > > > > > > > > Signed-off-by: Anton Protopopov <aspsk@isovalent.com> > > > > --- > > > > include/linux/btf_ids.h | 1 + > > > > kernel/bpf/map_iter.c | 3 +-- > > > > kernel/bpf/verifier.c | 5 ++++- > > > > 3 files changed, 6 insertions(+), 3 deletions(-) > > > > > > > > diff --git a/include/linux/btf_ids.h b/include/linux/btf_ids.h > > > > index 00950cc03bff..a3462a9b8e18 100644 > > > > --- a/include/linux/btf_ids.h > > > > +++ b/include/linux/btf_ids.h > > > > @@ -267,5 +267,6 @@ MAX_BTF_TRACING_TYPE, > > > > extern u32 btf_tracing_ids[]; > > > > extern u32 bpf_cgroup_btf_id[]; > > > > extern u32 bpf_local_storage_map_btf_id[]; > > > > +extern u32 btf_bpf_map_id[]; > > > > > > > > #endif > > > > diff --git a/kernel/bpf/map_iter.c b/kernel/bpf/map_iter.c > > > > index d06d3b7150e5..b67996147895 100644 > > > > --- a/kernel/bpf/map_iter.c > > > > +++ b/kernel/bpf/map_iter.c > > > > @@ -78,8 +78,7 @@ static const struct seq_operations bpf_map_seq_ops = { > > > > .show = bpf_map_seq_show, > > > > }; > > > > > > > > -BTF_ID_LIST(btf_bpf_map_id) > > > > -BTF_ID(struct, bpf_map) > > > > +BTF_ID_LIST_GLOBAL_SINGLE(btf_bpf_map_id, struct, bpf_map) > > > > > > > > static const struct bpf_iter_seq_info bpf_map_seq_info = { > > > > .seq_ops = &bpf_map_seq_ops, > > > > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c > > > > index 0b9da95331d7..5663f97ef292 100644 > > > > --- a/kernel/bpf/verifier.c > > > > +++ b/kernel/bpf/verifier.c > > > > @@ -5419,6 +5419,9 @@ static bool is_trusted_reg(const struct bpf_reg_state *reg) > > > > if (reg->ref_obj_id) > > > > return true; > > > > > > > > + if (reg->type == CONST_PTR_TO_MAP) > > > > + return true; > > > > + > > > > > > Overall it looks great. > > > Instead of above, how about the following instead: > > > > > > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c > > > index 0b9da95331d7..cd08167dc347 100644 > > > --- a/kernel/bpf/verifier.c > > > +++ b/kernel/bpf/verifier.c > > > @@ -10775,7 +10775,7 @@ static int check_kfunc_args(struct > > > bpf_verifier_env *env, struct bpf_kfunc_call_ > > > if (!is_kfunc_trusted_args(meta) && !is_kfunc_rcu(meta)) > > > break; > > > > > > - if (!is_trusted_reg(reg)) { > > > + if (!is_trusted_reg(reg) && > > > !reg2btf_ids[base_type(reg->type)]) { > > > > > > > > > This way we won't need to list every convertible type in is_trusted_reg. > > > > > > I'm a bit hesitant to put reg2btf_ids[] check directly into is_trusted_reg(). > > > Maybe it's ok, but it needs more analysis. > > > > I am not sure I see a difference in adding a check you proposed above and > > adding the reg2btf_ids[] check directly into the is_trusted_reg() function. > > Basically, we say "if type is in reg2btf_ids[], then consider it trusted" in > > both cases. AFAIS, currently the reg2btf_ids[] contains only trusted types, > > however, could it happen that we add a non-trusted type there? > > > > So, I would leave the patch as is (which also makes sense because the > > const-ptr-to-map is a special case), or add the "reg2btf_ids[] check" > > directly into the is_trusted_reg() function. > > Fair enough. Let's add reg2btf_ids[] to is_trusted_reg() directly. Thanks, I will send v2.
diff --git a/include/linux/btf_ids.h b/include/linux/btf_ids.h index 00950cc03bff..a3462a9b8e18 100644 --- a/include/linux/btf_ids.h +++ b/include/linux/btf_ids.h @@ -267,5 +267,6 @@ MAX_BTF_TRACING_TYPE, extern u32 btf_tracing_ids[]; extern u32 bpf_cgroup_btf_id[]; extern u32 bpf_local_storage_map_btf_id[]; +extern u32 btf_bpf_map_id[]; #endif diff --git a/kernel/bpf/map_iter.c b/kernel/bpf/map_iter.c index d06d3b7150e5..b67996147895 100644 --- a/kernel/bpf/map_iter.c +++ b/kernel/bpf/map_iter.c @@ -78,8 +78,7 @@ static const struct seq_operations bpf_map_seq_ops = { .show = bpf_map_seq_show, }; -BTF_ID_LIST(btf_bpf_map_id) -BTF_ID(struct, bpf_map) +BTF_ID_LIST_GLOBAL_SINGLE(btf_bpf_map_id, struct, bpf_map) static const struct bpf_iter_seq_info bpf_map_seq_info = { .seq_ops = &bpf_map_seq_ops, diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 0b9da95331d7..5663f97ef292 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -5419,6 +5419,9 @@ static bool is_trusted_reg(const struct bpf_reg_state *reg) if (reg->ref_obj_id) return true; + if (reg->type == CONST_PTR_TO_MAP) + return true; + /* If a register is not referenced, it is trusted if it has the * MEM_ALLOC or PTR_TRUSTED type modifiers, and no others. Some of the * other type modifiers may be safe, but we elect to take an opt-in @@ -10052,13 +10055,13 @@ static bool __btf_type_is_scalar_struct(struct bpf_verifier_env *env, return true; } - static u32 *reg2btf_ids[__BPF_REG_TYPE_MAX] = { #ifdef CONFIG_NET [PTR_TO_SOCKET] = &btf_sock_ids[BTF_SOCK_TYPE_SOCK], [PTR_TO_SOCK_COMMON] = &btf_sock_ids[BTF_SOCK_TYPE_SOCK_COMMON], [PTR_TO_TCP_SOCK] = &btf_sock_ids[BTF_SOCK_TYPE_TCP], #endif + [CONST_PTR_TO_MAP] = btf_bpf_map_id, }; enum kfunc_ptr_arg_type {
Patch verifier to regard values of type CONST_PTR_TO_MAP as trusted pointers to struct bpf_map. This allows kfuncs to work with `struct bpf_map *` arguments. Save some bytes by defining btf_bpf_map_id as BTF_ID_LIST_GLOBAL_SINGLE (which is u32[1]), not as BTF_ID_LIST (which is u32[64]). Signed-off-by: Anton Protopopov <aspsk@isovalent.com> --- include/linux/btf_ids.h | 1 + kernel/bpf/map_iter.c | 3 +-- kernel/bpf/verifier.c | 5 ++++- 3 files changed, 6 insertions(+), 3 deletions(-)