Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2ea864c5 authored by Mauricio Vasquez B's avatar Mauricio Vasquez B Committed by Alexei Starovoitov
Browse files

bpf/verifier: add ARG_PTR_TO_UNINIT_MAP_VALUE 



ARG_PTR_TO_UNINIT_MAP_VALUE argument is a pointer to a memory zone
used to save the value of a map.  Basically the same as
ARG_PTR_TO_UNINIT_MEM, but the size has not be passed as an extra
argument.

This will be used in the following patch that implements some new
helpers that receive a pointer to be filled with a map value.

Signed-off-by: default avatarMauricio Vasquez B <mauricio.vasquez@polito.it>
Acked-by: default avatarSong Liu <songliubraving@fb.com>
Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
parent c9d29f46

include/linux/bpf.h

+1 −0
Original line number Diff line number Diff line
@@ -138,6 +138,7 @@ enum bpf_arg_type { 
	ARG_CONST_MAP_PTR,	/* const argument used as pointer to bpf_map */

	ARG_PTR_TO_MAP_KEY,	/* pointer to stack used as map key */

	ARG_PTR_TO_MAP_VALUE,	/* pointer to stack used as map value */

	ARG_PTR_TO_UNINIT_MAP_VALUE,	/* pointer to valid memory used to store a map value */



	/* the following constraints used to prototype bpf_memcmp() and other

	 * functions that access data on eBPF program stack

kernel/bpf/verifier.c

+6 −3
Original line number Diff line number Diff line
@@ -2117,7 +2117,8 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 regno, 
	}



	if (arg_type == ARG_PTR_TO_MAP_KEY ||

	    arg_type == ARG_PTR_TO_MAP_VALUE) {

	    arg_type == ARG_PTR_TO_MAP_VALUE ||

	    arg_type == ARG_PTR_TO_UNINIT_MAP_VALUE) {

		expected_type = PTR_TO_STACK;

		if (!type_is_pkt_pointer(type) && type != PTR_TO_MAP_VALUE &&

		    type != expected_type)
@@ -2187,7 +2188,8 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 regno, 
		err = check_helper_mem_access(env, regno,

					      meta->map_ptr->key_size, false,

					      NULL);

	} else if (arg_type == ARG_PTR_TO_MAP_VALUE) {

	} else if (arg_type == ARG_PTR_TO_MAP_VALUE ||

		   arg_type == ARG_PTR_TO_UNINIT_MAP_VALUE) {

		/* bpf_map_xxx(..., map_ptr, ..., value) call:

		 * check [value, value + map->value_size) validity

		 */
@@ -2196,9 +2198,10 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 regno, 
			verbose(env, "invalid map_ptr to access map->value\n");

			return -EACCES;

		}

		meta->raw_mode = (arg_type == ARG_PTR_TO_UNINIT_MAP_VALUE);

		err = check_helper_mem_access(env, regno,

					      meta->map_ptr->value_size, false,

					      NULL);

					      meta);

	} else if (arg_type_is_mem_size(arg_type)) {

		bool zero_size_allowed = (arg_type == ARG_CONST_SIZE_OR_ZERO);