Message ID | 20230228040121.94253-3-alexei.starovoitov@gmail.com (mailing list archive) |
---|---|
State | Changes Requested |
Delegated to: | BPF |
Headers | show |
Series | bpf: Introduce kptr_rcu. | expand |
On Mon, Feb 27, 2023 at 08:01:18PM -0800, Alexei Starovoitov wrote: > From: Alexei Starovoitov <ast@kernel.org> > > bpf programs sometimes do: > bpf_cgrp_storage_get(&map, task->cgroups->dfl_cgrp, ...); > It is safe to do, because cgroups->dfl_cgrp pointer is set diring init and > never changes. The task->cgroups is also never NULL. It is also set during init > and will change when task switches cgroups. For any trusted task pointer > dereference of cgroups and dfl_cgrp should yield trusted pointers. The verifier > wasn't aware of this. Hence in gcc compiled kernels task->cgroups dereference > was producing PTR_TO_BTF_ID without modifiers while in clang compiled kernels > the verifier recognizes __rcu tag in cgroups field and produces > PTR_TO_BTF_ID | MEM_RCU | MAYBE_NULL. > Tag cgroups and dfl_cgrp as trusted to equalize clang and gcc behavior. > When GCC supports btf_type_tag such tagging will done directly in the type. > > Signed-off-by: Alexei Starovoitov <ast@kernel.org> Acked-by: David Vernet <void@manifault.com>
On Mon, Feb 27, 2023 at 08:01:18PM -0800, Alexei Starovoitov wrote: > From: Alexei Starovoitov <ast@kernel.org> > > bpf programs sometimes do: > bpf_cgrp_storage_get(&map, task->cgroups->dfl_cgrp, ...); > It is safe to do, because cgroups->dfl_cgrp pointer is set diring init and ^ u > never changes. The task->cgroups is also never NULL. It is also set during init > and will change when task switches cgroups. For any trusted task pointer > dereference of cgroups and dfl_cgrp should yield trusted pointers. The verifier > wasn't aware of this. Hence in gcc compiled kernels task->cgroups dereference > was producing PTR_TO_BTF_ID without modifiers while in clang compiled kernels > the verifier recognizes __rcu tag in cgroups field and produces > PTR_TO_BTF_ID | MEM_RCU | MAYBE_NULL. > Tag cgroups and dfl_cgrp as trusted to equalize clang and gcc behavior. > When GCC supports btf_type_tag such tagging will done directly in the type. > > Signed-off-by: Alexei Starovoitov <ast@kernel.org> Acked-by: Tejun Heo <tj@kernel.org> Thanks.
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 5cb8b623f639..e4234266e76d 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -5011,6 +5011,10 @@ static int bpf_map_direct_read(struct bpf_map *map, int off, int size, u64 *val) BTF_TYPE_SAFE_NESTED(struct task_struct) { const cpumask_t *cpus_ptr; + struct css_set *cgroups; +}; +BTF_TYPE_SAFE_NESTED(struct css_set) { + struct cgroup *dfl_cgrp; }; static bool nested_ptr_is_trusted(struct bpf_verifier_env *env, @@ -5022,6 +5026,7 @@ static bool nested_ptr_is_trusted(struct bpf_verifier_env *env, return false; BTF_TYPE_EMIT(BTF_TYPE_SAFE_NESTED(struct task_struct)); + BTF_TYPE_EMIT(BTF_TYPE_SAFE_NESTED(struct css_set)); return btf_nested_type_is_trusted(&env->log, reg, off); }