bpf: Check pointer type for all atomic RMW paths

Atomic RMW verification records an instruction pointer type only when the current destination is PTR_TO_ARENA. A second path can therefore reach the same instruction with an ordinary pointer without comparing it against the saved arena type. The post-verification fixup uses the saved type to rewrite the instruction to BPF_PROBE_ATOMIC for every path. Record the actual destination type for all atomic RMW paths so the existing mismatch check rejects incompatible uses of one instruction.

Yiyang Chen committed 2 months ago

Commit 4bc49ae1 parent c93cbdb1 file · +3 −5Browse files

Showing the changes to kernel (1 of 1 file). Show all

Unified · Split

kernel/bpf/verifier.c+3−5

@@ -6739,11 +6739,9 @@ static int check_atomic_rmw(struct bpf_verifier_env *env, · 6738 unmodified lines
6739	6739	if (err)
6740	6740	return err;
6741	6741
6742		− if (is_arena_reg(env, insn->dst_reg)) {
6743		− err = save_aux_ptr_type(env, PTR_TO_ARENA, false);
6744		− if (err)
6745		− return err;
6746		− }
	6742	+ err = save_aux_ptr_type(env, dst_reg->type, false);
	6743	+ if (err)
	6744	+ return err;
6747	6745	/* Check whether we can write into the same memory. */
6748	6746	err = check_mem_access(env, env->insn_idx, dst_reg, argno_from_reg(insn->dst_reg), insn->off,
6749	6747	BPF_SIZE(insn->code), BPF_WRITE, -1, true, false);