If we encounter a pointer to memory, we set meta->raw_mode depending on the type of memory we point at. What isn't obvious is that this information is only used when the next memory size argument is encountered. Move the assignment closer to where it's used, and add a comment that explains what is going on.
Showing the changes to kernel (1 of 1 file). Show all
Unified · Split
| @@ -4067,7 +4067,6 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg, · 4066 unmodified lines | |||
| 4067 | type != PTR_TO_RDWR_BUF && | 4067 | type != PTR_TO_RDWR_BUF && |
| 4068 | type != expected_type) | 4068 | type != expected_type) |
| 4069 | goto err_type; | 4069 | goto err_type; |
| 4070 | meta->raw_mode = arg_type == ARG_PTR_TO_UNINIT_MEM; | ||
| 4071 | } else if (arg_type_is_alloc_mem_ptr(arg_type)) { | 4070 | } else if (arg_type_is_alloc_mem_ptr(arg_type)) { |
| 4072 | expected_type = PTR_TO_MEM; | 4071 | expected_type = PTR_TO_MEM; |
| 4073 | if (register_is_null(reg) && | 4072 | if (register_is_null(reg) && |
| @@ -4156,6 +4155,11 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg, · 82 unmodified lines | |||
| 4156 | err = check_helper_mem_access(env, regno, | 4155 | err = check_helper_mem_access(env, regno, |
| 4157 | meta->map_ptr->value_size, false, | 4156 | meta->map_ptr->value_size, false, |
| 4158 | meta); | 4157 | meta); |
| 4158 | } else if (arg_type_is_mem_ptr(arg_type)) { | ||
| 4159 | /* The access to this pointer is only checked when we hit the | ||
| 4160 | * next is_mem_size argument below. | ||
| 4161 | */ | ||
| 4162 | meta->raw_mode = (arg_type == ARG_PTR_TO_UNINIT_MEM); | ||
| 4159 | } else if (arg_type_is_mem_size(arg_type)) { | 4163 | } else if (arg_type_is_mem_size(arg_type)) { |
| 4160 | bool zero_size_allowed = (arg_type == ARG_CONST_SIZE_OR_ZERO); | 4164 | bool zero_size_allowed = (arg_type == ARG_CONST_SIZE_OR_ZERO); |
| 4161 | 4165 | ||