bpf: reject program if a __user tagged memory accessed in kernel way

BPF verifier supports direct memory access for BPF_PROG_TYPE_TRACING type of bpf programs, e.g., a->b. If "a" is a pointer pointing to kernel memory, bpf verifier will allow user to write code in C like a->b and the verifier will translate it to a kernel load properly. If "a" is a pointer to user memory, it is expected that bpf developer should be bpf_probe_read_user() helper to get the value a->b. Without utilizing BTF __user tagging information, current verifier will assume that a->b is a kernel memory access and this may generate incorrect result. Now BTF contains __user information, it can check whether the pointer points to a user memory or not. If it is, the verifier can reject the program and force users to use bpf_probe_read_user() helper explicitly. In the future, we can easily extend btf_add_space for other address space tagging, for example, rcu/percpu etc.

Yonghong Song committed 4 years ago

Commit c6f1bfe1 parent 7472d5a6 files · +71 −24Browse files

Showing the changes to include (2 of 6 files). Show all

Unified · Split

2 files

include/linux/bpf.h +6 −3
include/linux/btf.h +5 −0

include/linux/bpf.h+6−3

 	 */
 	MEM_ALLOC		= BIT(2 + BPF_BASE_TYPE_BITS),
-	__BPF_TYPE_LAST_FLAG	= MEM_ALLOC,
+	/* MEM is in user address space. */
+	MEM_USER		= BIT(3 + BPF_BASE_TYPE_BITS),
+	__BPF_TYPE_LAST_FLAG	= MEM_USER,
 };
 /* Max number of base types. */
 				 const struct btf *btf,
 				 const struct btf_type *t, int off, int size,
 				 enum bpf_access_type atype,
-				 u32 *next_btf_id);
+				 u32 *next_btf_id, enum bpf_type_flag *flag);
 };
 struct bpf_prog_offload_ops {
 int btf_struct_access(struct bpf_verifier_log *log, const struct btf *btf,
 		      const struct btf_type *t, int off, int size,
 		      enum bpf_access_type atype,
-		      u32 *next_btf_id);
+		      u32 *next_btf_id, enum bpf_type_flag *flag);
 bool btf_struct_ids_match(struct bpf_verifier_log *log,
 			  const struct btf *btf, u32 id, int off,
 			  const struct btf *need_btf, u32 need_type_id);

include/linux/btf.h+5−0

 	return BTF_INFO_KIND(t->info) == BTF_KIND_VAR;
 }
+static inline bool btf_type_is_type_tag(const struct btf_type *t)
+{
+	return BTF_INFO_KIND(t->info) == BTF_KIND_TYPE_TAG;
+}
 /* union is only a special case of struct:
  * all its offsetof(member) == 0
  */

bpf: reject program if a __user tagged memory accessed in kernel way

Keyboard shortcuts

General

Issues and pull requests

Issues, pull requests and Inbox

Repository code