bpf_convert_ctx_accesses() turns a BPF_LDX into a BPF_PROBE_MEM one by matching the type recorded for the insn against a list of exact pointer types. The list cannot keep up with the flag combinations the verifier produces, and a type which is missing from it ends up as a plain load without an exception table entry, so a bad address panics the kernel instead of being handled. Two such types exist today and are reachable: - PTR_TO_BTF_ID | PTR_UNTRUSTED | MEM_ALLOC | NON_OWN_REF - PTR_TO_BTF_ID | PTR_UNTRUSTED | MEM_RCU Rather than adding the two, just drop the list and state the property itself in the default case of the switch. This is a superset of what the list matched, the untrusted PTR_TO_MEM does not have to carry MEM_RDONLY for it anymore, and it stays in sync with the verifier side which uses the same match in save_aux_ptr_type() and reg_type_mismatch_ok(). Assert that a fault prone type which does not get the rewrite for whatever reason is rejected at load time rather than left to fault at runtime to catch any future cases.
Showing the changes to include (1 of 3 files). Show all
Unified · Split
| @@ -1308,6 +1308,17 @@ static inline u32 type_flag(u32 type) · 1307 unmodified lines | |||
| 1308 | return type & ~BPF_BASE_TYPE_MASK; | 1308 | return type & ~BPF_BASE_TYPE_MASK; |
| 1309 | } | 1309 | } |
| 1310 | 1310 | ||
| 1311 | static inline bool bpf_is_ptr_to_mem_or_btf_id(enum bpf_reg_type type) | ||
| 1312 | { | ||
| 1313 | switch (base_type(type)) { | ||
| 1314 | case PTR_TO_MEM: | ||
| 1315 | case PTR_TO_BTF_ID: | ||
| 1316 | return true; | ||
| 1317 | default: | ||
| 1318 | return false; | ||
| 1319 | } | ||
| 1320 | } | ||
| 1321 | |||
| 1311 | static inline bool bpf_may_fault_on_deref(enum bpf_reg_type type) | 1322 | static inline bool bpf_may_fault_on_deref(enum bpf_reg_type type) |
| 1312 | { | 1323 | { |
| 1313 | /* | 1324 | /* |