diff mbox series

[bpf-next,v5,2/6] bpf/verifier: add bpf_timer as a kfunc capable type

Message ID 20240322-hid-bpf-sleepable-v5-2-179c7b59eaaa@kernel.org (mailing list archive)
State Changes Requested
Delegated to: BPF
Headers show
Series sleepable bpf_timer (was: allow HID-BPF to do device IOs) | expand

Checks

Context Check Description
bpf/vmtest-bpf-next-PR fail PR summary
netdev/series_format success Posting correctly formatted
netdev/tree_selection success Clearly marked for bpf-next, async
netdev/ynl success Generated files up to date; no warnings/errors; no diff in generated;
netdev/fixes_present success Fixes tag not required for -next series
netdev/header_inline success No static functions without inline keyword in header files
netdev/build_32bit success Errors and warnings before: 951 this patch: 951
netdev/build_tools success No tools touched, skip
netdev/cc_maintainers success CCed 13 of 13 maintainers
netdev/build_clang success Errors and warnings before: 957 this patch: 957
netdev/verify_signedoff success Signed-off-by tag matches author and committer
netdev/deprecated_api success None detected
netdev/check_selftest success No net selftest shell script
netdev/verify_fixes success No Fixes tag
netdev/build_allmodconfig_warn success Errors and warnings before: 968 this patch: 968
netdev/checkpatch warning WARNING: line length of 82 exceeds 80 columns WARNING: line length of 89 exceeds 80 columns WARNING: line length of 93 exceeds 80 columns
netdev/build_clang_rust success No Rust files in patch. Skipping build
netdev/kdoc success Errors and warnings before: 0 this patch: 0
netdev/source_inline success Was 0 now: 0
bpf/vmtest-bpf-next-VM_Test-0 success Logs for Lint
bpf/vmtest-bpf-next-VM_Test-1 success Logs for ShellCheck
bpf/vmtest-bpf-next-VM_Test-2 success Logs for Unittests
bpf/vmtest-bpf-next-VM_Test-3 success Logs for Validate matrix.py
bpf/vmtest-bpf-next-VM_Test-5 success Logs for aarch64-gcc / build-release
bpf/vmtest-bpf-next-VM_Test-18 success Logs for set-matrix
bpf/vmtest-bpf-next-VM_Test-19 success Logs for x86_64-gcc / build / build for x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-17 success Logs for s390x-gcc / veristat
bpf/vmtest-bpf-next-VM_Test-20 success Logs for x86_64-gcc / build-release
bpf/vmtest-bpf-next-VM_Test-10 success Logs for aarch64-gcc / veristat
bpf/vmtest-bpf-next-VM_Test-11 success Logs for s390x-gcc / build / build for s390x with gcc
bpf/vmtest-bpf-next-VM_Test-12 success Logs for s390x-gcc / build-release
bpf/vmtest-bpf-next-VM_Test-4 success Logs for aarch64-gcc / build / build for aarch64 with gcc
bpf/vmtest-bpf-next-VM_Test-28 success Logs for x86_64-llvm-17 / build / build for x86_64 with llvm-17
bpf/vmtest-bpf-next-VM_Test-34 success Logs for x86_64-llvm-17 / veristat
bpf/vmtest-bpf-next-VM_Test-35 success Logs for x86_64-llvm-18 / build / build for x86_64 with llvm-18
bpf/vmtest-bpf-next-VM_Test-42 success Logs for x86_64-llvm-18 / veristat
bpf/vmtest-bpf-next-VM_Test-9 success Logs for aarch64-gcc / test (test_verifier, false, 360) / test_verifier on aarch64 with gcc
bpf/vmtest-bpf-next-VM_Test-6 success Logs for aarch64-gcc / test (test_maps, false, 360) / test_maps on aarch64 with gcc
bpf/vmtest-bpf-next-VM_Test-16 success Logs for s390x-gcc / test (test_verifier, false, 360) / test_verifier on s390x with gcc
bpf/vmtest-bpf-next-VM_Test-7 fail Logs for aarch64-gcc / test (test_progs, false, 360) / test_progs on aarch64 with gcc
bpf/vmtest-bpf-next-VM_Test-8 fail Logs for aarch64-gcc / test (test_progs_no_alu32, false, 360) / test_progs_no_alu32 on aarch64 with gcc
bpf/vmtest-bpf-next-VM_Test-13 success Logs for s390x-gcc / test (test_maps, false, 360) / test_maps on s390x with gcc
bpf/vmtest-bpf-next-VM_Test-26 success Logs for x86_64-gcc / test (test_verifier, false, 360) / test_verifier on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-33 success Logs for x86_64-llvm-17 / test (test_verifier, false, 360) / test_verifier on x86_64 with llvm-17
bpf/vmtest-bpf-next-VM_Test-36 success Logs for x86_64-llvm-18 / build-release / build for x86_64 with llvm-18 and -O2 optimization
bpf/vmtest-bpf-next-VM_Test-21 success Logs for x86_64-gcc / test (test_maps, false, 360) / test_maps on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-22 fail Logs for x86_64-gcc / test (test_progs, false, 360) / test_progs on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-23 fail Logs for x86_64-gcc / test (test_progs_no_alu32, false, 360) / test_progs_no_alu32 on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-24 success Logs for x86_64-gcc / test (test_progs_no_alu32_parallel, true, 30) / test_progs_no_alu32_parallel on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-25 success Logs for x86_64-gcc / test (test_progs_parallel, true, 30) / test_progs_parallel on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-15 fail Logs for s390x-gcc / test (test_progs_no_alu32, false, 360) / test_progs_no_alu32 on s390x with gcc
bpf/vmtest-bpf-next-VM_Test-27 success Logs for x86_64-gcc / veristat / veristat on x86_64 with gcc
bpf/vmtest-bpf-next-VM_Test-30 success Logs for x86_64-llvm-17 / test (test_maps, false, 360) / test_maps on x86_64 with llvm-17
bpf/vmtest-bpf-next-VM_Test-31 fail Logs for x86_64-llvm-17 / test (test_progs, false, 360) / test_progs on x86_64 with llvm-17
bpf/vmtest-bpf-next-VM_Test-32 fail Logs for x86_64-llvm-17 / test (test_progs_no_alu32, false, 360) / test_progs_no_alu32 on x86_64 with llvm-17
bpf/vmtest-bpf-next-VM_Test-37 success Logs for x86_64-llvm-18 / test (test_maps, false, 360) / test_maps on x86_64 with llvm-18
bpf/vmtest-bpf-next-VM_Test-41 success Logs for x86_64-llvm-18 / test (test_verifier, false, 360) / test_verifier on x86_64 with llvm-18
bpf/vmtest-bpf-next-VM_Test-14 fail Logs for s390x-gcc / test (test_progs, false, 360) / test_progs on s390x with gcc
bpf/vmtest-bpf-next-VM_Test-29 success Logs for x86_64-llvm-17 / build-release / build for x86_64 with llvm-17 and -O2 optimization
bpf/vmtest-bpf-next-VM_Test-38 fail Logs for x86_64-llvm-18 / test (test_progs, false, 360) / test_progs on x86_64 with llvm-18
bpf/vmtest-bpf-next-VM_Test-39 fail Logs for x86_64-llvm-18 / test (test_progs_cpuv4, false, 360) / test_progs_cpuv4 on x86_64 with llvm-18
bpf/vmtest-bpf-next-VM_Test-40 fail Logs for x86_64-llvm-18 / test (test_progs_no_alu32, false, 360) / test_progs_no_alu32 on x86_64 with llvm-18

Commit Message

Benjamin Tissoires March 22, 2024, 2:56 p.m. UTC 
We need to extend the bpf_timer API, but the way forward relies on kfuncs.
So make bpf_timer known for kfuncs from the verifier PoV

Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>

---

changes in v5:
- also check for the reg offset

changes in v4:
- enforce KF_ARG_PTR_TO_TIMER to be of type PTR_TO_MAP_VALUE

new in v3 (split from v2 02/10)
---
 kernel/bpf/verifier.c | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

Comments

Kumar Kartikeya Dwivedi March 22, 2024, 4:30 p.m. UTC | #1 
On Fri, 22 Mar 2024 at 15:57, Benjamin Tissoires <bentiss@kernel.org> wrote:
>
> We need to extend the bpf_timer API, but the way forward relies on kfuncs.
> So make bpf_timer known for kfuncs from the verifier PoV
>
> Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
>
> ---
>
> changes in v5:
> - also check for the reg offset
>
> changes in v4:
> - enforce KF_ARG_PTR_TO_TIMER to be of type PTR_TO_MAP_VALUE
>
> new in v3 (split from v2 02/10)
> ---
>  kernel/bpf/verifier.c | 23 +++++++++++++++++++++++
>  1 file changed, 23 insertions(+)
>
> diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> index 63749ad5ac6b..24a604e26ec7 100644
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -10826,6 +10826,7 @@ enum {
>         KF_ARG_LIST_NODE_ID,
>         KF_ARG_RB_ROOT_ID,
>         KF_ARG_RB_NODE_ID,
> +       KF_ARG_TIMER_ID,
>  };
>
>  BTF_ID_LIST(kf_arg_btf_ids)
> @@ -10834,6 +10835,7 @@ BTF_ID(struct, bpf_list_head)
>  BTF_ID(struct, bpf_list_node)
>  BTF_ID(struct, bpf_rb_root)
>  BTF_ID(struct, bpf_rb_node)
> +BTF_ID(struct, bpf_timer_kern)
>
>  static bool __is_kfunc_ptr_arg_type(const struct btf *btf,
>                                     const struct btf_param *arg, int type)
> @@ -10877,6 +10879,12 @@ static bool is_kfunc_arg_rbtree_node(const struct btf *btf, const struct btf_par
>         return __is_kfunc_ptr_arg_type(btf, arg, KF_ARG_RB_NODE_ID);
>  }
>
> +static bool is_kfunc_arg_timer(const struct btf *btf, const struct btf_param *arg)
> +{
> +       bool ret = __is_kfunc_ptr_arg_type(btf, arg, KF_ARG_TIMER_ID);
> +       return ret;
> +}
> +
>  static bool is_kfunc_arg_callback(struct bpf_verifier_env *env, const struct btf *btf,
>                                   const struct btf_param *arg)
>  {
> @@ -10946,6 +10954,7 @@ enum kfunc_ptr_arg_type {
>         KF_ARG_PTR_TO_NULL,
>         KF_ARG_PTR_TO_CONST_STR,
>         KF_ARG_PTR_TO_MAP,
> +       KF_ARG_PTR_TO_TIMER,
>  };
>
>  enum special_kfunc_type {
> @@ -11102,6 +11111,9 @@ get_kfunc_ptr_arg_type(struct bpf_verifier_env *env,
>         if (is_kfunc_arg_map(meta->btf, &args[argno]))
>                 return KF_ARG_PTR_TO_MAP;
>
> +       if (is_kfunc_arg_timer(meta->btf, &args[argno]))
> +               return KF_ARG_PTR_TO_TIMER;
> +
>         if ((base_type(reg->type) == PTR_TO_BTF_ID || reg2btf_ids[base_type(reg->type)])) {
>                 if (!btf_type_is_struct(ref_t)) {
>                         verbose(env, "kernel function %s args#%d pointer type %s %s is not supported\n",
> @@ -11735,6 +11747,7 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_
>                 case KF_ARG_PTR_TO_CALLBACK:
>                 case KF_ARG_PTR_TO_REFCOUNTED_KPTR:
>                 case KF_ARG_PTR_TO_CONST_STR:
> +               case KF_ARG_PTR_TO_TIMER:
>                         /* Trusted by default */
>                         break;
>                 default:
> @@ -12021,6 +12034,16 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_
>                         if (ret)
>                                 return ret;
>                         break;
> +               case KF_ARG_PTR_TO_TIMER:
> +                       if (reg->type != PTR_TO_MAP_VALUE) {
> +                               verbose(env, "arg#%d doesn't point to a map value\n", i);
> +                               return -EINVAL;
> +                       }
> +                       if (reg->off) {
> +                               verbose(env, "arg#%d offset can not be greater than 0\n", i);
> +                               return -EINVAL;
> +                       }

This won't be correct. You don't really check whether the timer exists
at reg->off (and if you did, this would still restrict it to 0 offset,
and not check the variable offset which would be non-zero). What I
would suggest is calling process_timer_func (see how dynptr calls the
same underlying process_dynptr_func to enforce type invariants). This
would allow sharing the same checks and avoid bugs from creeping in.
It does all checks wrt constant/variable offset and looking up the
timer field offset and matching it against the one in the pointer.

> +                       break;
>                 }
>         }
>
>
> --
> 2.44.0
>
>
Alexei Starovoitov March 24, 2024, 3:53 a.m. UTC | #2 
On Fri, Mar 22, 2024 at 9:31 AM Kumar Kartikeya Dwivedi
<memxor@gmail.com> wrote:
>
> On Fri, 22 Mar 2024 at 15:57, Benjamin Tissoires <bentiss@kernel.org> wrote:
> >
> > We need to extend the bpf_timer API, but the way forward relies on kfuncs.
> > So make bpf_timer known for kfuncs from the verifier PoV
> >
> > Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
> >
> > ---
> >
> > changes in v5:
> > - also check for the reg offset
> >
> > changes in v4:
> > - enforce KF_ARG_PTR_TO_TIMER to be of type PTR_TO_MAP_VALUE
> >
> > new in v3 (split from v2 02/10)
> > ---
> >  kernel/bpf/verifier.c | 23 +++++++++++++++++++++++
> >  1 file changed, 23 insertions(+)
> >
> > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> > index 63749ad5ac6b..24a604e26ec7 100644
> > --- a/kernel/bpf/verifier.c
> > +++ b/kernel/bpf/verifier.c
> > @@ -10826,6 +10826,7 @@ enum {
> >         KF_ARG_LIST_NODE_ID,
> >         KF_ARG_RB_ROOT_ID,
> >         KF_ARG_RB_NODE_ID,
> > +       KF_ARG_TIMER_ID,
> >  };
> >
> >  BTF_ID_LIST(kf_arg_btf_ids)
> > @@ -10834,6 +10835,7 @@ BTF_ID(struct, bpf_list_head)
> >  BTF_ID(struct, bpf_list_node)
> >  BTF_ID(struct, bpf_rb_root)
> >  BTF_ID(struct, bpf_rb_node)
> > +BTF_ID(struct, bpf_timer_kern)
> >
> >  static bool __is_kfunc_ptr_arg_type(const struct btf *btf,
> >                                     const struct btf_param *arg, int type)
> > @@ -10877,6 +10879,12 @@ static bool is_kfunc_arg_rbtree_node(const struct btf *btf, const struct btf_par
> >         return __is_kfunc_ptr_arg_type(btf, arg, KF_ARG_RB_NODE_ID);
> >  }
> >
> > +static bool is_kfunc_arg_timer(const struct btf *btf, const struct btf_param *arg)
> > +{
> > +       bool ret = __is_kfunc_ptr_arg_type(btf, arg, KF_ARG_TIMER_ID);
> > +       return ret;
> > +}
> > +
> >  static bool is_kfunc_arg_callback(struct bpf_verifier_env *env, const struct btf *btf,
> >                                   const struct btf_param *arg)
> >  {
> > @@ -10946,6 +10954,7 @@ enum kfunc_ptr_arg_type {
> >         KF_ARG_PTR_TO_NULL,
> >         KF_ARG_PTR_TO_CONST_STR,
> >         KF_ARG_PTR_TO_MAP,
> > +       KF_ARG_PTR_TO_TIMER,
> >  };
> >
> >  enum special_kfunc_type {
> > @@ -11102,6 +11111,9 @@ get_kfunc_ptr_arg_type(struct bpf_verifier_env *env,
> >         if (is_kfunc_arg_map(meta->btf, &args[argno]))
> >                 return KF_ARG_PTR_TO_MAP;
> >
> > +       if (is_kfunc_arg_timer(meta->btf, &args[argno]))
> > +               return KF_ARG_PTR_TO_TIMER;
> > +
> >         if ((base_type(reg->type) == PTR_TO_BTF_ID || reg2btf_ids[base_type(reg->type)])) {
> >                 if (!btf_type_is_struct(ref_t)) {
> >                         verbose(env, "kernel function %s args#%d pointer type %s %s is not supported\n",
> > @@ -11735,6 +11747,7 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_
> >                 case KF_ARG_PTR_TO_CALLBACK:
> >                 case KF_ARG_PTR_TO_REFCOUNTED_KPTR:
> >                 case KF_ARG_PTR_TO_CONST_STR:
> > +               case KF_ARG_PTR_TO_TIMER:
> >                         /* Trusted by default */
> >                         break;
> >                 default:
> > @@ -12021,6 +12034,16 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_
> >                         if (ret)
> >                                 return ret;
> >                         break;
> > +               case KF_ARG_PTR_TO_TIMER:
> > +                       if (reg->type != PTR_TO_MAP_VALUE) {
> > +                               verbose(env, "arg#%d doesn't point to a map value\n", i);
> > +                               return -EINVAL;
> > +                       }
> > +                       if (reg->off) {
> > +                               verbose(env, "arg#%d offset can not be greater than 0\n", i);
> > +                               return -EINVAL;
> > +                       }
>
> This won't be correct. You don't really check whether the timer exists
> at reg->off (and if you did, this would still restrict it to 0 offset,
> and not check the variable offset which would be non-zero). What I
> would suggest is calling process_timer_func (see how dynptr calls the
> same underlying process_dynptr_func to enforce type invariants). This
> would allow sharing the same checks and avoid bugs from creeping in.
> It does all checks wrt constant/variable offset and looking up the
> timer field offset and matching it against the one in the pointer.

Observation is correct. The patch is buggy,
but the suggestion to follow process_dynptr_func() will lead
to unnecessary complexity.
dynptr-s are on stack with plenty of extra checks.
In this case bpf_timer is in map_value.
Much simpler is to follow KF_ARG_PTR_TO_MAP approach.
Set ref_id, ref_t, ref_tname to bpf_timer and
process_kf_arg_ptr_to_btf_id() should work as-is.

You still need
+BTF_ID(struct, bpf_timer_kern)
to recognize that argument in a kfunc,
but the selftests will be using 'struct bpf_timer t',
so KF_ARG_PTR_TO_TIMER would need to match against 'struct bpf_timer'
and not against 'struct bpf_timer_kern'.
Kumar Kartikeya Dwivedi March 24, 2024, 4 a.m. UTC | #3 
On Sun, 24 Mar 2024 at 04:53, Alexei Starovoitov
<alexei.starovoitov@gmail.com> wrote:
>
> On Fri, Mar 22, 2024 at 9:31 AM Kumar Kartikeya Dwivedi
> <memxor@gmail.com> wrote:
> >
> > On Fri, 22 Mar 2024 at 15:57, Benjamin Tissoires <bentiss@kernel.org> wrote:
> > >
> > > We need to extend the bpf_timer API, but the way forward relies on kfuncs.
> > > So make bpf_timer known for kfuncs from the verifier PoV
> > >
> > > Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
> > >
> > > ---
> > >
> > > changes in v5:
> > > - also check for the reg offset
> > >
> > > changes in v4:
> > > - enforce KF_ARG_PTR_TO_TIMER to be of type PTR_TO_MAP_VALUE
> > >
> > > new in v3 (split from v2 02/10)
> > > ---
> > >  kernel/bpf/verifier.c | 23 +++++++++++++++++++++++
> > >  1 file changed, 23 insertions(+)
> > >
> > > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> > > index 63749ad5ac6b..24a604e26ec7 100644
> > > --- a/kernel/bpf/verifier.c
> > > +++ b/kernel/bpf/verifier.c
> > > @@ -10826,6 +10826,7 @@ enum {
> > >         KF_ARG_LIST_NODE_ID,
> > >         KF_ARG_RB_ROOT_ID,
> > >         KF_ARG_RB_NODE_ID,
> > > +       KF_ARG_TIMER_ID,
> > >  };
> > >
> > >  BTF_ID_LIST(kf_arg_btf_ids)
> > > @@ -10834,6 +10835,7 @@ BTF_ID(struct, bpf_list_head)
> > >  BTF_ID(struct, bpf_list_node)
> > >  BTF_ID(struct, bpf_rb_root)
> > >  BTF_ID(struct, bpf_rb_node)
> > > +BTF_ID(struct, bpf_timer_kern)
> > >
> > >  static bool __is_kfunc_ptr_arg_type(const struct btf *btf,
> > >                                     const struct btf_param *arg, int type)
> > > @@ -10877,6 +10879,12 @@ static bool is_kfunc_arg_rbtree_node(const struct btf *btf, const struct btf_par
> > >         return __is_kfunc_ptr_arg_type(btf, arg, KF_ARG_RB_NODE_ID);
> > >  }
> > >
> > > +static bool is_kfunc_arg_timer(const struct btf *btf, const struct btf_param *arg)
> > > +{
> > > +       bool ret = __is_kfunc_ptr_arg_type(btf, arg, KF_ARG_TIMER_ID);
> > > +       return ret;
> > > +}
> > > +
> > >  static bool is_kfunc_arg_callback(struct bpf_verifier_env *env, const struct btf *btf,
> > >                                   const struct btf_param *arg)
> > >  {
> > > @@ -10946,6 +10954,7 @@ enum kfunc_ptr_arg_type {
> > >         KF_ARG_PTR_TO_NULL,
> > >         KF_ARG_PTR_TO_CONST_STR,
> > >         KF_ARG_PTR_TO_MAP,
> > > +       KF_ARG_PTR_TO_TIMER,
> > >  };
> > >
> > >  enum special_kfunc_type {
> > > @@ -11102,6 +11111,9 @@ get_kfunc_ptr_arg_type(struct bpf_verifier_env *env,
> > >         if (is_kfunc_arg_map(meta->btf, &args[argno]))
> > >                 return KF_ARG_PTR_TO_MAP;
> > >
> > > +       if (is_kfunc_arg_timer(meta->btf, &args[argno]))
> > > +               return KF_ARG_PTR_TO_TIMER;
> > > +
> > >         if ((base_type(reg->type) == PTR_TO_BTF_ID || reg2btf_ids[base_type(reg->type)])) {
> > >                 if (!btf_type_is_struct(ref_t)) {
> > >                         verbose(env, "kernel function %s args#%d pointer type %s %s is not supported\n",
> > > @@ -11735,6 +11747,7 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_
> > >                 case KF_ARG_PTR_TO_CALLBACK:
> > >                 case KF_ARG_PTR_TO_REFCOUNTED_KPTR:
> > >                 case KF_ARG_PTR_TO_CONST_STR:
> > > +               case KF_ARG_PTR_TO_TIMER:
> > >                         /* Trusted by default */
> > >                         break;
> > >                 default:
> > > @@ -12021,6 +12034,16 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_
> > >                         if (ret)
> > >                                 return ret;
> > >                         break;
> > > +               case KF_ARG_PTR_TO_TIMER:
> > > +                       if (reg->type != PTR_TO_MAP_VALUE) {
> > > +                               verbose(env, "arg#%d doesn't point to a map value\n", i);
> > > +                               return -EINVAL;
> > > +                       }
> > > +                       if (reg->off) {
> > > +                               verbose(env, "arg#%d offset can not be greater than 0\n", i);
> > > +                               return -EINVAL;
> > > +                       }
> >
> > This won't be correct. You don't really check whether the timer exists
> > at reg->off (and if you did, this would still restrict it to 0 offset,
> > and not check the variable offset which would be non-zero). What I
> > would suggest is calling process_timer_func (see how dynptr calls the
> > same underlying process_dynptr_func to enforce type invariants). This
> > would allow sharing the same checks and avoid bugs from creeping in.
> > It does all checks wrt constant/variable offset and looking up the
> > timer field offset and matching it against the one in the pointer.
>
> Observation is correct. The patch is buggy,
> but the suggestion to follow process_dynptr_func() will lead
> to unnecessary complexity.
> dynptr-s are on stack with plenty of extra checks.

The suggestion was to call process_timer_func, not process_dynptr_func.

> In this case bpf_timer is in map_value.
> Much simpler is to follow KF_ARG_PTR_TO_MAP approach.

What I meant by the example was that dynptr handling does the same
thing for kfuncs and helpers (using the same function), so timer
arguments should do the same (i.e. use process_timer_func), which will
do all checks for constant offset (ensuring var_off is tnum_is_const)
and match it against btf_record->timer_off.

> [...]
Alexei Starovoitov March 24, 2024, 4:37 a.m. UTC | #4 
On Sat, Mar 23, 2024 at 9:01 PM Kumar Kartikeya Dwivedi
<memxor@gmail.com> wrote:
>
> On Sun, 24 Mar 2024 at 04:53, Alexei Starovoitov
> <alexei.starovoitov@gmail.com> wrote:
> >
> > On Fri, Mar 22, 2024 at 9:31 AM Kumar Kartikeya Dwivedi
> > <memxor@gmail.com> wrote:
> > >
> > > On Fri, 22 Mar 2024 at 15:57, Benjamin Tissoires <bentiss@kernel.org> wrote:
> > > >
> > > > We need to extend the bpf_timer API, but the way forward relies on kfuncs.
> > > > So make bpf_timer known for kfuncs from the verifier PoV
> > > >
> > > > Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
> > > >
> > > > ---
> > > >
> > > > changes in v5:
> > > > - also check for the reg offset
> > > >
> > > > changes in v4:
> > > > - enforce KF_ARG_PTR_TO_TIMER to be of type PTR_TO_MAP_VALUE
> > > >
> > > > new in v3 (split from v2 02/10)
> > > > ---
> > > >  kernel/bpf/verifier.c | 23 +++++++++++++++++++++++
> > > >  1 file changed, 23 insertions(+)
> > > >
> > > > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> > > > index 63749ad5ac6b..24a604e26ec7 100644
> > > > --- a/kernel/bpf/verifier.c
> > > > +++ b/kernel/bpf/verifier.c
> > > > @@ -10826,6 +10826,7 @@ enum {
> > > >         KF_ARG_LIST_NODE_ID,
> > > >         KF_ARG_RB_ROOT_ID,
> > > >         KF_ARG_RB_NODE_ID,
> > > > +       KF_ARG_TIMER_ID,
> > > >  };
> > > >
> > > >  BTF_ID_LIST(kf_arg_btf_ids)
> > > > @@ -10834,6 +10835,7 @@ BTF_ID(struct, bpf_list_head)
> > > >  BTF_ID(struct, bpf_list_node)
> > > >  BTF_ID(struct, bpf_rb_root)
> > > >  BTF_ID(struct, bpf_rb_node)
> > > > +BTF_ID(struct, bpf_timer_kern)
> > > >
> > > >  static bool __is_kfunc_ptr_arg_type(const struct btf *btf,
> > > >                                     const struct btf_param *arg, int type)
> > > > @@ -10877,6 +10879,12 @@ static bool is_kfunc_arg_rbtree_node(const struct btf *btf, const struct btf_par
> > > >         return __is_kfunc_ptr_arg_type(btf, arg, KF_ARG_RB_NODE_ID);
> > > >  }
> > > >
> > > > +static bool is_kfunc_arg_timer(const struct btf *btf, const struct btf_param *arg)
> > > > +{
> > > > +       bool ret = __is_kfunc_ptr_arg_type(btf, arg, KF_ARG_TIMER_ID);
> > > > +       return ret;
> > > > +}
> > > > +
> > > >  static bool is_kfunc_arg_callback(struct bpf_verifier_env *env, const struct btf *btf,
> > > >                                   const struct btf_param *arg)
> > > >  {
> > > > @@ -10946,6 +10954,7 @@ enum kfunc_ptr_arg_type {
> > > >         KF_ARG_PTR_TO_NULL,
> > > >         KF_ARG_PTR_TO_CONST_STR,
> > > >         KF_ARG_PTR_TO_MAP,
> > > > +       KF_ARG_PTR_TO_TIMER,
> > > >  };
> > > >
> > > >  enum special_kfunc_type {
> > > > @@ -11102,6 +11111,9 @@ get_kfunc_ptr_arg_type(struct bpf_verifier_env *env,
> > > >         if (is_kfunc_arg_map(meta->btf, &args[argno]))
> > > >                 return KF_ARG_PTR_TO_MAP;
> > > >
> > > > +       if (is_kfunc_arg_timer(meta->btf, &args[argno]))
> > > > +               return KF_ARG_PTR_TO_TIMER;
> > > > +
> > > >         if ((base_type(reg->type) == PTR_TO_BTF_ID || reg2btf_ids[base_type(reg->type)])) {
> > > >                 if (!btf_type_is_struct(ref_t)) {
> > > >                         verbose(env, "kernel function %s args#%d pointer type %s %s is not supported\n",
> > > > @@ -11735,6 +11747,7 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_
> > > >                 case KF_ARG_PTR_TO_CALLBACK:
> > > >                 case KF_ARG_PTR_TO_REFCOUNTED_KPTR:
> > > >                 case KF_ARG_PTR_TO_CONST_STR:
> > > > +               case KF_ARG_PTR_TO_TIMER:
> > > >                         /* Trusted by default */
> > > >                         break;
> > > >                 default:
> > > > @@ -12021,6 +12034,16 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_
> > > >                         if (ret)
> > > >                                 return ret;
> > > >                         break;
> > > > +               case KF_ARG_PTR_TO_TIMER:
> > > > +                       if (reg->type != PTR_TO_MAP_VALUE) {
> > > > +                               verbose(env, "arg#%d doesn't point to a map value\n", i);
> > > > +                               return -EINVAL;
> > > > +                       }
> > > > +                       if (reg->off) {
> > > > +                               verbose(env, "arg#%d offset can not be greater than 0\n", i);
> > > > +                               return -EINVAL;
> > > > +                       }
> > >
> > > This won't be correct. You don't really check whether the timer exists
> > > at reg->off (and if you did, this would still restrict it to 0 offset,
> > > and not check the variable offset which would be non-zero). What I
> > > would suggest is calling process_timer_func (see how dynptr calls the
> > > same underlying process_dynptr_func to enforce type invariants). This
> > > would allow sharing the same checks and avoid bugs from creeping in.
> > > It does all checks wrt constant/variable offset and looking up the
> > > timer field offset and matching it against the one in the pointer.
> >
> > Observation is correct. The patch is buggy,
> > but the suggestion to follow process_dynptr_func() will lead
> > to unnecessary complexity.
> > dynptr-s are on stack with plenty of extra checks.
>
> The suggestion was to call process_timer_func, not process_dynptr_func.
>
> > In this case bpf_timer is in map_value.
> > Much simpler is to follow KF_ARG_PTR_TO_MAP approach.
>
> What I meant by the example was that dynptr handling does the same
> thing for kfuncs and helpers (using the same function), so timer
> arguments should do the same (i.e. use process_timer_func), which will
> do all checks for constant offset (ensuring var_off is tnum_is_const)
> and match it against btf_record->timer_off.

I don't follow. Please elaborate with a patch.
The var_off and off is a part of the bug, but it's not the biggest part of it.
Kumar Kartikeya Dwivedi March 24, 2024, 4:56 a.m. UTC | #5 
On Sun, 24 Mar 2024 at 05:38, Alexei Starovoitov
<alexei.starovoitov@gmail.com> wrote:
>
> On Sat, Mar 23, 2024 at 9:01 PM Kumar Kartikeya Dwivedi
> <memxor@gmail.com> wrote:
> >
> > On Sun, 24 Mar 2024 at 04:53, Alexei Starovoitov
> > <alexei.starovoitov@gmail.com> wrote:
> > >
> > > On Fri, Mar 22, 2024 at 9:31 AM Kumar Kartikeya Dwivedi
> > > <memxor@gmail.com> wrote:
> > > >
> > > > On Fri, 22 Mar 2024 at 15:57, Benjamin Tissoires <bentiss@kernel.org> wrote:
> > > > >
> > > > > We need to extend the bpf_timer API, but the way forward relies on kfuncs.
> > > > > So make bpf_timer known for kfuncs from the verifier PoV
> > > > >
> > > > > Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
> > > > >
> > > > > ---
> > > > >
> > > > > changes in v5:
> > > > > - also check for the reg offset
> > > > >
> > > > > changes in v4:
> > > > > - enforce KF_ARG_PTR_TO_TIMER to be of type PTR_TO_MAP_VALUE
> > > > >
> > > > > new in v3 (split from v2 02/10)
> > > > > ---
> > > > >  kernel/bpf/verifier.c | 23 +++++++++++++++++++++++
> > > > >  1 file changed, 23 insertions(+)
> > > > >
> > > > > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> > > > > index 63749ad5ac6b..24a604e26ec7 100644
> > > > > --- a/kernel/bpf/verifier.c
> > > > > +++ b/kernel/bpf/verifier.c
> > > > > @@ -10826,6 +10826,7 @@ enum {
> > > > >         KF_ARG_LIST_NODE_ID,
> > > > >         KF_ARG_RB_ROOT_ID,
> > > > >         KF_ARG_RB_NODE_ID,
> > > > > +       KF_ARG_TIMER_ID,
> > > > >  };
> > > > >
> > > > >  BTF_ID_LIST(kf_arg_btf_ids)
> > > > > @@ -10834,6 +10835,7 @@ BTF_ID(struct, bpf_list_head)
> > > > >  BTF_ID(struct, bpf_list_node)
> > > > >  BTF_ID(struct, bpf_rb_root)
> > > > >  BTF_ID(struct, bpf_rb_node)
> > > > > +BTF_ID(struct, bpf_timer_kern)
> > > > >
> > > > >  static bool __is_kfunc_ptr_arg_type(const struct btf *btf,
> > > > >                                     const struct btf_param *arg, int type)
> > > > > @@ -10877,6 +10879,12 @@ static bool is_kfunc_arg_rbtree_node(const struct btf *btf, const struct btf_par
> > > > >         return __is_kfunc_ptr_arg_type(btf, arg, KF_ARG_RB_NODE_ID);
> > > > >  }
> > > > >
> > > > > +static bool is_kfunc_arg_timer(const struct btf *btf, const struct btf_param *arg)
> > > > > +{
> > > > > +       bool ret = __is_kfunc_ptr_arg_type(btf, arg, KF_ARG_TIMER_ID);
> > > > > +       return ret;
> > > > > +}
> > > > > +
> > > > >  static bool is_kfunc_arg_callback(struct bpf_verifier_env *env, const struct btf *btf,
> > > > >                                   const struct btf_param *arg)
> > > > >  {
> > > > > @@ -10946,6 +10954,7 @@ enum kfunc_ptr_arg_type {
> > > > >         KF_ARG_PTR_TO_NULL,
> > > > >         KF_ARG_PTR_TO_CONST_STR,
> > > > >         KF_ARG_PTR_TO_MAP,
> > > > > +       KF_ARG_PTR_TO_TIMER,
> > > > >  };
> > > > >
> > > > >  enum special_kfunc_type {
> > > > > @@ -11102,6 +11111,9 @@ get_kfunc_ptr_arg_type(struct bpf_verifier_env *env,
> > > > >         if (is_kfunc_arg_map(meta->btf, &args[argno]))
> > > > >                 return KF_ARG_PTR_TO_MAP;
> > > > >
> > > > > +       if (is_kfunc_arg_timer(meta->btf, &args[argno]))
> > > > > +               return KF_ARG_PTR_TO_TIMER;
> > > > > +
> > > > >         if ((base_type(reg->type) == PTR_TO_BTF_ID || reg2btf_ids[base_type(reg->type)])) {
> > > > >                 if (!btf_type_is_struct(ref_t)) {
> > > > >                         verbose(env, "kernel function %s args#%d pointer type %s %s is not supported\n",
> > > > > @@ -11735,6 +11747,7 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_
> > > > >                 case KF_ARG_PTR_TO_CALLBACK:
> > > > >                 case KF_ARG_PTR_TO_REFCOUNTED_KPTR:
> > > > >                 case KF_ARG_PTR_TO_CONST_STR:
> > > > > +               case KF_ARG_PTR_TO_TIMER:
> > > > >                         /* Trusted by default */
> > > > >                         break;
> > > > >                 default:
> > > > > @@ -12021,6 +12034,16 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_
> > > > >                         if (ret)
> > > > >                                 return ret;
> > > > >                         break;
> > > > > +               case KF_ARG_PTR_TO_TIMER:
> > > > > +                       if (reg->type != PTR_TO_MAP_VALUE) {
> > > > > +                               verbose(env, "arg#%d doesn't point to a map value\n", i);
> > > > > +                               return -EINVAL;
> > > > > +                       }
> > > > > +                       if (reg->off) {
> > > > > +                               verbose(env, "arg#%d offset can not be greater than 0\n", i);
> > > > > +                               return -EINVAL;
> > > > > +                       }
> > > >
> > > > This won't be correct. You don't really check whether the timer exists
> > > > at reg->off (and if you did, this would still restrict it to 0 offset,
> > > > and not check the variable offset which would be non-zero). What I
> > > > would suggest is calling process_timer_func (see how dynptr calls the
> > > > same underlying process_dynptr_func to enforce type invariants). This
> > > > would allow sharing the same checks and avoid bugs from creeping in.
> > > > It does all checks wrt constant/variable offset and looking up the
> > > > timer field offset and matching it against the one in the pointer.
> > >
> > > Observation is correct. The patch is buggy,
> > > but the suggestion to follow process_dynptr_func() will lead
> > > to unnecessary complexity.
> > > dynptr-s are on stack with plenty of extra checks.
> >
> > The suggestion was to call process_timer_func, not process_dynptr_func.
> >
> > > In this case bpf_timer is in map_value.
> > > Much simpler is to follow KF_ARG_PTR_TO_MAP approach.
> >
> > What I meant by the example was that dynptr handling does the same
> > thing for kfuncs and helpers (using the same function), so timer
> > arguments should do the same (i.e. use process_timer_func), which will
> > do all checks for constant offset (ensuring var_off is tnum_is_const)
> > and match it against btf_record->timer_off.
>
> I don't follow. Please elaborate with a patch.
> The var_off and off is a part of the bug, but it's not the biggest part of it.

Not compile tested.
Alexei Starovoitov March 24, 2024, 10:13 p.m. UTC | #6 
On Sat, Mar 23, 2024 at 9:57 PM Kumar Kartikeya Dwivedi
<memxor@gmail.com> wrote:

> > > >
> > > > Observation is correct. The patch is buggy,
> > > > but the suggestion to follow process_dynptr_func() will lead
> > > > to unnecessary complexity.
> > > > dynptr-s are on stack with plenty of extra checks.
> > >
> > > The suggestion was to call process_timer_func, not process_dynptr_func.
> > >
> > > > In this case bpf_timer is in map_value.
> > > > Much simpler is to follow KF_ARG_PTR_TO_MAP approach.
> > >
> > > What I meant by the example was that dynptr handling does the same
> > > thing for kfuncs and helpers (using the same function), so timer
> > > arguments should do the same (i.e. use process_timer_func), which will
> > > do all checks for constant offset (ensuring var_off is tnum_is_const)
> > > and match it against btf_record->timer_off.
> >
> > I don't follow. Please elaborate with a patch.
> > The var_off and off is a part of the bug, but it's not the biggest part of it.
>
> Not compile tested.

I see. All makes sense to me.

Benjamin,
pls incorporate it in your set.
Benjamin Tissoires March 25, 2024, 8:42 a.m. UTC | #7 
On Mar 24 2024, Alexei Starovoitov wrote:
> On Sat, Mar 23, 2024 at 9:57 PM Kumar Kartikeya Dwivedi
> <memxor@gmail.com> wrote:
> 
> > > > >
> > > > > Observation is correct. The patch is buggy,
> > > > > but the suggestion to follow process_dynptr_func() will lead
> > > > > to unnecessary complexity.
> > > > > dynptr-s are on stack with plenty of extra checks.
> > > >
> > > > The suggestion was to call process_timer_func, not process_dynptr_func.
> > > >
> > > > > In this case bpf_timer is in map_value.
> > > > > Much simpler is to follow KF_ARG_PTR_TO_MAP approach.
> > > >
> > > > What I meant by the example was that dynptr handling does the same
> > > > thing for kfuncs and helpers (using the same function), so timer
> > > > arguments should do the same (i.e. use process_timer_func), which will
> > > > do all checks for constant offset (ensuring var_off is tnum_is_const)
> > > > and match it against btf_record->timer_off.
> > >
> > > I don't follow. Please elaborate with a patch.
> > > The var_off and off is a part of the bug, but it's not the biggest part of it.
> >
> > Not compile tested.

Compiles just fine :)

> 
> I see. All makes sense to me.
> 
> Benjamin,
> pls incorporate it in your set.
> 

OK, done!

I just had to revert to the following or KF_ARG_TIMER_ID was not
recognized by the verifier:

---
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 7ee20e9d14bd..a5e147468ac8 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -10848,7 +10848,7 @@ BTF_ID(struct, bpf_list_head)
 BTF_ID(struct, bpf_list_node)
 BTF_ID(struct, bpf_rb_root)
 BTF_ID(struct, bpf_rb_node)
-BTF_ID(struct, bpf_timer)
+BTF_ID(struct, bpf_timer_kern)
 
 static bool __is_kfunc_ptr_arg_type(const struct btf *btf,
 				    const struct btf_param *arg, int type)
---

Cheers,
Benjamin
diff mbox series

Patch

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 63749ad5ac6b..24a604e26ec7 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -10826,6 +10826,7 @@  enum {
 	KF_ARG_LIST_NODE_ID,
 	KF_ARG_RB_ROOT_ID,
 	KF_ARG_RB_NODE_ID,
+	KF_ARG_TIMER_ID,
 };
 
 BTF_ID_LIST(kf_arg_btf_ids)
@@ -10834,6 +10835,7 @@  BTF_ID(struct, bpf_list_head)
 BTF_ID(struct, bpf_list_node)
 BTF_ID(struct, bpf_rb_root)
 BTF_ID(struct, bpf_rb_node)
+BTF_ID(struct, bpf_timer_kern)
 
 static bool __is_kfunc_ptr_arg_type(const struct btf *btf,
 				    const struct btf_param *arg, int type)
@@ -10877,6 +10879,12 @@  static bool is_kfunc_arg_rbtree_node(const struct btf *btf, const struct btf_par
 	return __is_kfunc_ptr_arg_type(btf, arg, KF_ARG_RB_NODE_ID);
 }
 
+static bool is_kfunc_arg_timer(const struct btf *btf, const struct btf_param *arg)
+{
+	bool ret = __is_kfunc_ptr_arg_type(btf, arg, KF_ARG_TIMER_ID);
+	return ret;
+}
+
 static bool is_kfunc_arg_callback(struct bpf_verifier_env *env, const struct btf *btf,
 				  const struct btf_param *arg)
 {
@@ -10946,6 +10954,7 @@  enum kfunc_ptr_arg_type {
 	KF_ARG_PTR_TO_NULL,
 	KF_ARG_PTR_TO_CONST_STR,
 	KF_ARG_PTR_TO_MAP,
+	KF_ARG_PTR_TO_TIMER,
 };
 
 enum special_kfunc_type {
@@ -11102,6 +11111,9 @@  get_kfunc_ptr_arg_type(struct bpf_verifier_env *env,
 	if (is_kfunc_arg_map(meta->btf, &args[argno]))
 		return KF_ARG_PTR_TO_MAP;
 
+	if (is_kfunc_arg_timer(meta->btf, &args[argno]))
+		return KF_ARG_PTR_TO_TIMER;
+
 	if ((base_type(reg->type) == PTR_TO_BTF_ID || reg2btf_ids[base_type(reg->type)])) {
 		if (!btf_type_is_struct(ref_t)) {
 			verbose(env, "kernel function %s args#%d pointer type %s %s is not supported\n",
@@ -11735,6 +11747,7 @@  static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_
 		case KF_ARG_PTR_TO_CALLBACK:
 		case KF_ARG_PTR_TO_REFCOUNTED_KPTR:
 		case KF_ARG_PTR_TO_CONST_STR:
+		case KF_ARG_PTR_TO_TIMER:
 			/* Trusted by default */
 			break;
 		default:
@@ -12021,6 +12034,16 @@  static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_
 			if (ret)
 				return ret;
 			break;
+		case KF_ARG_PTR_TO_TIMER:
+			if (reg->type != PTR_TO_MAP_VALUE) {
+				verbose(env, "arg#%d doesn't point to a map value\n", i);
+				return -EINVAL;
+			}
+			if (reg->off) {
+				verbose(env, "arg#%d offset can not be greater than 0\n", i);
+				return -EINVAL;
+			}
+			break;
 		}
 	}