netdev - Re: [PATCH v2 bpf-next 3/7] bpf: track reference type in verifier

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 21 May 2020 18:13:35 -0700
From:   Alexei Starovoitov <alexei.starovoitov@...il.com>
To:     Andrii Nakryiko <andriin@...com>
Cc:     bpf@...r.kernel.org, netdev@...r.kernel.org, ast@...com,
        daniel@...earbox.net, andrii.nakryiko@...il.com,
        kernel-team@...com, "Paul E . McKenney" <paulmck@...nel.org>,
        Jonathan Lemon <jonathan.lemon@...il.com>
Subject: Re: [PATCH v2 bpf-next 3/7] bpf: track reference type in verifier

On Sun, May 17, 2020 at 12:57:23PM -0700, Andrii Nakryiko wrote:
>  
> +static enum bpf_ref_type get_release_ref_type(enum bpf_func_id func_id)
> +{
> +	switch (func_id) {
> +	case BPF_FUNC_sk_release:
> +		return BPF_REF_SOCKET;
> +	case BPF_FUNC_ringbuf_submit:
> +	case BPF_FUNC_ringbuf_discard:
> +		return BPF_REF_RINGBUF;
> +	default:
> +		return BPF_REF_INVALID;
> +	}
> +}
> +
>  static bool may_be_acquire_function(enum bpf_func_id func_id)
>  {
>  	return func_id == BPF_FUNC_sk_lookup_tcp ||
> @@ -464,6 +477,28 @@ static bool is_acquire_function(enum bpf_func_id func_id,
>  	return false;
>  }
>  
> +static enum bpf_ref_type get_acquire_ref_type(enum bpf_func_id func_id,
> +					      const struct bpf_map *map)
> +{
> +	enum bpf_map_type map_type = map ? map->map_type : BPF_MAP_TYPE_UNSPEC;
> +
> +	switch (func_id) {
> +	case BPF_FUNC_sk_lookup_tcp:
> +	case BPF_FUNC_sk_lookup_udp:
> +	case BPF_FUNC_skc_lookup_tcp:
> +		return BPF_REF_SOCKET;
> +	case BPF_FUNC_map_lookup_elem:
> +		if (map_type == BPF_MAP_TYPE_SOCKMAP ||
> +		    map_type == BPF_MAP_TYPE_SOCKHASH)
> +			return BPF_REF_SOCKET;
> +		return BPF_REF_INVALID;
> +	case BPF_FUNC_ringbuf_reserve:
> +		return BPF_REF_RINGBUF;
> +	default:
> +		return BPF_REF_INVALID;
> +	}
> +}

Two switch() stmts to convert helpers to REF is kinda hacky.
I think get_release_ref_type() could have got the ref's type as btf_id from its
arguments which would have made it truly generic and 'enum bpf_ref_type' would
be unnecessary, but sk_lookup_* helpers return u64 and don't have btf_id of
return value. I think we better fix that. Then btf_id would be that ref type.