Dave Marchevsky 47e34cb74d bpf: Add verifier check for BPF_PTR_POISON retval and arg
BPF_PTR_POISON was added in commit c0a5a21c25f37 ("bpf: Allow storing
referenced kptr in map") to denote a bpf_func_proto btf_id which the
verifier will replace with a dynamically-determined btf_id at verification
time.

This patch adds verifier 'poison' functionality to BPF_PTR_POISON in
order to prepare for expanded use of the value to poison ret- and
arg-btf_id in ongoing work, namely rbtree and linked list patchsets
[0, 1]. Specifically, when the verifier checks helper calls, it assumes
that BPF_PTR_POISON'ed ret type will be replaced with a valid type before
- or in lieu of - the default ret_btf_id logic. Similarly for arg btf_id.

If poisoned btf_id reaches default handling block for either, consider
this a verifier internal error and fail verification. Otherwise a helper
w/ poisoned btf_id but no verifier logic replacing the type will cause a
crash as the invalid pointer is dereferenced.

Also move BPF_PTR_POISON to existing include/linux/posion.h header and
remove unnecessary shift.

  [0]: lore.kernel.org/bpf/20220830172759.4069786-1-davemarchevsky@fb.com
  [1]: lore.kernel.org/bpf/20220904204145.3089-1-memxor@gmail.com

Signed-off-by: Dave Marchevsky <davemarchevsky@fb.com>
Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/r/20220912154544.1398199-1-davemarchevsky@fb.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2022-09-15 02:44:07 -07:00
..
2022-08-14 09:28:54 -07:00
2022-05-26 17:13:43 -07:00
2022-08-08 15:16:29 -07:00
2022-05-25 16:18:27 -07:00
2021-12-02 17:25:21 +09:00
2022-07-28 12:36:35 +02:00
2022-06-02 08:55:01 -07:00
2022-01-11 13:08:21 -08:00
2021-09-08 15:32:35 -07:00
2022-05-23 17:51:12 -07:00
2022-03-15 10:32:44 +01:00
2022-08-05 09:41:12 -07:00
2021-09-08 15:32:34 -07:00
2022-08-02 19:34:45 -07:00
2021-10-14 13:29:18 +02:00
2022-02-25 09:36:06 +01:00
2022-08-06 16:38:17 -07:00
2022-08-03 19:52:08 -07:00