by Daniel Xu

[permalink] [raw]

Subject: Re: [PATCH bpf-next v4 08/12] bpf: verifier: Relax caller requirements for kfunc projection type args

On Mon, Jun 10, 2024 at 11:30:31AM GMT, Alexei Starovoitov wrote:
> On Sat, Jun 8, 2024 at 2:16 PM Daniel Xu <[email protected]> wrote:
> >
> > Currently, if a kfunc accepts a projection type as an argument (eg
> > struct __sk_buff *), the caller must exactly provide exactly the same
> > type with provable provenance.
> >
> > However in practice, kfuncs that accept projection types _must_ cast to
> > the underlying type before use b/c projection type layouts are
> > completely made up. Thus, it is ok to relax the verifier rules around
> > implicit conversions.
> >
> > We will use this functionality in the next commit when we align kfuncs
> > to user-facing types.
> >
> > Signed-off-by: Daniel Xu <[email protected]>
> > ---
> > kernel/bpf/verifier.c | 10 +++++++++-
> > 1 file changed, 9 insertions(+), 1 deletion(-)
> >
> > diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
> > index 81a3d2ced78d..0808beca3837 100644
> > --- a/kernel/bpf/verifier.c
> > +++ b/kernel/bpf/verifier.c
> > @@ -11257,6 +11257,8 @@ static int process_kf_arg_ptr_to_btf_id(struct bpf_verifier_env *env,
> > bool strict_type_match = false;
> > const struct btf *reg_btf;
> > const char *reg_ref_tname;
> > + bool taking_projection;
> > + bool struct_same;
> > u32 reg_ref_id;
> >
> > if (base_type(reg->type) == PTR_TO_BTF_ID) {
> > @@ -11300,7 +11302,13 @@ static int process_kf_arg_ptr_to_btf_id(struct bpf_verifier_env *env,
> >
> > reg_ref_t = btf_type_skip_modifiers(reg_btf, reg_ref_id, &reg_ref_id);
> > reg_ref_tname = btf_name_by_offset(reg_btf, reg_ref_t->name_off);
> > - if (!btf_struct_ids_match(&env->log, reg_btf, reg_ref_id, reg->off, meta->btf, ref_id, strict_type_match)) {
> > + struct_same = btf_struct_ids_match(&env->log, reg_btf, reg_ref_id, reg->off, meta->btf, ref_id, strict_type_match);
> > + /* If kfunc is accepting a projection type (ie. __sk_buff), it cannot
> > + * actually use it -- it must cast to the underlying type. So we allow
> > + * caller to pass in the underlying type.
> > + */
> > + taking_projection = !strcmp(ref_tname, "__sk_buff") && !strcmp(reg_ref_tname, "sk_buff");
>
> xdp_md/buff probably as well?
>
> And with that share the code with btf_is_prog_ctx_type() ?

Ack - will do.

2024-06-12 12:43:22

by Jiri Olsa

[permalink] [raw]

Subject: Re: [PATCH bpf-next v4 03/12] bpf: selftests: Fix fentry test kfunc prototypes

On Tue, Jun 11, 2024 at 10:58:26AM -0600, Daniel Xu wrote:
> On Mon, Jun 10, 2024 at 03:28:36PM GMT, Jiri Olsa wrote:
> > On Sat, Jun 08, 2024 at 03:15:59PM -0600, Daniel Xu wrote:
> > > The prototypes in progs/get_func_ip_test.c were not in line with how the
> > > actual kfuncs are defined in net/bpf/test_run.c. This causes compilation
> > > errors when kfunc prototypes are generated from BTF.
> > >
> > > Fix by aligning with actual kfunc definitions.
> > >
> > > Signed-off-by: Daniel Xu <[email protected]>
> > > ---
> > > .../testing/selftests/bpf/progs/get_func_ip_test.c | 14 +++++++-------
> > > 1 file changed, 7 insertions(+), 7 deletions(-)
> > >
> > > diff --git a/tools/testing/selftests/bpf/progs/get_func_ip_test.c b/tools/testing/selftests/bpf/progs/get_func_ip_test.c
> > > index 8956eb78a226..a89596f7585d 100644
> > > --- a/tools/testing/selftests/bpf/progs/get_func_ip_test.c
> > > +++ b/tools/testing/selftests/bpf/progs/get_func_ip_test.c
> > > @@ -5,13 +5,13 @@
> > >
> > > char _license[] SEC("license") = "GPL";
> > >
> > > -extern const void bpf_fentry_test1 __ksym;
> > > -extern const void bpf_fentry_test2 __ksym;
> > > -extern const void bpf_fentry_test3 __ksym;
> > > -extern const void bpf_fentry_test4 __ksym;
> > > -extern const void bpf_modify_return_test __ksym;
> > > -extern const void bpf_fentry_test6 __ksym;
> > > -extern const void bpf_fentry_test7 __ksym;
> > > +extern int bpf_fentry_test1(int a) __ksym;
> >
> > hum, the only registered one as kfunc is bpf_fentry_test1, to allow fmodret
> > also there's bpf_fentry_test9 as kfunc, which AFAICS is not really needed
>
> I think bpf_modify_return_test() is also registered. But otherwise yeah,
> I think I was overaggressive here. Are you thinking something like this?

yes, looks good

>
>
> diff --git a/tools/testing/selftests/bpf/progs/get_func_ip_test.c b/tools/testing/selftests/bpf/progs/get_func_ip_test.c
> index a89596f7585d..2011cacdeb18 100644
> --- a/tools/testing/selftests/bpf/progs/get_func_ip_test.c
> +++ b/tools/testing/selftests/bpf/progs/get_func_ip_test.c
> @@ -6,12 +6,11 @@
> char _license[] SEC("license") = "GPL";
>
> extern int bpf_fentry_test1(int a) __ksym;
> -extern int bpf_fentry_test2(int a, __u64 b) __ksym;
> -extern int bpf_fentry_test3(char a, int b, __u64 c) __ksym;
> -extern int bpf_fentry_test4(void *a, char b, int c, __u64 d) __ksym;
> extern int bpf_modify_return_test(int a, int *b) __ksym;
> -extern int bpf_fentry_test6(__u64 a, void *b, short c, int d, void *e, __u64 f) __ksym;
> -extern int bpf_fentry_test7(struct bpf_fentry_test_t *arg) __ksym;

I did not realize bpf_fentry_test6/7 are not used.. ok

thanks,
jirka

> +
> +extern const void bpf_fentry_test2 __ksym;
> +extern const void bpf_fentry_test3 __ksym;
> +extern const void bpf_fentry_test4 __ksym;
>
> extern bool CONFIG_X86_KERNEL_IBT __kconfig __weak;