tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

bpf: Support __nullable argument suffix for tp_btf

Pointers passed to tp_btf were trusted to be valid, but some tracepoints
do take NULL pointer as input, such as trace_tcp_send_reset(). Then the
invalid memory access cannot be detected by verifier.

This patch fix it by add a suffix "__nullable" to the unreliable
argument. The suffix is shown in btf, and PTR_MAYBE_NULL will be added
to nullable arguments. Then users must check the pointer before use it.

A problem here is that we use "btf_trace_##call" to search func_proto.
As it is a typedef, argument names as well as the suffix are not
recorded. To solve this, I use bpf_raw_event_map to find
"__bpf_trace##template" from "btf_trace_##call", and then we can see the
suffix.

Suggested-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Philo Lu <lulie@linux.alibaba.com>
Link: https://lore.kernel.org/r/20240911033719.91468-2-lulie@linux.alibaba.com
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>

authored by

Philo Lu and committed by
Martin KaFai Lau 8aeaed21 23dc9867

+35 -4
+3
kernel/bpf/btf.c
··· 6523 6523 if (prog_args_trusted(prog)) 6524 6524 info->reg_type |= PTR_TRUSTED; 6525 6525 6526 + if (btf_param_match_suffix(btf, &args[arg], "__nullable")) 6527 + info->reg_type |= PTR_MAYBE_NULL; 6528 + 6526 6529 if (tgt_prog) { 6527 6530 enum bpf_prog_type tgt_type; 6528 6531
+32 -4
kernel/bpf/verifier.c
··· 28 28 #include <linux/cpumask.h> 29 29 #include <linux/bpf_mem_alloc.h> 30 30 #include <net/xdp.h> 31 + #include <linux/trace_events.h> 32 + #include <linux/kallsyms.h> 31 33 32 34 #include "disasm.h" 33 35 ··· 21156 21154 { 21157 21155 bool prog_extension = prog->type == BPF_PROG_TYPE_EXT; 21158 21156 bool prog_tracing = prog->type == BPF_PROG_TYPE_TRACING; 21157 + char trace_symbol[KSYM_SYMBOL_LEN]; 21159 21158 const char prefix[] = "btf_trace_"; 21159 + struct bpf_raw_event_map *btp; 21160 21160 int ret = 0, subprog = -1, i; 21161 21161 const struct btf_type *t; 21162 21162 bool conservative = true; 21163 - const char *tname; 21163 + const char *tname, *fname; 21164 21164 struct btf *btf; 21165 21165 long addr = 0; 21166 21166 struct module *mod = NULL; ··· 21293 21289 return -EINVAL; 21294 21290 } 21295 21291 tname += sizeof(prefix) - 1; 21296 - t = btf_type_by_id(btf, t->type); 21297 - if (!btf_type_is_ptr(t)) 21298 - /* should never happen in valid vmlinux build */ 21292 + 21293 + /* The func_proto of "btf_trace_##tname" is generated from typedef without argument 21294 + * names. Thus using bpf_raw_event_map to get argument names. 21295 + */ 21296 + btp = bpf_get_raw_tracepoint(tname); 21297 + if (!btp) 21299 21298 return -EINVAL; 21299 + fname = kallsyms_lookup((unsigned long)btp->bpf_func, NULL, NULL, NULL, 21300 + trace_symbol); 21301 + bpf_put_raw_tracepoint(btp); 21302 + 21303 + if (fname) 21304 + ret = btf_find_by_name_kind(btf, fname, BTF_KIND_FUNC); 21305 + 21306 + if (!fname || ret < 0) { 21307 + bpf_log(log, "Cannot find btf of tracepoint template, fall back to %s%s.\n", 21308 + prefix, tname); 21309 + t = btf_type_by_id(btf, t->type); 21310 + if (!btf_type_is_ptr(t)) 21311 + /* should never happen in valid vmlinux build */ 21312 + return -EINVAL; 21313 + } else { 21314 + t = btf_type_by_id(btf, ret); 21315 + if (!btf_type_is_func(t)) 21316 + /* should never happen in valid vmlinux build */ 21317 + return -EINVAL; 21318 + } 21319 + 21300 21320 t = btf_type_by_id(btf, t->type); 21301 21321 if (!btf_type_is_func_proto(t)) 21302 21322 /* should never happen in valid vmlinux build */