• Yonghong Song's avatar
    bpf: Handle MEM_RCU type properly · fca1aa75
    Yonghong Song authored
    Commit 9bb00b28 ("bpf: Add kfunc bpf_rcu_read_lock/unlock()")
    introduced MEM_RCU and bpf_rcu_read_lock/unlock() support. In that
    commit, a rcu pointer is tagged with both MEM_RCU and PTR_TRUSTED
    so that it can be passed into kfuncs or helpers as an argument.
    
    Martin raised a good question in [1] such that the rcu pointer,
    although being able to accessing the object, might have reference
    count of 0. This might cause a problem if the rcu pointer is passed
    to a kfunc which expects trusted arguments where ref count should
    be greater than 0.
    
    This patch makes the following changes related to MEM_RCU pointer:
      - MEM_RCU pointer might be NULL (PTR_MAYBE_NULL).
      - Introduce KF_RCU so MEM_RCU ptr can be acquired with
        a KF_RCU tagged kfunc which assumes ref count of rcu ptr
        could be zero.
      - For mem access 'b = ptr->a', say 'ptr' is a MEM_RCU ptr, and
        'a' is tagged with __rcu as well. Let us mark 'b' as
        MEM_RCU | PTR_MAYBE_NULL.
    
     [1] https://lore.kernel.org/bpf/ac70f574-4023-664e-b711-e0d3b18117fd@linux.dev/
    
    Fixes: 9bb00b28 ("bpf: Add kfunc bpf_rcu_read_lock/unlock()")
    Signed-off-by: default avatarYonghong Song <yhs@fb.com>
    Link: https://lore.kernel.org/r/20221203184602.477272-1-yhs@fb.comSigned-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
    fca1aa75
verifier.c 488 KB