• Dave Marchevsky's avatar
    bpf: Special verifier handling for bpf_rbtree_{remove, first} · a40d3632
    Dave Marchevsky authored
    Newly-added bpf_rbtree_{remove,first} kfuncs have some special properties
    that require handling in the verifier:
    
      * both bpf_rbtree_remove and bpf_rbtree_first return the type containing
        the bpf_rb_node field, with the offset set to that field's offset,
        instead of a struct bpf_rb_node *
        * mark_reg_graph_node helper added in previous patch generalizes
          this logic, use it
    
      * bpf_rbtree_remove's node input is a node that's been inserted
        in the tree - a non-owning reference.
    
      * bpf_rbtree_remove must invalidate non-owning references in order to
        avoid aliasing issue. Use previously-added
        invalidate_non_owning_refs helper to mark this function as a
        non-owning ref invalidation point.
    
      * Unlike other functions, which convert one of their input arg regs to
        non-owning reference, bpf_rbtree_first takes no arguments and just
        returns a non-owning reference (possibly null)
        * For now verifier logic for this is special-cased instead of
          adding new kfunc flag.
    
    This patch, along with the previous one, complete special verifier
    handling for all rbtree API functions added in this series.
    
    With functional verifier handling of rbtree_remove, under current
    non-owning reference scheme, a node type with both bpf_{list,rb}_node
    fields could cause the verifier to accept programs which remove such
    nodes from collections they haven't been added to.
    
    In order to prevent this, this patch adds a check to btf_parse_fields
    which rejects structs with both bpf_{list,rb}_node fields. This is a
    temporary measure that can be removed after "collection identity"
    followup. See comment added in btf_parse_fields. A linked_list BTF test
    exercising the new check is added in this patch as well.
    Signed-off-by: default avatarDave Marchevsky <davemarchevsky@fb.com>
    Link: https://lore.kernel.org/r/20230214004017.2534011-6-davemarchevsky@fb.comSigned-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
    a40d3632
btf.c 216 KB