bpf: Fix check_reg_type for PTR_TO_BTF_ID
authorKumar Kartikeya Dwivedi <memxor@gmail.com>
Tue, 21 Feb 2023 20:06:44 +0000 (21:06 +0100)
committerAlexei Starovoitov <ast@kernel.org>
Wed, 22 Feb 2023 20:50:15 +0000 (12:50 -0800)
commitda03e43a8c500fcfb11ac5eeb03c1b4a9c1dd958
tree8335ed9b25334e4fa368f61969357aa026634d06
parent521d3c0a1730c29c96870919a7a115577e17f8c7
bpf: Fix check_reg_type for PTR_TO_BTF_ID

The current code does type matching for the case where reg->type is
PTR_TO_BTF_ID or has the PTR_TRUSTED flag. However, this only needs to
occur for non-MEM_ALLOC and non-MEM_PERCPU cases, but will include both
as per the current code.

The MEM_ALLOC case with or without PTR_TRUSTED needs to be handled
specially by the code for type_is_alloc case, while MEM_PERCPU case must
be ignored. Hence, to restore correct behavior and for clarity,
explicitly list out the handled PTR_TO_BTF_ID types which should be
handled for each case using a switch statement.

Helpers currently only take:
PTR_TO_BTF_ID
PTR_TO_BTF_ID | PTR_TRUSTED
PTR_TO_BTF_ID | MEM_RCU
PTR_TO_BTF_ID | MEM_ALLOC
PTR_TO_BTF_ID | MEM_PERCPU
PTR_TO_BTF_ID | MEM_PERCPU | PTR_TRUSTED

This fix was also described (for the MEM_ALLOC case) in [0].

  [0]: https://lore.kernel.org/bpf/20221121160657.h6z7xuvedybp5y7s@apollo

Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/r/20230221200646.2500777-6-memxor@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
kernel/bpf/verifier.c