linux-stable/kernel
Joanne Koong 97e03f5210 bpf: Add verifier support for dynptrs
This patch adds the bulk of the verifier work for supporting dynamic
pointers (dynptrs) in bpf.

A bpf_dynptr is opaque to the bpf program. It is a 16-byte structure
defined internally as:

struct bpf_dynptr_kern {
    void *data;
    u32 size;
    u32 offset;
} __aligned(8);

The upper 8 bits of *size* is reserved (it contains extra metadata about
read-only status and dynptr type). Consequently, a dynptr only supports
memory less than 16 MB.

There are different types of dynptrs (eg malloc, ringbuf, ...). In this
patchset, the most basic one, dynptrs to a bpf program's local memory,
is added. For now only local memory that is of reg type PTR_TO_MAP_VALUE
is supported.

In the verifier, dynptr state information will be tracked in stack
slots. When the program passes in an uninitialized dynptr
(ARG_PTR_TO_DYNPTR | MEM_UNINIT), the stack slots corresponding
to the frame pointer where the dynptr resides at are marked
STACK_DYNPTR. For helper functions that take in initialized dynptrs (eg
bpf_dynptr_read + bpf_dynptr_write which are added later in this
patchset), the verifier enforces that the dynptr has been initialized
properly by checking that their corresponding stack slots have been
marked as STACK_DYNPTR.

The 6th patch in this patchset adds test cases that the verifier should
successfully reject, such as for example attempting to use a dynptr
after doing a direct write into it inside the bpf program.

Signed-off-by: Joanne Koong <joannelkoong@gmail.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: David Vernet <void@manifault.com>
Link: https://lore.kernel.org/bpf/20220523210712.3641569-2-joannelkoong@gmail.com
2022-05-23 14:30:17 -07:00
..
bpf bpf: Add verifier support for dynptrs 2022-05-23 14:30:17 -07:00
cgroup Driver core changes for 5.18-rc1 2022-03-28 12:41:28 -07:00
configs Char/Misc and other driver updates for 5.18-rc1 2022-03-28 12:27:35 -07:00
debug kdb: Fix the putarea helper function 2022-03-24 16:39:47 +00:00
dma dma-direct: avoid redundant memory sync for swiotlb 2022-04-14 06:30:39 +02:00
entry entry: Fix compile error in dynamic_irqentry_exit_cond_resched() 2022-04-05 09:59:36 +02:00
events perf/core: Always set cpuctx cgrp when enable cgroup event 2022-04-05 09:59:45 +02:00
futex mm/truncate: Inline invalidate_complete_page() into its one caller 2022-03-21 12:59:01 -04:00
gcov
irq genirq/affinity: Consider that CPUs on nodes can be unbalanced 2022-04-11 09:58:03 +02:00
kcsan KCSAN updates for v5.17 2022-01-11 09:51:26 -08:00
livepatch ptrace: Cleanups for v5.18 2022-03-28 17:29:53 -07:00
locking Changes in this cycle were: 2022-03-22 13:44:21 -07:00
power for-5.18/block-2022-03-18 2022-03-21 16:48:55 -07:00
printk printk changes for 5.18 2022-03-23 10:54:27 -07:00
rcu Changes in this cycle were: 2022-03-22 14:39:12 -07:00
sched sched: Teach the forced-newidle balancer about CPU affinity limitation. 2022-04-05 09:59:36 +02:00
time tick/sched: Fix non-kernel-doc comment 2022-04-10 12:23:34 +02:00
trace bpf: Add bpf_skc_to_mptcp_sock_proto 2022-05-20 15:29:00 -07:00
.gitignore
acct.c
async.c Revert "module, async: async_synchronize_full() on module init iff async is used" 2022-02-03 11:20:34 -08:00
audit.c audit: improve audit queue handling when "audit=1" on cmdline 2022-01-25 13:22:51 -05:00
audit.h audit: log AUDIT_TIME_* records only from rules 2022-02-22 13:51:40 -05:00
audit_fsnotify.c
audit_tree.c
audit_watch.c
auditfilter.c audit/stable-5.17 PR 20220110 2022-01-11 13:08:21 -08:00
auditsc.c audit/stable-5.18 PR 20220321 2022-03-21 20:53:11 -07:00
backtracetest.c
bounds.c
capability.c xfs: don't generate selinux audit messages for capability testing 2022-03-09 10:32:06 -08:00
cfi.c
compat.c
configs.c
context_tracking.c
cpu.c cpu/hotplug: Remove the 'cpu' member of cpuhp_cpu_state 2022-04-13 21:25:40 +02:00
cpu_pm.c
crash_core.c
crash_dump.c
cred.c x86: Mark __invalid_creds() __noreturn 2022-03-15 10:32:44 +01:00
delayacct.c delayacct: track delays from memory compact 2022-01-20 08:52:55 +02:00
dma.c
exec_domain.c
exit.c ptrace: Cleanups for v5.18 2022-03-28 17:29:53 -07:00
extable.c lkdtm: Really write into kernel text in WRITE_KERN 2022-02-16 23:25:12 +11:00
fail_function.c
fork.c kasan, arm64: reset pointer tags of vmapped stacks 2022-03-24 19:06:47 -07:00
freezer.c
gen_kheaders.sh
groups.c
hung_task.c hung_task: move hung_task sysctl interface to hung_task.c 2022-01-22 08:33:34 +02:00
iomem.c
irq_work.c irq_work: use kasan_record_aux_stack_noalloc() record callstack 2022-04-15 14:49:55 -07:00
jump_label.c
kallsyms.c ftrace: Add ftrace_lookup_symbols function 2022-05-10 14:42:06 -07:00
kcmp.c
Kconfig.freezer
Kconfig.hz
Kconfig.locks
Kconfig.preempt Revert "signal, x86: Delay calling signals in atomic on RT enabled kernels" 2022-03-31 10:36:55 +02:00
kcov.c kcov: properly handle subsequent mmap calls 2022-03-23 19:00:35 -07:00
kexec.c
kexec_core.c
kexec_elf.c
kexec_file.c
kexec_internal.h
kheaders.c
kmod.c
kprobes.c kprobes: Use rethook for kretprobe if possible 2022-03-28 19:38:09 -07:00
ksysfs.c kernel/ksysfs.c: use helper macro __ATTR_RW 2022-03-23 19:00:33 -07:00
kthread.c asm-generic updates for 5.18 2022-03-23 18:03:08 -07:00
latencytop.c
Makefile static_call: Don't make __static_call_return0 static 2022-04-05 09:59:38 +02:00
module-internal.h module: add in-kernel support for decompressing 2022-01-11 18:45:02 -08:00
module.c NFSD: Remove svc_serv_ops::svo_module 2022-02-28 10:26:40 -05:00
module_decompress.c module: fix building with sysfs disabled 2022-02-16 12:51:32 -08:00
module_signature.c
module_signing.c
notifier.c notifier: Return an error when a callback has already been registered 2021-12-29 10:37:33 +01:00
nsproxy.c
padata.c padata: replace cpumask_weight with cpumask_empty in padata.c 2022-01-31 11:21:46 +11:00
panic.c panic: move panic_print before kmsg dumpers 2022-03-23 19:00:35 -07:00
params.c kobject: remove kset from struct kset_uevent_ops callbacks 2021-12-28 11:26:18 +01:00
pid.c
pid_namespace.c
profile.c exit: Remove profile_handoff_task 2022-01-08 12:43:57 -06:00
ptrace.c ptrace: Check PTRACE_O_SUSPEND_SECCOMP permission on PTRACE_SEIZE 2022-03-22 13:06:05 -05:00
range.c
reboot.c
regset.c
relay.c
resource.c kernel/resource: fix kfree() of bootmem memory again 2022-03-23 19:00:35 -07:00
resource_kunit.c
rseq.c rseq: Remove broken uapi field layout on 32-bit little endian 2022-02-02 13:11:34 +01:00
scftorture.c
scs.c kasan, vmalloc: only tag normal vmalloc allocations 2022-03-24 19:06:48 -07:00
seccomp.c ptrace: Cleanups for v5.18 2022-03-28 17:29:53 -07:00
signal.c Revert "signal, x86: Delay calling signals in atomic on RT enabled kernels" 2022-03-31 10:36:55 +02:00
smp.c smp: Fix offline cpu check in flush_smp_call_function_queue() 2022-04-13 18:44:35 +02:00
smpboot.c
smpboot.h
softirq.c genirq, softirq: Use in_hardirq() instead of in_irq() 2022-02-02 21:34:19 +01:00
stackleak.c gcc-plugins/stackleak: Use noinstr in favor of notrace 2022-02-03 17:02:21 -08:00
stacktrace.c uaccess: remove CONFIG_SET_FS 2022-02-25 09:36:06 +01:00
static_call.c static_call: Don't make __static_call_return0 static 2022-04-05 09:59:38 +02:00
static_call_inline.c static_call: Don't make __static_call_return0 static 2022-04-05 09:59:38 +02:00
stop_machine.c
sys.c prlimit: do not grab the tasklist_lock 2022-03-08 14:33:36 -06:00
sys_ni.c mm/mempolicy: wire up syscall set_mempolicy_home_node 2022-01-15 16:30:30 +02:00
sysctl-test.c
sysctl.c bpf: Move BPF sysctls from kernel/sysctl.c to BPF core 2022-04-13 21:36:56 +02:00
task_work.c resume_user_mode: Move to resume_user_mode.h 2022-03-10 16:51:50 -06:00
taskstats.c taskstats: remove unneeded dead assignment 2022-03-23 19:00:35 -07:00
torture.c torture: Wake up kthreads after storing task_struct pointer 2022-02-01 17:24:39 -08:00
tracepoint.c
tsacct.c taskstats: Cleanup the use of task->exit_code 2022-01-08 12:43:57 -06:00
ucount.c ucounts: Handle wrapping in is_ucounts_overlimit 2022-02-17 09:11:57 -06:00
uid16.c
uid16.h
umh.c
up.c
user-return-notifier.c
user.c
user_namespace.c ucounts: Fix systemd LimitNPROC with private users regression 2022-02-25 10:40:14 -06:00
usermode_driver.c
utsname.c
utsname_sysctl.c
watch_queue.c watch_queue: Free the page array when watch_queue is dismantled 2022-04-02 10:37:39 -07:00
watchdog.c sched/isolation: Use single feature type while referring to housekeeping cpumask 2022-02-16 15:57:55 +01:00
watchdog_hld.c
workqueue.c Merge branch 'for-5.18' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq 2022-03-23 12:40:51 -07:00
workqueue_internal.h