Re: [PATCHv9 bpf-next 1/5] bpf: add a new bpf argument type ARG_CONST_MAP_PTR_OR_NULL

Hi Daniel,

Sorry for the late reply. I was in PTO last few days.

On Fri, Aug 28, 2020 at 11:56:37PM +0200, Daniel Borkmann wrote:

On 8/26/20 3:19 PM, Hangbin Liu wrote:

quoted

Add a new bpf argument type ARG_CONST_MAP_PTR_OR_NULL which could be
used when we want to allow NULL pointer for map parameter. The bpf helper
need to take care and check if the map is NULL when use this type.

Signed-off-by: Hangbin Liu <redacted>
---

v9: merge the patch from [1] in to this series.
v1-v8: no this patch

[1] https://lore.kernel.org/bpf/20200715070001.2048207-1-liuhangbin@gmail.com/ (local)
---
  include/linux/bpf.h   |  2 ++
  kernel/bpf/verifier.c | 23 ++++++++++++++++-------
  2 files changed, 18 insertions(+), 7 deletions(-)

diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index a6131d95e31e..cb40a1281ea2 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h

@@ -276,6 +276,7 @@ enum bpf_arg_type {
  	ARG_PTR_TO_ALLOC_MEM,	/* pointer to dynamically allocated memory */
  	ARG_PTR_TO_ALLOC_MEM_OR_NULL,	/* pointer to dynamically allocated memory or NULL */
  	ARG_CONST_ALLOC_SIZE_OR_ZERO,	/* number of allocated bytes requested */
+	ARG_CONST_MAP_PTR_OR_NULL,	/* const argument used as pointer to bpf_map or NULL */
  };
  /* type of values returned from helper functions */

@@ -369,6 +370,7 @@ enum bpf_reg_type {
  	PTR_TO_RDONLY_BUF_OR_NULL, /* reg points to a readonly buffer or NULL */
  	PTR_TO_RDWR_BUF,	 /* reg points to a read/write buffer */
  	PTR_TO_RDWR_BUF_OR_NULL, /* reg points to a read/write buffer or NULL */
+	CONST_PTR_TO_MAP_OR_NULL, /* reg points to struct bpf_map or NULL */

Why is this needed & where do you assign it? Also, if we were to use CONST_PTR_TO_MAP_OR_NULL
then it's missing few things like rejection of arithmetic in adjust_ptr_min_max_vals(), handling
in pruning logic etc.

Either way, given no helper currently returns CONST_PTR_TO_MAP_OR_NULL, the ARG_CONST_MAP_PTR_OR_NULL
one should be sufficient, so I'd suggest to remove the CONST_PTR_TO_MAP_OR_NULL bits.

Sorry, I misunderstand the bpf_reg_type when added it.

Thanks for the comment. I will remove it.

quoted

-	} else if (arg_type == ARG_CONST_MAP_PTR) {
+	} else if (arg_type == ARG_CONST_MAP_PTR ||
+		   arg_type == ARG_CONST_MAP_PTR_OR_NULL) {
  		expected_type = CONST_PTR_TO_MAP;
-		if (type != expected_type)
+		if (register_is_null(reg) &&
+		    arg_type == ARG_CONST_MAP_PTR_OR_NULL)
+			/* final test in check_stack_boundary() */;

Where is that test in the code? Copy-paste leftover comment?

Yeah...  I will remove it.

Thanks
Hangbin