kernel/bpf/verifier.c

640 static enum bpf_dynptr_type arg_to_dynptr_type(enum bpf_arg_type arg_type)
642 	switch (arg_type & DYNPTR_TYPE_FLAG_MASK) {
706 				   enum bpf_arg_type arg_type, int insn_idx, int clone_ref_obj_id)
737 	type = arg_to_dynptr_type(arg_type);
974 				    enum bpf_arg_type arg_type)
981 	if (arg_type == ARG_PTR_TO_DYNPTR)
984 	dynptr_type = arg_to_dynptr_type(arg_type);
7658 			       enum bpf_arg_type arg_type, int clone_ref_obj_id)
7666 	if ((arg_type & (MEM_UNINIT | MEM_RDONLY)) == (MEM_UNINIT | MEM_RDONLY)) {
7686 	if (arg_type & MEM_UNINIT) {
7702 		err = mark_stack_slots_dynptr(env, reg, arg_type, insn_idx, clone_ref_obj_id);
7705 		if (reg->type == CONST_PTR_TO_DYNPTR && !(arg_type & MEM_RDONLY)) {
7718 		if (!is_dynptr_type_expected(env, reg, arg_type & ~MEM_RDONLY)) {
7721 				dynptr_type_str(arg_to_dynptr_type(arg_type)), regno);
8076 				 enum bpf_arg_type *arg_type)
8087 		if (*arg_type == ARG_PTR_TO_MAP_VALUE) {
8088 			*arg_type = ARG_PTR_TO_BTF_ID_SOCK_COMMON;
8090 			verbose(env, "invalid arg_type for sockmap/sockhash\n");
8096 			*arg_type = ARG_PTR_TO_MAP_VALUE;
8223 			  enum bpf_arg_type arg_type,
8232 	compatible = compatible_reg_types[base_type(arg_type)];
8234 		verbose(env, "verifier internal error: unsupported arg type %d\n", arg_type);
8248 	 * Therefore we fold these flags depending on the arg_type before comparison.
8250 	if (arg_type & MEM_RDONLY)
8252 	if (arg_type & PTR_MAYBE_NULL)
8254 	if (base_type(arg_type) == ARG_PTR_TO_MEM)
8282 		if (!(arg_type & MEM_RDONLY)) {
8304 		bool strict_type_match = arg_type_is_release(arg_type) &&
8308 		    (!type_may_be_null(arg_type) || arg_type_is_release(arg_type))) {
8386 				  enum bpf_arg_type arg_type)
8396 	if (arg_type_is_release(arg_type)) {
8403 		if (arg_type_is_dynptr(arg_type) && type == PTR_TO_STACK)
8463 		if (arg_type_is_dynptr(fn->arg_type[i])) {
8576 	enum bpf_arg_type arg_type = fn->arg_type[arg];
8581 	if (arg_type == ARG_DONTCARE)
8588 	if (arg_type == ARG_ANYTHING) {
8603 	if (base_type(arg_type) == ARG_PTR_TO_MAP_VALUE) {
8604 		err = resolve_map_arg_type(env, meta, &arg_type);
8609 	if (register_is_null(reg) && type_may_be_null(arg_type))
8616 	if (base_type(arg_type) == ARG_PTR_TO_BTF_ID ||
8617 	    base_type(arg_type) == ARG_PTR_TO_SPIN_LOCK)
8620 	err = check_reg_type(env, regno, arg_type, arg_btf_id, meta);
8624 	err = check_func_arg_reg_off(env, reg, regno, arg_type);
8629 	if (arg_type_is_release(arg_type)) {
8630 		if (arg_type_is_dynptr(arg_type)) {
8671 	switch (base_type(arg_type)) {
8717 		if (type_may_be_null(arg_type) && register_is_null(reg))
8728 		meta->raw_mode = arg_type & MEM_UNINIT;
8771 		meta->raw_mode = arg_type & MEM_UNINIT;
8772 		if (arg_type & MEM_FIXED_SIZE) {
8785 		err = process_dynptr_func(env, regno, insn_idx, arg_type, 0);
8803 		int size = int_ptr_type_to_size(arg_type);
9143 	bool is_fixed = fn->arg_type[arg] & MEM_FIXED_SIZE;
9147 	if (arg + 1 < ARRAY_SIZE(fn->arg_type))
9148 		is_next_size = arg_type_is_mem_size(fn->arg_type[arg + 1]);
9150 	if (base_type(fn->arg_type[arg]) != ARG_PTR_TO_MEM)
9178 	for (i = 0; i < ARRAY_SIZE(fn->arg_type); i++) {
9179 		if (base_type(fn->arg_type[i]) == ARG_PTR_TO_BTF_ID)
9181 		if (base_type(fn->arg_type[i]) == ARG_PTR_TO_SPIN_LOCK)
9183 		if (base_type(fn->arg_type[i]) != ARG_PTR_TO_BTF_ID && fn->arg_btf_id[i] &&
9185 		    (base_type(fn->arg_type[i]) != ARG_PTR_TO_MEM ||
9186 		     !(fn->arg_type[i] & MEM_FIXED_SIZE)))
9369 		if (arg->arg_type == ARG_ANYTHING) {
9374 		} else if (arg->arg_type == ARG_PTR_TO_CTX) {
9385 		} else if (base_type(arg->arg_type) == ARG_PTR_TO_MEM) {
9391 			if (!(arg->arg_type & PTR_MAYBE_NULL) && (reg->type & PTR_MAYBE_NULL)) {
9395 		} else if (base_type(arg->arg_type) == ARG_PTR_TO_ARENA) {
9407 		} else if (arg->arg_type == (ARG_PTR_TO_DYNPTR | MEM_RDONLY)) {
9408 			ret = process_dynptr_func(env, regno, -1, arg->arg_type, 0);
9411 		} else if (base_type(arg->arg_type) == ARG_PTR_TO_BTF_ID) {
9415 			if (register_is_null(reg) && type_may_be_null(arg->arg_type))
9419 			err = check_reg_type(env, regno, arg->arg_type, &arg->btf_id, &meta);
9420 			err = err ?: check_func_arg_reg_off(env, reg, regno, arg->arg_type);
9425 				i, arg->arg_type);
10288 		if (arg_type_is_dynptr(fn->arg_type[meta.release_regno - BPF_REG_1])) {
11628 		enum bpf_arg_type arg_type = ARG_DONTCARE;
11738 			arg_type |= OBJ_RELEASE;
11759 			arg_type |= OBJ_RELEASE;
11760 		ret = check_func_arg_reg_off(env, reg, regno, arg_type);
20452 			if (sub->arg_cnt != 1 || sub->args[0].arg_type != ARG_ANYTHING) {
20462 			if (arg->arg_type == ARG_PTR_TO_CTX) {
20465 			} else if (arg->arg_type == ARG_ANYTHING) {
20468 			} else if (arg->arg_type == (ARG_PTR_TO_DYNPTR | MEM_RDONLY)) {
20471 			} else if (base_type(arg->arg_type) == ARG_PTR_TO_MEM) {
20473 				if (arg->arg_type & PTR_MAYBE_NULL)
20478 			} else if (base_type(arg->arg_type) == ARG_PTR_TO_BTF_ID) {
20480 				if (arg->arg_type & PTR_MAYBE_NULL)
20482 				if (arg->arg_type & PTR_UNTRUSTED)
20484 				if (arg->arg_type & PTR_TRUSTED)
20490 			} else if (base_type(arg->arg_type) == ARG_PTR_TO_ARENA) {
20495 					  i - BPF_REG_1, arg->arg_type);
20507 			if (ret || sub->arg_cnt != 1 || sub->args[0].arg_type != ARG_PTR_TO_CTX)