kernel/bpf/verifier.c

136  * Now verifier knows that this map has key of R1->map_ptr->key_size bytes
271 	struct bpf_map *map_ptr;
415 		rec = reg->map_ptr->record;
1769 	/* Clear off and union(map_ptr, range) */
1835 		const struct bpf_map *map = reg->map_ptr;
1839 			reg->map_ptr = map->inner_map_meta;
2292 	 * Clear type, off, and union(map_ptr, range) and
5051 	struct bpf_map *map = regs[regno].map_ptr;
5417 	struct bpf_map *map = reg->map_ptr;
6586 	struct bpf_map *map = reg->map_ptr;
6595 		verbose(env, "map_ptr access not supported without CONFIG_DEBUG_INFO_BTF\n");
6600 		verbose(env, "map_ptr access not supported for map type %d\n",
6763 					      reg->map_ptr->key_size, false);
6783 			kptr_field = btf_record_find(reg->map_ptr->record,
6788 			struct bpf_map *map = reg->map_ptr;
7264 					       reg->map_ptr->key_size, false);
7497 		map = reg->map_ptr;
7561 	struct bpf_map *map = reg->map_ptr;
7584 	if (meta->map_ptr) {
7589 	meta->map_ptr = map;
7597 	struct bpf_map *map_ptr = reg->map_ptr;
7607 	if (!map_ptr->btf) {
7609 			map_ptr->name);
7612 	if (!btf_record_has_field(map_ptr->record, BPF_KPTR)) {
7613 		verbose(env, "map '%s' has no valid kptr\n", map_ptr->name);
7617 	meta->map_ptr = map_ptr;
7619 	kptr_field = btf_record_find(map_ptr->record, kptr_off, BPF_KPTR);
8078 	if (!meta->map_ptr) {
8080 		verbose(env, "invalid map_ptr to access map->type\n");
8084 	switch (meta->map_ptr->map_type) {
8524 	struct bpf_map *map = reg->map_ptr;
8673 		/* bpf_map_xxx(map_ptr) call: remember that map_ptr */
8674 		if (meta->map_ptr) {
8685 			 * Comparing map_ptr is enough to distinguish normal and outer maps.
8687 			if (meta->map_ptr != reg->map_ptr ||
8695 		meta->map_ptr = reg->map_ptr;
8699 		/* bpf_map_xxx(..., map_ptr, ..., key) call:
8703 		if (!meta->map_ptr) {
8704 			/* in function declaration map_ptr must come before
8709 			verbose(env, "invalid map_ptr to access map->key\n");
8713 					      meta->map_ptr->key_size, false,
8720 		/* bpf_map_xxx(..., map_ptr, ..., value) call:
8723 		if (!meta->map_ptr) {
8725 			verbose(env, "invalid map_ptr to access map->value\n");
8730 					      meta->map_ptr->value_size, false,
9619 	callee->regs[BPF_REG_2].map_ptr = caller->regs[BPF_REG_1].map_ptr;
9623 	callee->regs[BPF_REG_3].map_ptr = caller->regs[BPF_REG_1].map_ptr;
9657 		verbose(env, "tail_call abusing map_ptr\n");
9704 	struct bpf_map *map_ptr = caller->regs[BPF_REG_1].map_ptr;
9711 	callee->regs[BPF_REG_1].map_ptr = map_ptr;
9715 	callee->regs[BPF_REG_2].map_ptr = map_ptr;
9719 	callee->regs[BPF_REG_3].map_ptr = map_ptr;
9988 	struct bpf_map *map = meta->map_ptr;
10021 		bpf_map_ptr_store(aux, meta->map_ptr,
10022 				  !meta->map_ptr->bypass_spec_v1);
10023 	else if (BPF_MAP_PTR(aux->map_ptr_state) != meta->map_ptr)
10025 				  !meta->map_ptr->bypass_spec_v1);
10035 	struct bpf_map *map = meta->map_ptr;
10090 	struct bpf_map *fmt_map = fmt_reg->map_ptr;
10505 		/* remember map_ptr, so that check_map_access()
10509 		if (meta.map_ptr == NULL) {
10514 		regs[BPF_REG_0].map_ptr = meta.map_ptr;
10518 		    btf_record_has_field(meta.map_ptr->record, BPF_SPIN_LOCK)) {
10622 	if (helper_multiple_ref_obj_use(func_id, meta.map_ptr)) {
10634 	} else if (is_acquire_function(func_id, meta.map_ptr)) {
10649 	err = check_map_func_compatibility(env, meta.map_ptr, func_id);
11292  * The active_lock.ptr in case of map values is the reg->map_ptr, and in case of
11301  * hence their active_lock.ptr becomes map_ptr and id = 0 (since they all point
11304  * In case of inner map lookups, the inner map pointer has same map_ptr as the
11307  * maps from the same outer map share the same map_ptr as active_lock.ptr, they
11322 		ptr = reg->map_ptr;
12607 		max = ptr_reg->map_ptr->value_size;
15241 	dst_reg->map_ptr = map;
19114 	struct bpf_map *map_ptr;
19327 		map_ptr = prog->aux->poke_tab[i].tail_call.map;
19328 		map_ptr->ops->map_poke_untrack(map_ptr, prog->aux);
19596 	struct bpf_map *map_ptr;
19880 				verbose(env, "tail_call abusing map_ptr\n");
19884 			map_ptr = BPF_MAP_PTR(aux->map_ptr_state);
19886 						  map_ptr->max_entries, 2);
19888 						    container_of(map_ptr,
19992 			map_ptr = BPF_MAP_PTR(aux->map_ptr_state);
19993 			ops = map_ptr->ops;
19996 				cnt = ops->map_gen_lookup(map_ptr, insn_buf);
20248 		map_ptr = prog->aux->poke_tab[i].tail_call.map;
20249 		if (!map_ptr->ops->map_poke_track ||
20250 		    !map_ptr->ops->map_poke_untrack ||
20251 		    !map_ptr->ops->map_poke_run) {
20256 		ret = map_ptr->ops->map_poke_track(map_ptr, prog->aux);