Skip to content

Commit bd74e23

Browse files
kkdwivediAlexei Starovoitov
kkdwivedi
authored and
Alexei Starovoitov
committed
bpf: Zero index arg error string for dynptr and iter
Andrii spotted that process_dynptr_func's rejection of incorrect argument register type will print an error string where argument numbers are not zero-indexed, unlike elsewhere in the verifier. Fix this by subtracting 1 from regno. The same scenario exists for iterator messages. Fix selftest error strings that match on the exact argument number while we're at it to ensure clean bisection. Suggested-by: Andrii Nakryiko <[email protected]> Signed-off-by: Kumar Kartikeya Dwivedi <[email protected]> Link: https://lore.kernel.org/r/[email protected] Signed-off-by: Alexei Starovoitov <[email protected]>
1 parent d4c4435 commit bd74e23

File tree

6 files changed

+29
-29
lines changed

6 files changed

+29
-29
lines changed

‎kernel/bpf/verifier.c

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -8071,7 +8071,7 @@ static int process_dynptr_func(struct bpf_verifier_env *env, int regno, int insn
80718071
if (reg->type != PTR_TO_STACK && reg->type != CONST_PTR_TO_DYNPTR) {
80728072
verbose(env,
80738073
"arg#%d expected pointer to stack or const struct bpf_dynptr\n",
8074-
regno);
8074+
regno - 1);
80758075
return -EINVAL;
80768076
}
80778077

@@ -8125,15 +8125,15 @@ static int process_dynptr_func(struct bpf_verifier_env *env, int regno, int insn
81258125
if (!is_dynptr_reg_valid_init(env, reg)) {
81268126
verbose(env,
81278127
"Expected an initialized dynptr as arg #%d\n",
8128-
regno);
8128+
regno - 1);
81298129
return -EINVAL;
81308130
}
81318131

81328132
/* Fold modifiers (in this case, MEM_RDONLY) when checking expected type */
81338133
if (!is_dynptr_type_expected(env, reg, arg_type & ~MEM_RDONLY)) {
81348134
verbose(env,
81358135
"Expected a dynptr of type %s as arg #%d\n",
8136-
dynptr_type_str(arg_to_dynptr_type(arg_type)), regno);
8136+
dynptr_type_str(arg_to_dynptr_type(arg_type)), regno - 1);
81378137
return -EINVAL;
81388138
}
81398139

@@ -8202,7 +8202,7 @@ static int process_iter_arg(struct bpf_verifier_env *env, int regno, int insn_id
82028202
*/
82038203
btf_id = btf_check_iter_arg(meta->btf, meta->func_proto, regno - 1);
82048204
if (btf_id < 0) {
8205-
verbose(env, "expected valid iter pointer as arg #%d\n", regno);
8205+
verbose(env, "expected valid iter pointer as arg #%d\n", regno - 1);
82068206
return -EINVAL;
82078207
}
82088208
t = btf_type_by_id(meta->btf, btf_id);
@@ -8212,7 +8212,7 @@ static int process_iter_arg(struct bpf_verifier_env *env, int regno, int insn_id
82128212
/* bpf_iter_<type>_new() expects pointer to uninit iter state */
82138213
if (!is_iter_reg_valid_uninit(env, reg, nr_slots)) {
82148214
verbose(env, "expected uninitialized iter_%s as arg #%d\n",
8215-
iter_type_str(meta->btf, btf_id), regno);
8215+
iter_type_str(meta->btf, btf_id), regno - 1);
82168216
return -EINVAL;
82178217
}
82188218

@@ -8236,7 +8236,7 @@ static int process_iter_arg(struct bpf_verifier_env *env, int regno, int insn_id
82368236
break;
82378237
case -EINVAL:
82388238
verbose(env, "expected an initialized iter_%s as arg #%d\n",
8239-
iter_type_str(meta->btf, btf_id), regno);
8239+
iter_type_str(meta->btf, btf_id), regno - 1);
82408240
return err;
82418241
case -EPROTO:
82428242
verbose(env, "expected an RCU CS when using %s\n", meta->func_name);

‎tools/testing/selftests/bpf/progs/dynptr_fail.c

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -149,7 +149,7 @@ int ringbuf_release_uninit_dynptr(void *ctx)
149149

150150
/* A dynptr can't be used after it has been invalidated */
151151
SEC("?raw_tp")
152-
__failure __msg("Expected an initialized dynptr as arg #3")
152+
__failure __msg("Expected an initialized dynptr as arg #2")
153153
int use_after_invalid(void *ctx)
154154
{
155155
struct bpf_dynptr ptr;
@@ -428,7 +428,7 @@ int invalid_helper2(void *ctx)
428428

429429
/* A bpf_dynptr is invalidated if it's been written into */
430430
SEC("?raw_tp")
431-
__failure __msg("Expected an initialized dynptr as arg #1")
431+
__failure __msg("Expected an initialized dynptr as arg #0")
432432
int invalid_write1(void *ctx)
433433
{
434434
struct bpf_dynptr ptr;
@@ -1407,7 +1407,7 @@ int invalid_slice_rdwr_rdonly(struct __sk_buff *skb)
14071407

14081408
/* bpf_dynptr_adjust can only be called on initialized dynptrs */
14091409
SEC("?raw_tp")
1410-
__failure __msg("Expected an initialized dynptr as arg #1")
1410+
__failure __msg("Expected an initialized dynptr as arg #0")
14111411
int dynptr_adjust_invalid(void *ctx)
14121412
{
14131413
struct bpf_dynptr ptr = {};
@@ -1420,7 +1420,7 @@ int dynptr_adjust_invalid(void *ctx)
14201420

14211421
/* bpf_dynptr_is_null can only be called on initialized dynptrs */
14221422
SEC("?raw_tp")
1423-
__failure __msg("Expected an initialized dynptr as arg #1")
1423+
__failure __msg("Expected an initialized dynptr as arg #0")
14241424
int dynptr_is_null_invalid(void *ctx)
14251425
{
14261426
struct bpf_dynptr ptr = {};
@@ -1433,7 +1433,7 @@ int dynptr_is_null_invalid(void *ctx)
14331433

14341434
/* bpf_dynptr_is_rdonly can only be called on initialized dynptrs */
14351435
SEC("?raw_tp")
1436-
__failure __msg("Expected an initialized dynptr as arg #1")
1436+
__failure __msg("Expected an initialized dynptr as arg #0")
14371437
int dynptr_is_rdonly_invalid(void *ctx)
14381438
{
14391439
struct bpf_dynptr ptr = {};
@@ -1446,7 +1446,7 @@ int dynptr_is_rdonly_invalid(void *ctx)
14461446

14471447
/* bpf_dynptr_size can only be called on initialized dynptrs */
14481448
SEC("?raw_tp")
1449-
__failure __msg("Expected an initialized dynptr as arg #1")
1449+
__failure __msg("Expected an initialized dynptr as arg #0")
14501450
int dynptr_size_invalid(void *ctx)
14511451
{
14521452
struct bpf_dynptr ptr = {};
@@ -1459,7 +1459,7 @@ int dynptr_size_invalid(void *ctx)
14591459

14601460
/* Only initialized dynptrs can be cloned */
14611461
SEC("?raw_tp")
1462-
__failure __msg("Expected an initialized dynptr as arg #1")
1462+
__failure __msg("Expected an initialized dynptr as arg #0")
14631463
int clone_invalid1(void *ctx)
14641464
{
14651465
struct bpf_dynptr ptr1 = {};
@@ -1493,7 +1493,7 @@ int clone_invalid2(struct xdp_md *xdp)
14931493

14941494
/* Invalidating a dynptr should invalidate its clones */
14951495
SEC("?raw_tp")
1496-
__failure __msg("Expected an initialized dynptr as arg #3")
1496+
__failure __msg("Expected an initialized dynptr as arg #2")
14971497
int clone_invalidate1(void *ctx)
14981498
{
14991499
struct bpf_dynptr clone;
@@ -1514,7 +1514,7 @@ int clone_invalidate1(void *ctx)
15141514

15151515
/* Invalidating a dynptr should invalidate its parent */
15161516
SEC("?raw_tp")
1517-
__failure __msg("Expected an initialized dynptr as arg #3")
1517+
__failure __msg("Expected an initialized dynptr as arg #2")
15181518
int clone_invalidate2(void *ctx)
15191519
{
15201520
struct bpf_dynptr ptr;
@@ -1535,7 +1535,7 @@ int clone_invalidate2(void *ctx)
15351535

15361536
/* Invalidating a dynptr should invalidate its siblings */
15371537
SEC("?raw_tp")
1538-
__failure __msg("Expected an initialized dynptr as arg #3")
1538+
__failure __msg("Expected an initialized dynptr as arg #2")
15391539
int clone_invalidate3(void *ctx)
15401540
{
15411541
struct bpf_dynptr ptr;
@@ -1723,7 +1723,7 @@ __noinline long global_call_bpf_dynptr(const struct bpf_dynptr *dynptr)
17231723
}
17241724

17251725
SEC("?raw_tp")
1726-
__failure __msg("arg#1 expected pointer to stack or const struct bpf_dynptr")
1726+
__failure __msg("arg#0 expected pointer to stack or const struct bpf_dynptr")
17271727
int test_dynptr_reg_type(void *ctx)
17281728
{
17291729
struct task_struct *current = NULL;

‎tools/testing/selftests/bpf/progs/iters_state_safety.c

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,7 @@ int create_and_forget_to_destroy_fail(void *ctx)
7373
}
7474

7575
SEC("?raw_tp")
76-
__failure __msg("expected an initialized iter_num as arg #1")
76+
__failure __msg("expected an initialized iter_num as arg #0")
7777
int destroy_without_creating_fail(void *ctx)
7878
{
7979
/* init with zeros to stop verifier complaining about uninit stack */
@@ -91,7 +91,7 @@ int destroy_without_creating_fail(void *ctx)
9191
}
9292

9393
SEC("?raw_tp")
94-
__failure __msg("expected an initialized iter_num as arg #1")
94+
__failure __msg("expected an initialized iter_num as arg #0")
9595
int compromise_iter_w_direct_write_fail(void *ctx)
9696
{
9797
struct bpf_iter_num iter;
@@ -143,7 +143,7 @@ int compromise_iter_w_direct_write_and_skip_destroy_fail(void *ctx)
143143
}
144144

145145
SEC("?raw_tp")
146-
__failure __msg("expected an initialized iter_num as arg #1")
146+
__failure __msg("expected an initialized iter_num as arg #0")
147147
int compromise_iter_w_helper_write_fail(void *ctx)
148148
{
149149
struct bpf_iter_num iter;
@@ -230,7 +230,7 @@ int valid_stack_reuse(void *ctx)
230230
}
231231

232232
SEC("?raw_tp")
233-
__failure __msg("expected uninitialized iter_num as arg #1")
233+
__failure __msg("expected uninitialized iter_num as arg #0")
234234
int double_create_fail(void *ctx)
235235
{
236236
struct bpf_iter_num iter;
@@ -258,7 +258,7 @@ int double_create_fail(void *ctx)
258258
}
259259

260260
SEC("?raw_tp")
261-
__failure __msg("expected an initialized iter_num as arg #1")
261+
__failure __msg("expected an initialized iter_num as arg #0")
262262
int double_destroy_fail(void *ctx)
263263
{
264264
struct bpf_iter_num iter;
@@ -284,7 +284,7 @@ int double_destroy_fail(void *ctx)
284284
}
285285

286286
SEC("?raw_tp")
287-
__failure __msg("expected an initialized iter_num as arg #1")
287+
__failure __msg("expected an initialized iter_num as arg #0")
288288
int next_without_new_fail(void *ctx)
289289
{
290290
struct bpf_iter_num iter;
@@ -305,7 +305,7 @@ int next_without_new_fail(void *ctx)
305305
}
306306

307307
SEC("?raw_tp")
308-
__failure __msg("expected an initialized iter_num as arg #1")
308+
__failure __msg("expected an initialized iter_num as arg #0")
309309
int next_after_destroy_fail(void *ctx)
310310
{
311311
struct bpf_iter_num iter;

‎tools/testing/selftests/bpf/progs/iters_testmod_seq.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,7 @@ int testmod_seq_truncated(const void *ctx)
7979

8080
SEC("?raw_tp")
8181
__failure
82-
__msg("expected an initialized iter_testmod_seq as arg #2")
82+
__msg("expected an initialized iter_testmod_seq as arg #1")
8383
int testmod_seq_getter_before_bad(const void *ctx)
8484
{
8585
struct bpf_iter_testmod_seq it;
@@ -89,7 +89,7 @@ int testmod_seq_getter_before_bad(const void *ctx)
8989

9090
SEC("?raw_tp")
9191
__failure
92-
__msg("expected an initialized iter_testmod_seq as arg #2")
92+
__msg("expected an initialized iter_testmod_seq as arg #1")
9393
int testmod_seq_getter_after_bad(const void *ctx)
9494
{
9595
struct bpf_iter_testmod_seq it;

‎tools/testing/selftests/bpf/progs/test_kfunc_dynptr_param.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ int BPF_PROG(not_valid_dynptr, int cmd, union bpf_attr *attr, unsigned int size)
4545
}
4646

4747
SEC("?lsm.s/bpf")
48-
__failure __msg("arg#1 expected pointer to stack or const struct bpf_dynptr")
48+
__failure __msg("arg#0 expected pointer to stack or const struct bpf_dynptr")
4949
int BPF_PROG(not_ptr_to_stack, int cmd, union bpf_attr *attr, unsigned int size)
5050
{
5151
unsigned long val = 0;

‎tools/testing/selftests/bpf/progs/verifier_bits_iter.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ int BPF_PROG(no_destroy, struct bpf_iter_meta *meta, struct cgroup *cgrp)
3232

3333
SEC("iter/cgroup")
3434
__description("uninitialized iter in ->next()")
35-
__failure __msg("expected an initialized iter_bits as arg #1")
35+
__failure __msg("expected an initialized iter_bits as arg #0")
3636
int BPF_PROG(next_uninit, struct bpf_iter_meta *meta, struct cgroup *cgrp)
3737
{
3838
struct bpf_iter_bits it = {};
@@ -43,7 +43,7 @@ int BPF_PROG(next_uninit, struct bpf_iter_meta *meta, struct cgroup *cgrp)
4343

4444
SEC("iter/cgroup")
4545
__description("uninitialized iter in ->destroy()")
46-
__failure __msg("expected an initialized iter_bits as arg #1")
46+
__failure __msg("expected an initialized iter_bits as arg #0")
4747
int BPF_PROG(destroy_uninit, struct bpf_iter_meta *meta, struct cgroup *cgrp)
4848
{
4949
struct bpf_iter_bits it = {};

0 commit comments

Comments
 (0)