On Wed, 2024-02-21 at 17:25 +0100, Benjamin Tissoires wrote:
[...]
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index f81c799b2c80..2b11687063ff 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -5444,6 +5444,26 @@ static int check_map_access(struct bpf_verifier_env *env, u32 regno, return -EACCES; } break;
case BPF_TIMER:/* FIXME: kptr does the above, should we use the same? */
I don't think so. Basically this allows double word reads / writes from timer address, which probably should not be allowed.
The ACCESS_DIRECT is passed to check_map_access() from check_mem_access() and I don't see points where check_mem_access() call would be triggered for pointer parameter of kfunc (unless it is accompanied by a size parameter).
I tried the following simple program and it verifies fine:
struct elem { struct bpf_timer t; };
struct { __uint(type, BPF_MAP_TYPE_ARRAY); __uint(max_entries, 2); __type(key, int); __type(value, struct elem); } array SEC(".maps");
int bpf_timer_set_sleepable_cb (struct bpf_timer *timer, int (callback_fn)(void *map, int *key, struct bpf_timer *timer)) __ksym __weak;
static int cb_sleepable(void *map, int *key, struct bpf_timer *timer) { return 0; }
SEC("fentry/bpf_fentry_test5") int BPF_PROG2(test_sleepable, int, a) { struct bpf_timer *arr_timer; int array_key = ARRAY;
arr_timer = bpf_map_lookup_elem(&array, &array_key); if (!arr_timer) return 0; bpf_timer_init(arr_timer, &array, CLOCK_MONOTONIC);
bpf_timer_set_sleepable_cb(arr_timer, cb_sleepable); bpf_timer_start(arr_timer, 0, 0);
return 0; }
(in general, it would be easier to review if there were some test cases to play with).
if (src != ACCESS_DIRECT) {verbose(env, "bpf_timer cannot be accessed indirectly by helper\n");return -EACCES;}if (!tnum_is_const(reg->var_off)) {verbose(env, "bpf_timer access cannot have variable offset\n");return -EACCES;}if (p != off + reg->var_off.value) {verbose(env, "bpf_timer access misaligned expected=%u off=%llu\n",p, off + reg->var_off.value);return -EACCES;}if (size != bpf_size_to_bytes(BPF_DW)) {verbose(env, "bpf_timer access size must be BPF_DW\n");return -EACCES;}break; default: verbose(env, "%s cannot be accessed directly by load/store\n", btf_field_type_name(field->type));
[...]