Add SCALAR_MAYBE_ZERO as an alias of PTR_MAYBE_NULL for scalar size arguments, and define ARG_CONST_SIZE_OR_ZERO as ARG_CONST_SIZE | SCALAR_MAYBE_ZERO instead of a distinct base type. This lets check_func_arg() handle both with a single ARG_CONST_SIZE case, and the redundant compatible_reg_types[] entry is dropped. Signed-off-by: Amery Hung --- include/linux/bpf.h | 4 +++- kernel/bpf/verifier.c | 12 ++---------- 2 files changed, 5 insertions(+), 11 deletions(-) diff --git a/include/linux/bpf.h b/include/linux/bpf.h index e066f44a9c05..1d537ec557ec 100644 --- a/include/linux/bpf.h +++ b/include/linux/bpf.h @@ -748,6 +748,7 @@ extern const struct bpf_map_ops bpf_map_offload_ops; enum bpf_type_flag { /* PTR may be NULL. */ PTR_MAYBE_NULL = BIT(0 + BPF_BASE_TYPE_BITS), + SCALAR_MAYBE_ZERO = PTR_MAYBE_NULL, /* MEM is read-only. When applied on bpf_arg, it indicates the arg is * compatible with both mutable and immutable memory. @@ -889,7 +890,6 @@ enum bpf_arg_type { ARG_PTR_TO_ARENA, ARG_CONST_SIZE, /* number of bytes accessed from memory */ - ARG_CONST_SIZE_OR_ZERO, /* number of bytes accessed from memory or 0 */ ARG_PTR_TO_CTX, /* pointer to context */ ARG_ANYTHING, /* any (initialized) argument is ok */ @@ -922,6 +922,8 @@ enum bpf_arg_type { ARG_PTR_TO_UNINIT_MEM = MEM_UNINIT | MEM_WRITE | ARG_PTR_TO_MEM, /* Pointer to valid memory of size known at compile time. */ ARG_PTR_TO_FIXED_SIZE_MEM = MEM_FIXED_SIZE | ARG_PTR_TO_MEM, + /* Number of bytes accessed from memory, or 0. */ + ARG_CONST_SIZE_OR_ZERO = SCALAR_MAYBE_ZERO | ARG_CONST_SIZE, /* This must be the last entry. Its purpose is to ensure the enum is * wide enough to hold the higher bits reserved for bpf_type_flag. diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index 4606294e444a..cd77aacad34f 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -7724,8 +7724,7 @@ static int process_iter_next_call(struct bpf_verifier_env *env, int insn_idx, static bool arg_type_is_mem_size(enum bpf_arg_type type) { - return type == ARG_CONST_SIZE || - type == ARG_CONST_SIZE_OR_ZERO; + return base_type(type) == ARG_CONST_SIZE; } static bool arg_type_is_raw_mem(enum bpf_arg_type type) @@ -7872,7 +7871,6 @@ static const struct bpf_reg_types *compatible_reg_types[__BPF_ARG_TYPE_MAX] = { [ARG_PTR_TO_MAP_KEY] = &mem_types, [ARG_PTR_TO_MAP_VALUE] = &mem_types, [ARG_CONST_SIZE] = &scalar_types, - [ARG_CONST_SIZE_OR_ZERO] = &scalar_types, [ARG_CONST_ALLOC_SIZE_OR_ZERO] = &scalar_types, [ARG_CONST_MAP_PTR] = &const_map_ptr_types, [ARG_PTR_TO_CTX] = &context_types, @@ -8494,13 +8492,7 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg, err = check_mem_size_reg(env, reg_state(env, regno - 1), reg, argno_from_reg(regno - 1), argno, fn->arg_type[arg - 1] & MEM_WRITE ? BPF_WRITE : BPF_READ, - false, meta); - break; - case ARG_CONST_SIZE_OR_ZERO: - err = check_mem_size_reg(env, reg_state(env, regno - 1), reg, - argno_from_reg(regno - 1), argno, - fn->arg_type[arg - 1] & MEM_WRITE ? BPF_WRITE : BPF_READ, - true, meta); + arg_type & SCALAR_MAYBE_ZERO, meta); break; case ARG_PTR_TO_DYNPTR: err = process_dynptr_func(env, reg, argno, insn_idx, arg_type, &meta->ref_obj, -- 2.52.0