The following types can be returned by the btf_prepare_func_args(): - ARG_PTR_TO_CTX - ARG_PTR_TO_BTF_ID (+ flags) - ARG_PTR_TO_MEM (+ flags) - ARG_PTR_TO_ARENA - ARG_PTR_TO_DYNPTR - ARG_SCALAR Of these, valid programs can pass frame pointer only as ARG_PTR_TO_{MEM,BTF_ID,DYNPTR}. Additionally, pointer arithmetic allows the following trick: 0: (bf) r1 = r10 1: (07) r1 += -8 2: (1f) r1 -= r10 3: (85) call pc+1 // r1=fp0 ? 4: (95) exit This commit changes bpf_global_subprog_stack_access_bytes() to handle ARG_SCALAR and ARG_PTR_TO_DYNPTR, thus addressing the full set of possible returned values. Fixes: 8212c1c2986d ("bpf: Derive global subprog stack liveness from BTF signatures") Signed-off-by: Eduard Zingerman --- kernel/bpf/verifier.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c index fc1937b37dcf..5b6200083d05 100644 --- a/kernel/bpf/verifier.c +++ b/kernel/bpf/verifier.c @@ -14883,7 +14883,7 @@ bpf_global_subprog_stack_access_bytes(struct bpf_verifier_env *env, struct bpf_i switch (base_type(sub->args[arg].arg_type)) { case ARG_UNUSED: /* Not an argument slot. */ - case ARG_ANYTHING: /* A scalar, the callee can't dereference it. */ + case ARG_SCALAR: /* A scalar, the callee can't dereference it. */ return (struct arg_access_info) {}; case ARG_PTR_TO_BTF_ID: /* @@ -14899,6 +14899,10 @@ bpf_global_subprog_stack_access_bytes(struct bpf_verifier_env *env, struct bpf_i info.must_write = true; } return info; + case ARG_PTR_TO_DYNPTR: + /* The callee may adjust the view, but cannot reinitialize the dynptr. */ + info.size = BPF_DYNPTR_SIZE; + return info; default: return info; } -- 2.53.0