OpenCloudOS-Kernel/Documentation
David Vernet 3f00c52393 bpf: Allow trusted pointers to be passed to KF_TRUSTED_ARGS kfuncs
Kfuncs currently support specifying the KF_TRUSTED_ARGS flag to signal
to the verifier that it should enforce that a BPF program passes it a
"safe", trusted pointer. Currently, "safe" means that the pointer is
either PTR_TO_CTX, or is refcounted. There may be cases, however, where
the kernel passes a BPF program a safe / trusted pointer to an object
that the BPF program wishes to use as a kptr, but because the object
does not yet have a ref_obj_id from the perspective of the verifier, the
program would be unable to pass it to a KF_ACQUIRE | KF_TRUSTED_ARGS
kfunc.

The solution is to expand the set of pointers that are considered
trusted according to KF_TRUSTED_ARGS, so that programs can invoke kfuncs
with these pointers without getting rejected by the verifier.

There is already a PTR_UNTRUSTED flag that is set in some scenarios,
such as when a BPF program reads a kptr directly from a map
without performing a bpf_kptr_xchg() call. These pointers of course can
and should be rejected by the verifier. Unfortunately, however,
PTR_UNTRUSTED does not cover all the cases for safety that need to
be addressed to adequately protect kfuncs. Specifically, pointers
obtained by a BPF program "walking" a struct are _not_ considered
PTR_UNTRUSTED according to BPF. For example, say that we were to add a
kfunc called bpf_task_acquire(), with KF_ACQUIRE | KF_TRUSTED_ARGS, to
acquire a struct task_struct *. If we only used PTR_UNTRUSTED to signal
that a task was unsafe to pass to a kfunc, the verifier would mistakenly
allow the following unsafe BPF program to be loaded:

SEC("tp_btf/task_newtask")
int BPF_PROG(unsafe_acquire_task,
             struct task_struct *task,
             u64 clone_flags)
{
        struct task_struct *acquired, *nested;

        nested = task->last_wakee;

        /* Would not be rejected by the verifier. */
        acquired = bpf_task_acquire(nested);
        if (!acquired)
                return 0;

        bpf_task_release(acquired);
        return 0;
}

To address this, this patch defines a new type flag called PTR_TRUSTED
which tracks whether a PTR_TO_BTF_ID pointer is safe to pass to a
KF_TRUSTED_ARGS kfunc or a BPF helper function. PTR_TRUSTED pointers are
passed directly from the kernel as a tracepoint or struct_ops callback
argument. Any nested pointer that is obtained from walking a PTR_TRUSTED
pointer is no longer PTR_TRUSTED. From the example above, the struct
task_struct *task argument is PTR_TRUSTED, but the 'nested' pointer
obtained from 'task->last_wakee' is not PTR_TRUSTED.

A subsequent patch will add kfuncs for storing a task kfunc as a kptr,
and then another patch will add selftests to validate.

Signed-off-by: David Vernet <void@manifault.com>
Link: https://lore.kernel.org/r/20221120051004.3605026-3-void@manifault.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2022-11-20 09:16:21 -08:00
..
ABI memory tier, sysfs: rename attribute "nodes" to "nodelist" 2022-10-28 13:37:22 -07:00
PCI
RCU There's not a huge amount of activity in the docs tree this time around, 2022-10-03 10:23:32 -07:00
accounting filemap: make the accounting of thrashing more consistent 2022-09-26 19:46:06 -07:00
admin-guide media: vivid.rst: loop_video is set on the capture devnode 2022-10-25 16:43:54 +01:00
arc
arm EFI updates for v6.1 2022-10-09 08:56:54 -07:00
arm64 ARM: 2022-11-06 10:46:59 -08:00
block Documentation: document ublk user recovery feature 2022-10-18 05:12:26 -07:00
bpf bpf: Allow trusted pointers to be passed to KF_TRUSTED_ARGS kfuncs 2022-11-20 09:16:21 -08:00
cdrom
core-api overflow: Fix kern-doc markup for functions 2022-10-25 14:57:42 -07:00
cpu-freq
crypto
dev-tools linux-kselftest-kunit-6.1-rc1-2 2022-10-12 15:01:58 -07:00
devicetree dt-bindings: net: qcom,ipa: restate a requirement 2022-11-11 21:23:20 -08:00
doc-guide Rust introduction for v6.1-rc1 2022-10-03 16:39:37 -07:00
driver-api Documentation: devres: add missing I2C helper 2022-11-02 21:16:38 +01:00
fault-injection docs: notifier-error-inject: Correct test's name 2022-10-07 10:32:16 -06:00
fb Documentation: fb: udlfb: clean up text and formatting 2022-09-27 13:21:44 -06:00
features
filesystems A handful of relatively simple documentation fixes, plus a set of patches 2022-10-13 10:58:32 -07:00
firmware-guide Merge branches 'acpi-misc', 'acpi-tools' and 'acpi-docs' 2022-10-03 20:03:49 +02:00
firmware_class
fpga
gpu Immutable backlight-detect-refactor branch between acpi, drm-* and pdx86 2022-09-14 12:27:10 +01:00
hid
hwmon hwmon: (corsair-psu) Add USB id of the new HX1500i psu 2022-10-22 06:59:12 -07:00
i2c docs: i2c: slave-interface: return errno when handle I2C_SLAVE_WRITE_REQUESTED 2022-09-28 21:41:59 +02:00
ia64
iio docs: iio: add documentation for BNO055 driver 2022-09-21 18:42:56 +01:00
images
infiniband
input Merge branch 'next' into for-linus 2022-10-09 22:30:23 -07:00
isdn
kbuild Documentation: kbuild: Add description of git for reproducible builds 2022-10-28 00:16:29 +09:00
kernel-hacking Documentation: Fix spelling mistake in hacking.rst 2022-10-24 11:27:51 -06:00
leds
litmus-tests
livepatch
locking Remove duplicate words inside documentation 2022-09-27 13:21:43 -06:00
loongarch
m68k
maintainer
mhi
mips
misc-devices
mm A handful of relatively simple documentation fixes, plus a set of patches 2022-10-13 10:58:32 -07:00
netlabel
networking devlink: Add packet traps for 802.1X operation 2022-11-09 19:06:14 -08:00
nios2
nvdimm
openrisc
parisc
pcmcia
peci
power
powerpc powerpc/64s: update cpu selection options 2022-09-28 19:22:10 +10:00
process Four small fixes for the docs tree. 2022-11-01 15:11:42 -07:00
riscv doc: RISC-V: Document that misaligned accesses are supported 2022-10-12 08:58:10 -07:00
rust x86: enable initial Rust support 2022-09-28 09:02:45 +02:00
s390 vfio/mdev: embedd struct mdev_parent in the parent data structure 2022-10-04 12:06:58 -06:00
scheduler docs: scheduler: Update new path for the sysctl knobs 2022-09-27 13:21:42 -06:00
scsi scsi: docs: Fix a typo 2022-09-01 00:33:34 -04:00
security landlock: Fix documentation style 2022-09-29 18:43:04 +02:00
sh
sound
sparc
sphinx
sphinx-static
spi
staging docs: put atomic*.txt and memory-barriers.txt into the core-api book 2022-09-29 12:55:06 -06:00
target
timers
tools A handful of relatively simple documentation fixes, plus a set of patches 2022-10-13 10:58:32 -07:00
trace tracing/histogram: Update document for KEYS_MAX size 2022-10-18 15:41:56 -06:00
translations docs/process/howto: Replace C89 with C11 2022-10-24 11:27:51 -06:00
usb usbip: add USBIP_URB_* URB transfer flags 2022-08-31 09:07:53 +02:00
userspace-api media fixes for v6.1-rc2 2022-10-22 15:30:15 -07:00
virt ARM: 2022-10-11 20:07:44 -07:00
w1 Documentation: W1: minor typo corrections 2022-09-27 13:21:44 -06:00
watchdog
x86 - Get rid of a single ksize() usage 2022-10-04 10:12:08 -07:00
xtensa
.gitignore
Changes
CodingStyle
Kconfig
Makefile
SubmittingPatches
arch.rst
atomic_bitops.txt
atomic_t.txt
conf.py There's not a huge amount of activity in the docs tree this time around, 2022-10-03 10:23:32 -07:00
docutils.conf
dontdiff
index.rst Rust introduction for v6.1-rc1 2022-10-03 16:39:37 -07:00
memory-barriers.txt docs/memory-barriers.txt: Fixup long lines 2022-08-31 05:15:31 -07:00
subsystem-apis.rst docs: Rewrite the front page 2022-09-29 12:55:06 -06:00