bpf: Add __uninit kfunc annotation

This patch adds __uninit as a kfunc annotation.

This will be useful for scenarios such as for example in dynptrs,
indicating whether the dynptr should be checked by the verifier as an
initialized or an uninitialized dynptr.

Without this annotation, the alternative would be needing to hard-code
in the verifier the specific kfunc to indicate that arg should be
treated as an uninitialized arg.

Signed-off-by: Joanne Koong <joannelkoong@gmail.com>
Link: https://lore.kernel.org/r/20230301154953.641654-7-joannelkoong@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

diff --git a/Documentation/bpf/kfuncs.rst b/Documentation/bpf/kfuncs.rst
index 226313747be56a423d00354bbecc528058b9dda0..9a78533d25ac7fd143e5b510c315478017b72e64 100644 (file)
--- a/Documentation/bpf/kfuncs.rst
+++ b/Documentation/bpf/kfuncs.rst
@@ -100,6 +100,23 @@ Hence, whenever a constant scalar argument is accepted by a kfunc which is not a
 size parameter, and the value of the constant matters for program safety, __k
 suffix should be used.
 
+2.2.2 __uninit Annotation
+--------------------
+
+This annotation is used to indicate that the argument will be treated as
+uninitialized.
+
+An example is given below::
+
+        __bpf_kfunc int bpf_dynptr_from_skb(..., struct bpf_dynptr_kern *ptr__uninit)
+        {
+        ...
+        }
+
+Here, the dynptr will be treated as an uninitialized dynptr. Without this
+annotation, the verifier will reject the program if the dynptr passed in is
+not initialized.
+
 .. _BPF_kfunc_nodef:
 
 2.3 Using an existing kernel function

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 8fd2f26a8977479b753dc0aaa3c882b0b7d45cea..d052aa5800de80a4c1dbdc892f7dae980402de52 100644 (file)
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -8727,6 +8727,11 @@ static bool is_kfunc_arg_alloc_obj(const struct btf *btf, const struct btf_param
        return __kfunc_param_match_suffix(btf, arg, "__alloc");
 }
 
+static bool is_kfunc_arg_uninit(const struct btf *btf, const struct btf_param *arg)
+{
+       return __kfunc_param_match_suffix(btf, arg, "__uninit");
+}
+
 static bool is_kfunc_arg_scalar_with_name(const struct btf *btf,
                                          const struct btf_param *arg,
                                          const char *name)
@@ -9662,17 +9667,26 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_
                                return ret;
                        break;
                case KF_ARG_PTR_TO_DYNPTR:
+               {
+                       enum bpf_arg_type dynptr_arg_type = ARG_PTR_TO_DYNPTR;
+
                        if (reg->type != PTR_TO_STACK &&
                            reg->type != CONST_PTR_TO_DYNPTR) {
                                verbose(env, "arg#%d expected pointer to stack or dynptr_ptr\n", i);
                                return -EINVAL;
                        }
 
-                       ret = process_dynptr_func(env, regno, insn_idx,
-                                                 ARG_PTR_TO_DYNPTR | MEM_RDONLY);
+                       if (reg->type == CONST_PTR_TO_DYNPTR)
+                               dynptr_arg_type |= MEM_RDONLY;
+
+                       if (is_kfunc_arg_uninit(btf, &args[i]))
+                               dynptr_arg_type |= MEM_UNINIT;
+
+                       ret = process_dynptr_func(env, regno, insn_idx, dynptr_arg_type);
                        if (ret < 0)
                                return ret;
                        break;
+               }
                case KF_ARG_PTR_TO_LIST_HEAD:
                        if (reg->type != PTR_TO_MAP_VALUE &&
                            reg->type != (PTR_TO_BTF_ID | MEM_ALLOC)) {