[PATCH bpf v2 1/2] bpf: Require referenced or trusted pointer for __arg_trusted arg

[Yiyang Chen]

A global subprogram parameter tagged __arg_trusted is specified to
accept only the PTR_TRUSTED flavor of PTR_TO_BTF_ID, but the call-site
check in btf_check_func_arg_match() also accepts a bare PTR_TO_BTF_ID
and an MEM_RCU one.

check_reg_type() resolves the accepted set from the base argument type
alone and compares only MEM_RDONLY and PTR_MAYBE_NULL, so the
PTR_TRUSTED bit of arg_type is never consulted. btf_ptr_types lists
bare PTR_TO_BTF_ID and PTR_TO_BTF_ID | MEM_RCU alongside the trusted
flavor, and nothing else on the subprogram call path requires the
register to be referenced or trusted.

The callee is then validated with PTR_TRUSTED set on the register
while the caller passed a pointer that is neither referenced nor
trusted. bpf_may_fault_on_deref() is false for PTR_TRUSTED, so the
dereference becomes a raw load instead of a BPF_PROBE_MEM probe,
is_trusted_reg() kfuncs accept the pointer, and the callee can pass it
on to a kfunc that would have rejected it at the original call site.

Reject a PTR_TO_BTF_ID that is neither referenced nor trusted when the
argument is marked PTR_TRUSTED. A referenced register is accepted, as
in is_trusted_reg(). PTR_MAYBE_NULL is not counted as an unsafe
modifier when __arg_nullable declares it, so trusted-and-nullable
arguments keep working.

The check runs after check_reg_type() and check_func_arg_reg_off()
succeed so that type and offset diagnostics keep their current wording.
The kfunc path is unchanged.

Fixes: e2b3c4ff5d183da6d1863c2321413406a2752e7a ("bpf: add __arg_trusted global func arg tag")
Signed-off-by: Yiyang Chen <chenyy23@xxxxxxxxxxxxxxxxxxxxx>
---
 kernel/bpf/verifier.c | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 5f874979b8d75..c781e013c25cb 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -9806,6 +9806,30 @@ static int btf_check_func_arg_match(struct bpf_verifier_env *env, int subprog,
 			err = err ?: check_func_arg_reg_off(env, reg, argno, arg->arg_type);
 			if (err)
 				return err;
+
+			/* A __arg_trusted argument requires a referenced or trusted
+			 * pointer. btf_ptr_types also matches a bare PTR_TO_BTF_ID and
+			 * an MEM_RCU one, but neither is referenced or trusted, so the
+			 * callee would be verified with PTR_TRUSTED while the caller
+			 * passed something that is not. PTR_MAYBE_NULL is not counted
+			 * as unsafe when __arg_nullable declares it, because
+			 * bpf_type_has_unsafe_modifiers() treats that flag as unsafe.
+			 *
+			 * Checked after the type/offset match so that type and offset
+			 * diagnostics keep their current wording.
+			 */
+			if (arg->arg_type & PTR_TRUSTED) {
+				u32 flags = type_flag(reg->type);
+
+				if (!reg_is_referenced(env, reg) &&
+				    (!(flags & BPF_REG_TRUSTED_MODIFIERS) ||
+				     (flags & ~(BPF_REG_TRUSTED_MODIFIERS |
+						(arg->arg_type & PTR_MAYBE_NULL))))) {
+					bpf_log(log, "%s must be referenced or trusted\n",
+						reg_arg_name(env, argno));
+					return -EINVAL;
+				}
+			}
 		} else {
 			verifier_bug(env, "unrecognized %s type %d",
 				     reg_arg_name(env, argno), arg->arg_type);

-- 
2.43.0