[PATCH bpf-next v2 18/22] bpf: Apply the patch list without a verifier env

[Qiliang Yuan]

Rewrites outside of the verifier, like the blinding of constants in
classic BPF programs, have no verifier env, and core.c is built without
the verifier as well.

bpf_patch_list_commit() needs the env for the aux data and the tables
of the verifier, so these rewrites can't use the patch list.

Add bpf_patch_list_apply(), which builds the new image of a program,
puts it in place and moves its poke descriptors and line info along.
Without the aux data and the tables of the verifier, it can't remove
instructions.

Signed-off-by: Qiliang Yuan <odys.yuan@xxxxxxxxx>
---
 include/linux/bpf_verifier.h |  1 +
 kernel/bpf/core.c            | 31 +++++++++++++++++++++++++++++++
 2 files changed, 32 insertions(+)

diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h
index 9562665757a79..b133bbaf614ac 100644
--- a/include/linux/bpf_verifier.h
+++ b/include/linux/bpf_verifier.h
@@ -1118,6 +1118,7 @@ int bpf_patch_list_build(const struct bpf_patch_list *pl, const struct bpf_prog
 			 struct bpf_patch_image *img);
 void bpf_patch_image_free(struct bpf_patch_image *img);
 void bpf_patch_image_install(struct bpf_prog *prog, const struct bpf_patch_image *img);
+struct bpf_prog *bpf_patch_list_apply(struct bpf_prog *prog, struct bpf_patch_list *pl);
 
 /* single container for all structs
  * one verifier_env per bpf_check() call
diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c
index 0447e3b4cfa48..10d2c37f81280 100644
--- a/kernel/bpf/core.c
+++ b/kernel/bpf/core.c
@@ -880,6 +880,37 @@ void bpf_patch_image_install(struct bpf_prog *prog, const struct bpf_patch_image
 					      prog->aux->linfo[i].insn_off);
 }
 
+/*
+ * Apply the patches queued for 'prog' without a verifier env, which can't
+ * remove insns. Return the patched program, which may have moved.
+ */
+struct bpf_prog *bpf_patch_list_apply(struct bpf_prog *prog, struct bpf_patch_list *pl)
+{
+	struct bpf_patch_image img;
+	struct bpf_prog *new;
+	int err;
+
+	if (!pl->cnt)
+		return prog;
+
+	err = bpf_patch_list_build(pl, prog, &img);
+	if (!err && WARN_ON_ONCE(img.del))
+		err = -EINVAL;
+	if (!err) {
+		new = bpf_prog_realloc(prog, bpf_prog_size(img.new_cnt), GFP_USER);
+		if (new) {
+			prog = new;
+			bpf_patch_image_install(prog, &img);
+		} else {
+			err = -ENOMEM;
+		}
+	}
+
+	bpf_patch_image_free(&img);
+	bpf_patch_list_release(pl);
+	return err ? ERR_PTR(err) : prog;
+}
+
 static void bpf_prog_kallsyms_del_subprogs(struct bpf_prog *fp)
 {
 	int i;

-- 
2.43.0