bpf: Allow kind_flag for BTF type and decl tags

BTF type tags and decl tags now may have info->kflag set to 1,
changing the semantics of the tag.

Change BTF verification to permit BTF that makes use of this feature:
  * remove kflag check in btf_decl_tag_check_meta(), as both values
    are valid
  * allow kflag to be set for BTF_KIND_TYPE_TAG type in
    btf_ref_type_check_meta()

Make sure kind_flag is NOT set when checking for specific BTF tags,
such as "kptr", "user" etc.

Modify a selftest checking for kflag in decl_tag accordingly.

Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/bpf/20250130201239.1429648-6-ihor.solodrai@linux.dev

diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
index 9de6acddd479b4f5e32a5e6ba43cf369de4cee29..9433b6467bbeaa81168f14379013bae723c8cf19 100644 (file)
--- a/kernel/bpf/btf.c
+++ b/kernel/bpf/btf.c
@@ -2575,7 +2575,7 @@ static int btf_ref_type_check_meta(struct btf_verifier_env *env,
                return -EINVAL;
        }
 
-       if (btf_type_kflag(t)) {
+       if (btf_type_kflag(t) && !btf_type_is_type_tag(t)) {
                btf_verifier_log_type(env, t, "Invalid btf_info kind_flag");
                return -EINVAL;
        }
@@ -3332,6 +3332,8 @@ static int btf_find_kptr(const struct btf *btf, const struct btf_type *t,
                         u32 off, int sz, struct btf_field_info *info, u32 field_mask)
 {
        enum btf_field_type type;
+       const char *tag_value;
+       bool is_type_tag;
        u32 res_id;
 
        /* Permit modifiers on the pointer itself */
@@ -3341,19 +3343,20 @@ static int btf_find_kptr(const struct btf *btf, const struct btf_type *t,
        if (!btf_type_is_ptr(t))
                return BTF_FIELD_IGNORE;
        t = btf_type_by_id(btf, t->type);
-
-       if (!btf_type_is_type_tag(t))
+       is_type_tag = btf_type_is_type_tag(t) && !btf_type_kflag(t);
+       if (!is_type_tag)
                return BTF_FIELD_IGNORE;
        /* Reject extra tags */
        if (btf_type_is_type_tag(btf_type_by_id(btf, t->type)))
                return -EINVAL;
-       if (!strcmp("kptr_untrusted", __btf_name_by_offset(btf, t->name_off)))
+       tag_value = __btf_name_by_offset(btf, t->name_off);
+       if (!strcmp("kptr_untrusted", tag_value))
                type = BPF_KPTR_UNREF;
-       else if (!strcmp("kptr", __btf_name_by_offset(btf, t->name_off)))
+       else if (!strcmp("kptr", tag_value))
                type = BPF_KPTR_REF;
-       else if (!strcmp("percpu_kptr", __btf_name_by_offset(btf, t->name_off)))
+       else if (!strcmp("percpu_kptr", tag_value))
                type = BPF_KPTR_PERCPU;
-       else if (!strcmp("uptr", __btf_name_by_offset(btf, t->name_off)))
+       else if (!strcmp("uptr", tag_value))
                type = BPF_UPTR;
        else
                return -EINVAL;
@@ -4944,11 +4947,6 @@ static s32 btf_decl_tag_check_meta(struct btf_verifier_env *env,
                return -EINVAL;
        }
 
-       if (btf_type_kflag(t)) {
-               btf_verifier_log_type(env, t, "Invalid btf_info kind_flag");
-               return -EINVAL;
-       }
-
        component_idx = btf_type_decl_tag(t)->component_idx;
        if (component_idx < -1) {
                btf_verifier_log_type(env, t, "Invalid component_idx");
@@ -6743,7 +6741,7 @@ bool btf_ctx_access(int off, int size, enum bpf_access_type type,
        info->btf_id = t->type;
        t = btf_type_by_id(btf, t->type);
 
-       if (btf_type_is_type_tag(t)) {
+       if (btf_type_is_type_tag(t) && !btf_type_kflag(t)) {
                tag_value = __btf_name_by_offset(btf, t->name_off);
                if (strcmp(tag_value, "user") == 0)
                        info->reg_type |= MEM_USER;
@@ -7002,7 +7000,7 @@ error:
 
                        /* check type tag */
                        t = btf_type_by_id(btf, mtype->type);
-                       if (btf_type_is_type_tag(t)) {
+                       if (btf_type_is_type_tag(t) && !btf_type_kflag(t)) {
                                tag_value = __btf_name_by_offset(btf, t->name_off);
                                /* check __user tag */
                                if (strcmp(tag_value, "user") == 0)

diff --git a/tools/testing/selftests/bpf/prog_tests/btf.c b/tools/testing/selftests/bpf/prog_tests/btf.c
index e63d74ce046ff29c29ea5b69be2085709946c3f2..aab9ad88c8453b48782d1a1509407c7a677fc1ca 100644 (file)
--- a/tools/testing/selftests/bpf/prog_tests/btf.c
+++ b/tools/testing/selftests/bpf/prog_tests/btf.c
@@ -3866,7 +3866,7 @@ static struct btf_raw_test raw_tests[] = {
        .err_str = "vlen != 0",
 },
 {
-       .descr = "decl_tag test #8, invalid kflag",
+       .descr = "decl_tag test #8, tag with kflag",
        .raw_types = {
                BTF_TYPE_INT_ENC(0, BTF_INT_SIGNED, 0, 32, 4),  /* [1] */
                BTF_VAR_ENC(NAME_TBD, 1, 0),                    /* [2] */
@@ -3881,8 +3881,6 @@ static struct btf_raw_test raw_tests[] = {
        .key_type_id = 1,
        .value_type_id = 1,
        .max_entries = 1,
-       .btf_load_err = true,
-       .err_str = "Invalid btf_info kind_flag",
 },
 {
        .descr = "decl_tag test #9, var, invalid component_idx",