bpf: allow passing struct bpf_iter_<type> as kfunc arguments

There are potentially useful cases where a specific iterator type might
need to be passed into some kfunc. So, in addition to existing
bpf_iter_<type>_{new,next,destroy}() kfuncs, allow to pass iterator
pointer to any kfunc.

We employ "__iter" naming suffix for arguments that are meant to accept
iterators. We also enforce that they accept PTR -> STRUCT btf_iter_<type>
type chain and point to a valid initialized on-the-stack iterator state.

Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/r/20240808232230.2848712-3-andrii@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index df3be12096cf2415b9c602bbeb6846bd66703900..920d7c5fe9441c343cf4b0f0a72ea26583d7870c 100644 (file)
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -7970,12 +7970,17 @@ static bool is_iter_destroy_kfunc(struct bpf_kfunc_call_arg_meta *meta)
        return meta->kfunc_flags & KF_ITER_DESTROY;
 }
 
-static bool is_kfunc_arg_iter(struct bpf_kfunc_call_arg_meta *meta, int arg)
+static bool is_kfunc_arg_iter(struct bpf_kfunc_call_arg_meta *meta, int arg_idx,
+                             const struct btf_param *arg)
 {
        /* btf_check_iter_kfuncs() guarantees that first argument of any iter
         * kfunc is iter state pointer
         */
-       return arg == 0 && is_iter_kfunc(meta);
+       if (is_iter_kfunc(meta))
+               return arg_idx == 0;
+
+       /* iter passed as an argument to a generic kfunc */
+       return btf_param_match_suffix(meta->btf, arg, "__iter");
 }
 
 static int process_iter_arg(struct bpf_verifier_env *env, int regno, int insn_idx,
@@ -7983,14 +7988,20 @@ static int process_iter_arg(struct bpf_verifier_env *env, int regno, int insn_id
 {
        struct bpf_reg_state *regs = cur_regs(env), *reg = &regs[regno];
        const struct btf_type *t;
-       const struct btf_param *arg;
-       int spi, err, i, nr_slots;
-       u32 btf_id;
+       int spi, err, i, nr_slots, btf_id;
 
-       /* btf_check_iter_kfuncs() ensures we don't need to validate anything here */
-       arg = &btf_params(meta->func_proto)[0];
-       t = btf_type_skip_modifiers(meta->btf, arg->type, NULL);        /* PTR */
-       t = btf_type_skip_modifiers(meta->btf, t->type, &btf_id);       /* STRUCT */
+       /* For iter_{new,next,destroy} functions, btf_check_iter_kfuncs()
+        * ensures struct convention, so we wouldn't need to do any BTF
+        * validation here. But given iter state can be passed as a parameter
+        * to any kfunc, if arg has "__iter" suffix, we need to be a bit more
+        * conservative here.
+        */
+       btf_id = btf_check_iter_arg(meta->btf, meta->func_proto, regno - 1);
+       if (btf_id < 0) {
+               verbose(env, "expected valid iter pointer as arg #%d\n", regno);
+               return -EINVAL;
+       }
+       t = btf_type_by_id(meta->btf, btf_id);
        nr_slots = t->size / BPF_REG_SIZE;
 
        if (is_iter_new_kfunc(meta)) {
@@ -8012,7 +8023,9 @@ static int process_iter_arg(struct bpf_verifier_env *env, int regno, int insn_id
                if (err)
                        return err;
        } else {
-               /* iter_next() or iter_destroy() expect initialized iter state*/
+               /* iter_next() or iter_destroy(), as well as any kfunc
+                * accepting iter argument, expect initialized iter state
+                */
                err = is_iter_reg_valid_init(env, reg, meta->btf, btf_id, nr_slots);
                switch (err) {
                case 0:
@@ -11382,7 +11395,7 @@ get_kfunc_ptr_arg_type(struct bpf_verifier_env *env,
        if (is_kfunc_arg_dynptr(meta->btf, &args[argno]))
                return KF_ARG_PTR_TO_DYNPTR;
 
-       if (is_kfunc_arg_iter(meta, argno))
+       if (is_kfunc_arg_iter(meta, argno, &args[argno]))
                return KF_ARG_PTR_TO_ITER;
 
        if (is_kfunc_arg_list_head(meta->btf, &args[argno]))