bpf: Check ARG_PTR_TO_SPINLOCK register type in check_func_arg

Move the check for PTR_TO_MAP_VALUE to check_func_arg, where all other
checking is done as well. Move the invocation of process_spin_lock away
from the register type checking, to allow a future refactoring.

Signed-off-by: Lorenz Bauer <lmb@cloudflare.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Link: https://lore.kernel.org/bpf/20200921121227.255763-10-lmb@cloudflare.com

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 446fbe7f6b491e787af7e3216ef1a6fbd08abfb5..779091cb5bddaf8d66d2709088d3a86bf6fd99ec 100644 (file)
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -3828,10 +3828,6 @@ static int process_spin_lock(struct bpf_verifier_env *env, int regno,
        struct bpf_map *map = reg->map_ptr;
        u64 val = reg->var_off.value;
 
-       if (reg->type != PTR_TO_MAP_VALUE) {
-               verbose(env, "R%d is not a pointer to map_value\n", regno);
-               return -EINVAL;
-       }
        if (!is_const) {
                verbose(env,
                        "R%d doesn't have constant offset. bpf_spin_lock has to be at the constant offset\n",
@@ -4040,16 +4036,9 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
                if (type != expected_type)
                        goto err_type;
        } else if (arg_type == ARG_PTR_TO_SPIN_LOCK) {
-               if (meta->func_id == BPF_FUNC_spin_lock) {
-                       if (process_spin_lock(env, regno, true))
-                               return -EACCES;
-               } else if (meta->func_id == BPF_FUNC_spin_unlock) {
-                       if (process_spin_lock(env, regno, false))
-                               return -EACCES;
-               } else {
-                       verbose(env, "verifier internal error\n");
-                       return -EFAULT;
-               }
+               expected_type = PTR_TO_MAP_VALUE;
+               if (type != expected_type)
+                       goto err_type;
        } else if (arg_type_is_mem_ptr(arg_type)) {
                expected_type = PTR_TO_STACK;
                /* One exception here. In case function allows for NULL to be
@@ -4155,6 +4144,17 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
                err = check_helper_mem_access(env, regno,
                                              meta->map_ptr->value_size, false,
                                              meta);
+       } else if (arg_type == ARG_PTR_TO_SPIN_LOCK) {
+               if (meta->func_id == BPF_FUNC_spin_lock) {
+                       if (process_spin_lock(env, regno, true))
+                               return -EACCES;
+               } else if (meta->func_id == BPF_FUNC_spin_unlock) {
+                       if (process_spin_lock(env, regno, false))
+                               return -EACCES;
+               } else {
+                       verbose(env, "verifier internal error\n");
+                       return -EFAULT;
+               }
        } else if (arg_type_is_mem_ptr(arg_type)) {
                /* The access to this pointer is only checked when we hit the
                 * next is_mem_size argument below.