bpf: Unify referenced object tracking in verifier

Helpers and kfuncs independently tracked referenced object metadata
using standalone id fields in their respective arg_meta structs.
This led to duplicated logic and inconsistent error handling between the
two paths.

Introduce struct ref_obj_desc to consolidate id and parent_id along with
a count of how many arguments carry a reference. Add update_ref_obj() to
populate it from a bpf_reg_state, replacing open-coded assignments in
check_func_arg(), check_kfunc_args(), and process_iter_arg(). Add
validate_ref_obj() to check for ambiguous ref_obj before using it.

For ref_obj releasing helpers and kfuncs, keep checking it before
calling update_ref_obj() for now. A later patch will make these
functions not depending on ref_obj. For other users of ref_obj, move the
checks to the use locations. For helper, this means moving the checks
inside helper_multiple_ref_obj_use() to use locations.
is_acquire_function() is dropped as ref_obj is never used.

Pass ref_obj_desc into process_dynptr_func()/mark_stack_slots_dynptr()
instead of a bare parent_id to make it less confusing.

Drop the selftest introduced in 7ec899ac90a2 ("selftests/bpf: Negative
test case for ref_obj_id in args") since the verifier no longer
complains about ambiguous ref_obj if it is not used.

Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Amery Hung <ameryhung@gmail.com>
Link: https://lore.kernel.org/r/20260529014936.2811085-8-ameryhung@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h
index 75b287d8d92f50d904f9fd22dc315261de5ce21b..b0521ba7787a36887537944a9e7554c946f10f6c 100644 (file)
--- a/include/linux/bpf_verifier.h
+++ b/include/linux/bpf_verifier.h
@@ -1424,6 +1424,18 @@ struct bpf_dynptr_desc {
        u32 parent_id;
 };
 
+/*
+ * The last seen rereferenced object; Updated by update_ref_obj() when a register refers to a
+ * referenced object. Used when the helper or kfunc is releasing a referenced object, casting
+ * a referenced object, returning allocated memory derived from referenced object or creating
+ * a dynptr with a referenced object as parent.
+ */
+struct ref_obj_desc {
+       u32 id;
+       u32 parent_id;
+       u8 cnt;
+};
+
 struct bpf_kfunc_call_arg_meta {
        /* In parameters */
        struct btf *btf;
@@ -1432,7 +1444,6 @@ struct bpf_kfunc_call_arg_meta {
        const struct btf_type *func_proto;
        const char *func_name;
        /* Out parameters */
-       u32 id;
        u8 release_regno;
        bool r0_rdonly;
        u32 ret_btf_id;
@@ -1470,6 +1481,7 @@ struct bpf_kfunc_call_arg_meta {
        } iter;
        struct bpf_map_desc map;
        struct bpf_dynptr_desc dynptr;
+       struct ref_obj_desc ref_obj;
        u64 mem_size;
 };
 

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 4f75e5f95d2773192cba893ec67b5fd17568e7d9..bc8a09c858d8999865bab0732d509e5914fa7d53 100644 (file)
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -231,9 +231,28 @@ static void bpf_map_key_store(struct bpf_insn_aux_data *aux, u64 state)
                             (poisoned ? BPF_MAP_KEY_POISON : 0ULL);
 }
 
+static void update_ref_obj(struct ref_obj_desc *ref_obj, struct bpf_reg_state *reg)
+{
+       ref_obj->id = reg->id;
+       ref_obj->parent_id = reg->parent_id;
+       ref_obj->cnt++;
+}
+
+static int validate_ref_obj(struct bpf_verifier_env *env, struct ref_obj_desc *ref_obj)
+{
+       if (ref_obj->cnt > 1) {
+               verifier_bug(env, "function expects only one referenced object but got %d\n",
+                            ref_obj->cnt);
+               return -EFAULT;
+       }
+
+       return 0;
+}
+
 struct bpf_call_arg_meta {
        struct bpf_map_desc map;
        struct bpf_dynptr_desc dynptr;
+       struct ref_obj_desc ref_obj;
        bool raw_mode;
        bool pkt_access;
        u8 release_regno;
@@ -241,7 +260,6 @@ struct bpf_call_arg_meta {
        int access_size;
        int mem_size;
        u64 msize_max_value;
-       u32 id;
        int func_id;
        struct btf *btf;
        u32 btf_id;
@@ -528,20 +546,6 @@ bool bpf_is_may_goto_insn(struct bpf_insn *insn)
        return insn->code == (BPF_JMP | BPF_JCOND) && insn->src_reg == BPF_MAY_GOTO;
 }
 
-static bool helper_multiple_ref_obj_use(enum bpf_func_id func_id,
-                                       const struct bpf_map *map)
-{
-       int ref_obj_uses = 0;
-
-       if (is_ptr_cast_function(func_id))
-               ref_obj_uses++;
-       if (is_acquire_function(func_id, map))
-               ref_obj_uses++;
-
-       return ref_obj_uses > 1;
-}
-
-
 static bool is_spi_bounds_valid(struct bpf_func_state *state, int spi, int nr_slots)
 {
        int allocated_slots = state->allocated_stack / BPF_REG_SIZE;
@@ -670,11 +674,11 @@ static int destroy_if_dynptr_stack_slot(struct bpf_verifier_env *env,
                                        struct bpf_func_state *state, int spi);
 
 static int mark_stack_slots_dynptr(struct bpf_verifier_env *env, struct bpf_reg_state *reg,
-                                  enum bpf_arg_type arg_type, int insn_idx, int parent_id,
-                                  struct bpf_dynptr_desc *dynptr)
+                                  enum bpf_arg_type arg_type, int insn_idx,
+                                  struct ref_obj_desc *ref_obj, struct bpf_dynptr_desc *dynptr)
 {
        struct bpf_func_state *state = bpf_func(env, reg);
-       int spi, i, err;
+       int spi, i, err, parent_id = 0;
        enum bpf_dynptr_type type;
 
        spi = dynptr_get_spi(env, reg);
@@ -707,6 +711,13 @@ static int mark_stack_slots_dynptr(struct bpf_verifier_env *env, struct bpf_reg_
                return -EINVAL;
 
        if (dynptr->type == BPF_DYNPTR_TYPE_INVALID) { /* dynptr constructors */
+               err = validate_ref_obj(env, ref_obj);
+               if (err)
+                       return err;
+
+               /* Track parent's id if the parent is a referenced object */
+               parent_id = ref_obj->id;
+
                if (dynptr_type_referenced(type)) {
                        int id;
 
@@ -7188,7 +7199,7 @@ static int process_kptr_func(struct bpf_verifier_env *env, int regno,
  */
 static int process_dynptr_func(struct bpf_verifier_env *env, struct bpf_reg_state *reg,
                               argno_t argno, int insn_idx, enum bpf_arg_type arg_type,
-                              int parent_id, struct bpf_dynptr_desc *dynptr)
+                              struct ref_obj_desc *ref_obj, struct bpf_dynptr_desc *dynptr)
 {
        int spi, err = 0;
 
@@ -7229,7 +7240,7 @@ static int process_dynptr_func(struct bpf_verifier_env *env, struct bpf_reg_stat
                                return err;
                }
 
-               err = mark_stack_slots_dynptr(env, reg, arg_type, insn_idx, parent_id, dynptr);
+               err = mark_stack_slots_dynptr(env, reg, arg_type, insn_idx, ref_obj, dynptr);
        } else /* OBJ_RELEASE and None case from above */ {
                /* For the reg->type == PTR_TO_STACK case, bpf_dynptr is never const */
                if (reg->type == CONST_PTR_TO_DYNPTR && (arg_type & OBJ_RELEASE)) {
@@ -7277,13 +7288,6 @@ static int process_dynptr_func(struct bpf_verifier_env *env, struct bpf_reg_stat
        return err;
 }
 
-static u32 iter_ref_id(struct bpf_verifier_env *env, struct bpf_reg_state *reg, int spi)
-{
-       struct bpf_func_state *state = bpf_func(env, reg);
-
-       return state->stack[spi].spilled_ptr.id;
-}
-
 static bool is_iter_kfunc(struct bpf_kfunc_call_arg_meta *meta)
 {
        return meta->kfunc_flags & (KF_ITER_NEW | KF_ITER_NEXT | KF_ITER_DESTROY);
@@ -7316,6 +7320,7 @@ static bool is_kfunc_arg_iter(struct bpf_kfunc_call_arg_meta *meta, int arg_idx,
 static int process_iter_arg(struct bpf_verifier_env *env, struct bpf_reg_state *reg, argno_t argno, int insn_idx,
                            struct bpf_kfunc_call_arg_meta *meta)
 {
+       struct bpf_func_state *state = bpf_func(env, reg);
        const struct btf_type *t;
        u32 arg_idx = arg_idx_from_argno(argno);
        int spi, err, i, nr_slots, btf_id;
@@ -7387,7 +7392,7 @@ static int process_iter_arg(struct bpf_verifier_env *env, struct bpf_reg_state *
                /* remember meta->iter info for process_iter_next_call() */
                meta->iter.spi = spi;
                meta->iter.frameno = reg->frameno;
-               meta->id = iter_ref_id(env, reg, spi);
+               update_ref_obj(&meta->ref_obj, &state->stack[spi].spilled_ptr);
 
                if (is_iter_destroy_kfunc(meta)) {
                        err = unmark_stack_slots_iter(env, reg, nr_slots);
@@ -8166,6 +8171,7 @@ static int check_func_arg(struct bpf_verifier_env *env, u32 arg,
        u32 regno = BPF_REG_1 + arg;
        struct bpf_reg_state *reg = reg_state(env, regno);
        enum bpf_arg_type arg_type = fn->arg_type[arg];
+       argno_t argno = argno_from_arg(arg + 1);
        enum bpf_reg_type type = reg->type;
        u32 *arg_btf_id = NULL;
        u32 key_size;
@@ -8232,15 +8238,8 @@ skip_type_check:
                meta->release_regno = regno;
        }
 
-       if (reg_is_referenced(env, reg) && base_type(arg_type) != ARG_KPTR_XCHG_DEST) {
-               if (meta->id) {
-                       verbose(env, "more than one arg with referenced id R%d %u %u",
-                               regno, reg->id,
-                               meta->id);
-                       return -EACCES;
-               }
-               meta->id = reg->id;
-       }
+       if (reg_is_referenced(env, reg))
+               update_ref_obj(&meta->ref_obj, reg);
 
        switch (base_type(arg_type)) {
        case ARG_CONST_MAP_PTR:
@@ -8379,7 +8378,7 @@ skip_type_check:
                                         true, meta);
                break;
        case ARG_PTR_TO_DYNPTR:
-               err = process_dynptr_func(env, reg, argno_from_reg(regno), insn_idx, arg_type, 0,
+               err = process_dynptr_func(env, reg, argno_from_reg(regno), insn_idx, arg_type, &meta->ref_obj,
                                          &meta->dynptr);
                if (err)
                        return err;
@@ -9042,6 +9041,7 @@ static int btf_check_func_arg_match(struct bpf_verifier_env *env, int subprog,
        struct bpf_subprog_info *sub = subprog_info(env, subprog);
        struct bpf_func_state *caller = cur_func(env);
        struct bpf_verifier_log *log = &env->log;
+       struct ref_obj_desc ref_obj = {};
        u32 i;
        int ret, err;
 
@@ -9119,7 +9119,7 @@ static int btf_check_func_arg_match(struct bpf_verifier_env *env, int subprog,
                        if (ret)
                                return ret;
 
-                       ret = process_dynptr_func(env, reg, argno, -1, arg->arg_type, 0, NULL);
+                       ret = process_dynptr_func(env, reg, argno, -1, arg->arg_type, &ref_obj, NULL);
                        if (ret)
                                return ret;
                } else if (base_type(arg->arg_type) == ARG_PTR_TO_BTF_ID) {
@@ -10125,8 +10125,8 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn
                err = -EINVAL;
                if (arg_type_is_dynptr(fn->arg_type[meta.release_regno - BPF_REG_1])) {
                        err = unmark_stack_slots_dynptr(env, &regs[meta.release_regno]);
-               } else if (func_id == BPF_FUNC_kptr_xchg && meta.id) {
-                       u32 id = meta.id;
+               } else if (func_id == BPF_FUNC_kptr_xchg && meta.ref_obj.id) {
+                       u32 id = meta.ref_obj.id;
                        bool in_rcu = in_rcu_cs(env);
                        struct bpf_func_state *state;
                        struct bpf_reg_state *reg;
@@ -10145,10 +10145,10 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn
                                        }
                                }));
                        }
-               } else if (meta.id) {
-                       err = release_reference(env, meta.id);
+               } else if (meta.ref_obj.id) {
+                       err = release_reference(env, meta.ref_obj.id);
                } else if (bpf_register_is_null(&regs[meta.release_regno])) {
-                       /* meta.id can only be 0 if register that is meant to be
+                       /* meta.ref_obj.id can only be 0 if register that is meant to be
                         * released is NULL, which must be > R0.
                         */
                        err = 0;
@@ -10413,17 +10413,15 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn
        if (type_may_be_null(regs[BPF_REG_0].type))
                regs[BPF_REG_0].id = ++env->id_gen;
 
-       if (helper_multiple_ref_obj_use(func_id, meta.map.ptr)) {
-               verifier_bug(env, "func %s#%d sets ref_obj_id more than once",
-                            func_id_name(func_id), func_id);
-               return -EFAULT;
-       }
-
        if (is_ptr_cast_function(func_id) &&
-           find_reference_state(env->cur_state, meta.id)) {
+           find_reference_state(env->cur_state, meta.ref_obj.id)) {
                struct bpf_verifier_state *branch;
                struct bpf_reg_state *r0;
 
+               err = validate_ref_obj(env, &meta.ref_obj);
+               if (err)
+                       return err;
+
                /*
                 * In order for a release of any of the original or cast pointers
                 * to invalidate all other pointers, reuse the same reference id for
@@ -10441,7 +10439,7 @@ static int check_helper_call(struct bpf_verifier_env *env, struct bpf_insn *insn
                r0->type = SCALAR_VALUE;
 
                regs[BPF_REG_0].type &= ~PTR_MAYBE_NULL;
-               regs[BPF_REG_0].id = meta.id;
+               regs[BPF_REG_0].id = meta.ref_obj.id;
        } else if (is_acquire_function(func_id, meta.map.ptr)) {
                int id = acquire_reference(env, insn_idx, 0);
 
@@ -11915,13 +11913,13 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_
                }
 
                if (reg_is_referenced(env, reg)) {
-                       if (is_kfunc_release(meta) && meta->id) {
-                               verifier_bug(env, "more than one arg with referenced id %s %u %u",
-                                            reg_arg_name(env, argno), reg->id,
-                                            meta->id);
+                       if (is_kfunc_release(meta) && meta->ref_obj.cnt) {
+                               verbose(env, "more than one arg with referenced id %s %u %u",
+                                       reg_arg_name(env, argno), reg->id,
+                                       meta->ref_obj.id);
                                return -EFAULT;
                        }
-                       meta->id = reg->id;
+                       update_ref_obj(&meta->ref_obj, reg);
                        if (is_kfunc_release(meta)) {
                                if (regno < 0) {
                                        verbose(env, "%s release arg cannot be a stack argument\n",
@@ -12104,7 +12102,7 @@ static int check_kfunc_args(struct bpf_verifier_env *env, struct bpf_kfunc_call_
                        }
 
                        ret = process_dynptr_func(env, reg, argno, insn_idx, dynptr_arg_type,
-                                                 meta->id, &meta->dynptr);
+                                                 &meta->ref_obj, &meta->dynptr);
                        if (ret < 0)
                                return ret;
                        break;
@@ -13048,8 +13046,12 @@ static int check_kfunc_call(struct bpf_verifier_env *env, struct bpf_insn *insn,
                                regs[BPF_REG_0].type |= MEM_RDONLY;
 
                        /* Ensures we don't access the memory after a release_reference() */
-                       if (meta.id)
-                               regs[BPF_REG_0].parent_id = meta.id;
+                       if (meta.ref_obj.id) {
+                               err = validate_ref_obj(env, &meta.ref_obj);
+                               if (err)
+                                       return err;
+                               regs[BPF_REG_0].parent_id = meta.ref_obj.id;
+                       }
 
                        if (is_kfunc_rcu_protected(&meta))
                                regs[BPF_REG_0].type |= MEM_RCU;

diff --git a/tools/testing/selftests/bpf/progs/test_ringbuf_map_key.c b/tools/testing/selftests/bpf/progs/test_ringbuf_map_key.c
index 21bb7da90ea50de5b97df7b26d812c21e4f79241..0efafa927a3d13b9c20ecca1660faac238ea0b59 100644 (file)
--- a/tools/testing/selftests/bpf/progs/test_ringbuf_map_key.c
+++ b/tools/testing/selftests/bpf/progs/test_ringbuf_map_key.c
@@ -35,7 +35,7 @@ SEC("fentry/" SYS_PREFIX "sys_getpgid")
 int test_ringbuf_mem_map_key(void *ctx)
 {
        int cur_pid = bpf_get_current_pid_tgid() >> 32;
-       struct sample *sample, sample_copy;
+       struct sample *sample;
        int *lookup_val;
 
        if (cur_pid != pid)
@@ -55,16 +55,11 @@ int test_ringbuf_mem_map_key(void *ctx)
        lookup_val = (int *)bpf_map_lookup_elem(&hash_map, sample);
        __sink(lookup_val);
 
-       /* workaround - memcpy is necessary so that verifier doesn't
-        * complain with:
-        *   verifier internal error: more than one arg with ref_obj_id R3
-        * when trying to do bpf_map_update_elem(&hash_map, sample, &sample->seq, BPF_ANY);
-        *
+       /*
         * Since bpf_map_lookup_elem above uses 'sample' as key, test using
         * sample field as value below
         */
-       __builtin_memcpy(&sample_copy, sample, sizeof(struct sample));
-       bpf_map_update_elem(&hash_map, &sample_copy, &sample->seq, BPF_ANY);
+       bpf_map_update_elem(&hash_map, sample, &sample->seq, BPF_ANY);
 
        bpf_ringbuf_submit(sample, 0);
        return 0;

diff --git a/tools/testing/selftests/bpf/verifier/calls.c b/tools/testing/selftests/bpf/verifier/calls.c
index 0bb4337552c8a5ab58a4369ef8a790f96843ff4c..42d523a21a435064282d15d026d29399eb5169cc 100644 (file)
--- a/tools/testing/selftests/bpf/verifier/calls.c
+++ b/tools/testing/selftests/bpf/verifier/calls.c
@@ -2410,27 +2410,3 @@
        .errstr_unpriv = "",
        .prog_type = BPF_PROG_TYPE_CGROUP_SKB,
 },
-{
-       "calls: several args with ref_obj_id",
-       .insns = {
-       /* Reserve at least sizeof(struct iphdr) bytes in the ring buffer.
-        * With a smaller size, the verifier would reject the call to
-        * bpf_tcp_raw_gen_syncookie_ipv4 before we can reach the
-        * ref_obj_id error.
-        */
-       BPF_MOV64_IMM(BPF_REG_2, 20),
-       BPF_MOV64_IMM(BPF_REG_3, 0),
-       BPF_LD_MAP_FD(BPF_REG_1, 0),
-       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_ringbuf_reserve),
-       /* if r0 == 0 goto <exit> */
-       BPF_JMP_IMM(BPF_JEQ, BPF_REG_0, 0, 3),
-       BPF_MOV64_REG(BPF_REG_1, BPF_REG_0),
-       BPF_MOV64_REG(BPF_REG_2, BPF_REG_0),
-       BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, BPF_FUNC_tcp_raw_gen_syncookie_ipv4),
-       BPF_EXIT_INSN(),
-       },
-       .fixup_map_ringbuf = { 2 },
-       .result = REJECT,
-       .errstr = "more than one arg with ref_obj_id",
-       .prog_type = BPF_PROG_TYPE_SCHED_CLS,
-},