bpf: Factor out program return value calculation

Factor the return value range calculation logic in check_return_code
out of the function in preparation for separating the return value
validation logic for BPF_EXIT and bpf_throw().

No functional changes. The change made in return_retval_code's handling
of PROG_TRACING program types (not error'ing on the default case) is a
no-op because the match on the program attach type is exhaustive.

Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Emil Tsalapatis <emil@etsalapatis.com>
Link: https://lore.kernel.org/r/20260228184759.108145-2-emil@etsalapatis.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h
index c1e30096ea7bfc90b4eb79ab40f4fbd25b69188a..090aa26d1c9848d0a9fbfa6461c579877da4355b 100644 (file)
--- a/include/linux/bpf_verifier.h
+++ b/include/linux/bpf_verifier.h
@@ -265,6 +265,7 @@ struct bpf_reference_state {
 struct bpf_retval_range {
        s32 minval;
        s32 maxval;
+       bool return_32bit;
 };
 
 /* state of the program:

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 34f89ed29c47a982e42f74cf34249b5e4ddc02a7..89e6d2f6bdf6d1862630cbd16d9fc44ab7d75325 100644 (file)
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -2953,7 +2953,11 @@ static void init_reg_state(struct bpf_verifier_env *env,
 
 static struct bpf_retval_range retval_range(s32 minval, s32 maxval)
 {
-       return (struct bpf_retval_range){ minval, maxval };
+       /*
+        * return_32bit is set to false by default and set explicitly
+        * by the caller when necessary.
+        */
+       return (struct bpf_retval_range){ minval, maxval, false };
 }
 
 #define BPF_MAIN_FUNC (-1)
@@ -11175,10 +11179,9 @@ static bool in_rbtree_lock_required_cb(struct bpf_verifier_env *env)
        return is_rbtree_lock_required_kfunc(kfunc_btf_id);
 }
 
-static bool retval_range_within(struct bpf_retval_range range, const struct bpf_reg_state *reg,
-                               bool return_32bit)
+static bool retval_range_within(struct bpf_retval_range range, const struct bpf_reg_state *reg)
 {
-       if (return_32bit)
+       if (range.return_32bit)
                return range.minval <= reg->s32_min_value && reg->s32_max_value <= range.maxval;
        else
                return range.minval <= reg->smin_value && reg->smax_value <= range.maxval;
@@ -11222,7 +11225,7 @@ static int prepare_func_exit(struct bpf_verifier_env *env, int *insn_idx)
                        return err;
 
                /* enforce R0 return value range, and bpf_callback_t returns 64bit */
-               if (!retval_range_within(callee->callback_ret_range, r0, false)) {
+               if (!retval_range_within(callee->callback_ret_range, r0)) {
                        verbose_invalid_scalar(env, r0, callee->callback_ret_range,
                                               "At callback return", "R0");
                        return -EINVAL;
@@ -17841,6 +17844,115 @@ static int check_ld_abs(struct bpf_verifier_env *env, struct bpf_insn *insn)
        return 0;
 }
 
+
+static bool return_retval_range(struct bpf_verifier_env *env, struct bpf_retval_range *range)
+{
+       enum bpf_prog_type prog_type = resolve_prog_type(env->prog);
+
+       /* Default return value range. */
+       *range = retval_range(0, 1);
+
+       switch (prog_type) {
+       case BPF_PROG_TYPE_CGROUP_SOCK_ADDR:
+               switch (env->prog->expected_attach_type) {
+               case BPF_CGROUP_UDP4_RECVMSG:
+               case BPF_CGROUP_UDP6_RECVMSG:
+               case BPF_CGROUP_UNIX_RECVMSG:
+               case BPF_CGROUP_INET4_GETPEERNAME:
+               case BPF_CGROUP_INET6_GETPEERNAME:
+               case BPF_CGROUP_UNIX_GETPEERNAME:
+               case BPF_CGROUP_INET4_GETSOCKNAME:
+               case BPF_CGROUP_INET6_GETSOCKNAME:
+               case BPF_CGROUP_UNIX_GETSOCKNAME:
+                       *range = retval_range(1, 1);
+                       break;
+               case BPF_CGROUP_INET4_BIND:
+               case BPF_CGROUP_INET6_BIND:
+                       *range = retval_range(0, 3);
+                       break;
+               default:
+                       break;
+               }
+               break;
+       case BPF_PROG_TYPE_CGROUP_SKB:
+               if (env->prog->expected_attach_type == BPF_CGROUP_INET_EGRESS)
+                       *range = retval_range(0, 3);
+               break;
+       case BPF_PROG_TYPE_CGROUP_SOCK:
+       case BPF_PROG_TYPE_SOCK_OPS:
+       case BPF_PROG_TYPE_CGROUP_DEVICE:
+       case BPF_PROG_TYPE_CGROUP_SYSCTL:
+       case BPF_PROG_TYPE_CGROUP_SOCKOPT:
+               break;
+       case BPF_PROG_TYPE_RAW_TRACEPOINT:
+               if (!env->prog->aux->attach_btf_id)
+                       return false;
+               *range = retval_range(0, 0);
+               break;
+       case BPF_PROG_TYPE_TRACING:
+               switch (env->prog->expected_attach_type) {
+               case BPF_TRACE_FENTRY:
+               case BPF_TRACE_FEXIT:
+               case BPF_TRACE_FSESSION:
+                       *range = retval_range(0, 0);
+                       break;
+               case BPF_TRACE_RAW_TP:
+               case BPF_MODIFY_RETURN:
+                       return false;
+               case BPF_TRACE_ITER:
+               default:
+                       break;
+               }
+               break;
+       case BPF_PROG_TYPE_KPROBE:
+               switch (env->prog->expected_attach_type) {
+               case BPF_TRACE_KPROBE_SESSION:
+               case BPF_TRACE_UPROBE_SESSION:
+                       break;
+               default:
+                       return false;
+               }
+               break;
+       case BPF_PROG_TYPE_SK_LOOKUP:
+               *range = retval_range(SK_DROP, SK_PASS);
+               break;
+
+       case BPF_PROG_TYPE_LSM:
+               if (env->prog->expected_attach_type != BPF_LSM_CGROUP) {
+                       /* no range found, any return value is allowed */
+                       if (!get_func_retval_range(env->prog, range))
+                               return false;
+                       /* no restricted range, any return value is allowed */
+                       if (range->minval == S32_MIN && range->maxval == S32_MAX)
+                               return false;
+                       range->return_32bit = true;
+               } else if (!env->prog->aux->attach_func_proto->type) {
+                       /* Make sure programs that attach to void
+                        * hooks don't try to modify return value.
+                        */
+                       *range = retval_range(1, 1);
+               }
+               break;
+
+       case BPF_PROG_TYPE_NETFILTER:
+               *range = retval_range(NF_DROP, NF_ACCEPT);
+               break;
+       case BPF_PROG_TYPE_STRUCT_OPS:
+               *range = retval_range(0, 0);
+               break;
+       case BPF_PROG_TYPE_EXT:
+               /* freplace program can return anything as its return value
+                * depends on the to-be-replaced kernel func or bpf program.
+                */
+       default:
+               return false;
+       }
+
+       /* Continue calculating. */
+
+       return true;
+}
+
 static int check_return_code(struct bpf_verifier_env *env, int regno, const char *reg_name)
 {
        const char *exit_ctx = "At program exit";
@@ -17849,18 +17961,17 @@ static int check_return_code(struct bpf_verifier_env *env, int regno, const char
        struct bpf_reg_state *reg = reg_state(env, regno);
        struct bpf_retval_range range = retval_range(0, 1);
        enum bpf_prog_type prog_type = resolve_prog_type(env->prog);
-       int err;
        struct bpf_func_state *frame = env->cur_state->frame[0];
        const bool is_subprog = frame->subprogno;
-       bool return_32bit = false;
        const struct btf_type *reg_type, *ret_type = NULL;
+       int err;
 
        /* LSM and struct_ops func-ptr's return type could be "void" */
        if (!is_subprog || frame->in_exception_callback_fn) {
                switch (prog_type) {
                case BPF_PROG_TYPE_LSM:
                        if (prog->expected_attach_type == BPF_LSM_CGROUP)
-                               /* See below, can be 0 or 0-1 depending on hook. */
+                               /* See return_retval_range, can be 0 or 0-1 depending on hook. */
                                break;
                        if (!prog->aux->attach_func_proto->type)
                                return 0;
@@ -17918,101 +18029,14 @@ static int check_return_code(struct bpf_verifier_env *env, int regno, const char
                return 0;
        }
 
-       switch (prog_type) {
-       case BPF_PROG_TYPE_CGROUP_SOCK_ADDR:
-               if (env->prog->expected_attach_type == BPF_CGROUP_UDP4_RECVMSG ||
-                   env->prog->expected_attach_type == BPF_CGROUP_UDP6_RECVMSG ||
-                   env->prog->expected_attach_type == BPF_CGROUP_UNIX_RECVMSG ||
-                   env->prog->expected_attach_type == BPF_CGROUP_INET4_GETPEERNAME ||
-                   env->prog->expected_attach_type == BPF_CGROUP_INET6_GETPEERNAME ||
-                   env->prog->expected_attach_type == BPF_CGROUP_UNIX_GETPEERNAME ||
-                   env->prog->expected_attach_type == BPF_CGROUP_INET4_GETSOCKNAME ||
-                   env->prog->expected_attach_type == BPF_CGROUP_INET6_GETSOCKNAME ||
-                   env->prog->expected_attach_type == BPF_CGROUP_UNIX_GETSOCKNAME)
-                       range = retval_range(1, 1);
-               if (env->prog->expected_attach_type == BPF_CGROUP_INET4_BIND ||
-                   env->prog->expected_attach_type == BPF_CGROUP_INET6_BIND)
-                       range = retval_range(0, 3);
-               break;
-       case BPF_PROG_TYPE_CGROUP_SKB:
-               if (env->prog->expected_attach_type == BPF_CGROUP_INET_EGRESS) {
-                       range = retval_range(0, 3);
-                       enforce_attach_type_range = tnum_range(2, 3);
-               }
-               break;
-       case BPF_PROG_TYPE_CGROUP_SOCK:
-       case BPF_PROG_TYPE_SOCK_OPS:
-       case BPF_PROG_TYPE_CGROUP_DEVICE:
-       case BPF_PROG_TYPE_CGROUP_SYSCTL:
-       case BPF_PROG_TYPE_CGROUP_SOCKOPT:
-               break;
-       case BPF_PROG_TYPE_RAW_TRACEPOINT:
-               if (!env->prog->aux->attach_btf_id)
-                       return 0;
-               range = retval_range(0, 0);
-               break;
-       case BPF_PROG_TYPE_TRACING:
-               switch (env->prog->expected_attach_type) {
-               case BPF_TRACE_FENTRY:
-               case BPF_TRACE_FEXIT:
-               case BPF_TRACE_FSESSION:
-                       range = retval_range(0, 0);
-                       break;
-               case BPF_TRACE_RAW_TP:
-               case BPF_MODIFY_RETURN:
-                       return 0;
-               case BPF_TRACE_ITER:
-                       break;
-               default:
-                       return -ENOTSUPP;
-               }
-               break;
-       case BPF_PROG_TYPE_KPROBE:
-               switch (env->prog->expected_attach_type) {
-               case BPF_TRACE_KPROBE_SESSION:
-               case BPF_TRACE_UPROBE_SESSION:
-                       range = retval_range(0, 1);
-                       break;
-               default:
-                       return 0;
-               }
-               break;
-       case BPF_PROG_TYPE_SK_LOOKUP:
-               range = retval_range(SK_DROP, SK_PASS);
-               break;
+       if (prog_type == BPF_PROG_TYPE_STRUCT_OPS && !ret_type)
+               return 0;
 
-       case BPF_PROG_TYPE_LSM:
-               if (env->prog->expected_attach_type != BPF_LSM_CGROUP) {
-                       /* no range found, any return value is allowed */
-                       if (!get_func_retval_range(env->prog, &range))
-                               return 0;
-                       /* no restricted range, any return value is allowed */
-                       if (range.minval == S32_MIN && range.maxval == S32_MAX)
-                               return 0;
-                       return_32bit = true;
-               } else if (!env->prog->aux->attach_func_proto->type) {
-                       /* Make sure programs that attach to void
-                        * hooks don't try to modify return value.
-                        */
-                       range = retval_range(1, 1);
-               }
-               break;
+       if (prog_type == BPF_PROG_TYPE_CGROUP_SKB && (env->prog->expected_attach_type == BPF_CGROUP_INET_EGRESS))
+               enforce_attach_type_range = tnum_range(2, 3);
 
-       case BPF_PROG_TYPE_NETFILTER:
-               range = retval_range(NF_DROP, NF_ACCEPT);
-               break;
-       case BPF_PROG_TYPE_STRUCT_OPS:
-               if (!ret_type)
-                       return 0;
-               range = retval_range(0, 0);
-               break;
-       case BPF_PROG_TYPE_EXT:
-               /* freplace program can return anything as its return value
-                * depends on the to-be-replaced kernel func or bpf program.
-                */
-       default:
+       if (!return_retval_range(env, &range))
                return 0;
-       }
 
 enforce_retval:
        if (reg->type != SCALAR_VALUE) {
@@ -18025,7 +18049,7 @@ enforce_retval:
        if (err)
                return err;
 
-       if (!retval_range_within(range, reg, return_32bit)) {
+       if (!retval_range_within(range, reg)) {
                verbose_invalid_scalar(env, reg, range, exit_ctx, reg_name);
                if (!is_subprog &&
                    prog->expected_attach_type == BPF_LSM_CGROUP &&