bpf: verifier: Accept dynptr mem as mem in helpers

This allows using memory retrieved from dynptrs with helper functions
that accept ARG_PTR_TO_MEM. For instance, results from bpf_dynptr_data
can be passed along to bpf_strncmp.

Signed-off-by: Daniel Rosenberg <drosen@google.com>
Link: https://lore.kernel.org/r/20230506013134.2492210-5-drosen@google.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 7e6bbae9db81c4b691ff7f23f26313d7f1075a85..754129d412256bfbfed551055e5b5818f48ebde6 100644 (file)
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -7495,12 +7495,16 @@ static int check_reg_type(struct bpf_verifier_env *env, u32 regno,
         * ARG_PTR_TO_MEM + MAYBE_NULL is compatible with PTR_TO_MEM and PTR_TO_MEM + MAYBE_NULL,
         * but ARG_PTR_TO_MEM is compatible only with PTR_TO_MEM but NOT with PTR_TO_MEM + MAYBE_NULL
         *
+        * ARG_PTR_TO_MEM is compatible with PTR_TO_MEM that is tagged with a dynptr type.
+        *
         * Therefore we fold these flags depending on the arg_type before comparison.
         */
        if (arg_type & MEM_RDONLY)
                type &= ~MEM_RDONLY;
        if (arg_type & PTR_MAYBE_NULL)
                type &= ~PTR_MAYBE_NULL;
+       if (base_type(arg_type) == ARG_PTR_TO_MEM)
+               type &= ~DYNPTR_TYPE_FLAG_MASK;
 
        if (meta->func_id == BPF_FUNC_kptr_xchg && type & MEM_ALLOC)
                type &= ~MEM_ALLOC;