[PATCH bpf-next v4 13/13] bpf: Reject tracing progs for struct_ops with arena args

Reject tracing attachments to a target program with arena context
arguments. The struct_ops indirect trampoline converts those arguments
before entering the target, so a generic tracing trampoline would
otherwise expose arena offsets using the target BTF pointer type.

Signed-off-by: Kumar Kartikeya Dwivedi <[email protected]>
---
 include/linux/bpf.h     |  1 +
 kernel/bpf/trampoline.c | 10 ----------
 kernel/bpf/verifier.c   | 21 +++++++++++++++++++++
 3 files changed, 22 insertions(+), 10 deletions(-)

diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 00aaa23b4f7e..68ff66787ae1 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -2367,6 +2367,7 @@ static inline int bpf_fsession_cookie_cnt(struct bpf_tramp_nodes *nodes)
 
 int bpf_prog_ctx_arg_info_init(struct bpf_prog *prog,
 			       const struct bpf_ctx_arg_aux *info, u32 cnt);
+bool bpf_prog_has_arena_ctx_arg(const struct bpf_prog *prog);
 
 #if defined(CONFIG_CGROUP_BPF) && defined(CONFIG_BPF_LSM)
 int bpf_trampoline_link_cgroup_shim(struct bpf_prog *prog,
diff --git a/kernel/bpf/trampoline.c b/kernel/bpf/trampoline.c
index b349e0817184..e07af35ed040 100644
--- a/kernel/bpf/trampoline.c
+++ b/kernel/bpf/trampoline.c
@@ -529,16 +529,6 @@ bpf_trampoline_get_progs(const struct bpf_trampoline *tr, int *total, bool *ip_a
 	return tnodes;
 }
 
-static bool bpf_prog_has_arena_ctx_arg(const struct bpf_prog *prog)
-{
-	int i;
-
-	for (i = 0; i < prog->aux->ctx_arg_info_size; i++)
-		if (base_type(prog->aux->ctx_arg_info[i].reg_type) == PTR_TO_ARENA)
-			return true;
-	return false;
-}
-
 /*
  * The arena base against which save_args() converts the arguments marked
  * with BTF_FMODEL_ARENA_ARG. Only the struct_ops indirect trampoline
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 6897b08dd010..60d1ea9a094a 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -18868,6 +18868,16 @@ int bpf_prog_ctx_arg_info_init(struct bpf_prog *prog,
 	return prog->aux->ctx_arg_info ? 0 : -ENOMEM;
 }
 
+bool bpf_prog_has_arena_ctx_arg(const struct bpf_prog *prog)
+{
+	int i;
+
+	for (i = 0; i < prog->aux->ctx_arg_info_size; i++)
+		if (base_type(prog->aux->ctx_arg_info[i].reg_type) == PTR_TO_ARENA)
+			return true;
+	return false;
+}
+
 static int check_struct_ops_btf_id(struct bpf_verifier_env *env)
 {
 	const struct btf_type *t, *func_proto;
@@ -19255,6 +19265,17 @@ int bpf_check_attach_target(struct bpf_verifier_log *log,
 			bpf_log(log, "Subprog %s doesn't exist\n", tname);
 			return -EINVAL;
 		}
+		/*
+		 * A struct_ops indirect trampoline converts arena arguments
+		 * before invoking its program. A tracing program attached to the
+		 * main program would see the converted offset as a regular BTF
+		 * pointer.
+		 */
+		if (prog_tracing && subprog == 0 &&
+		    bpf_prog_has_arena_ctx_arg(tgt_prog)) {
+			bpf_log(log, "Cannot trace a target with arena context arguments\n");
+			return -EOPNOTSUPP;
+		}
 		if (aux->func && aux->func[subprog]->aux->exception_cb) {
 			bpf_log(log,
 				"%s programs cannot attach to exception callback\n",
-- 
2.53.0