Re: [PATCH bpf-next v4 2/6] bpf/verifier: add bpf_timer as a kfunc capable type

[Eduard Zingerman]

On Fri, 2024-03-15 at 15:29 +0100, Benjamin Tissoires wrote:
[...]

> @@ -12021,6 +12034,12 @@ static int check_kfunc_args(struct bpf_verifier_env 
> *env, struct bpf_kfunc_call_
>                       if (ret)
>                               return ret;
>                       break;
> +             case KF_ARG_PTR_TO_TIMER:
> +                     if (reg->type != PTR_TO_MAP_VALUE) {
> +                             verbose(env, "arg#%d doesn't point to a map 
> value\n", i);
> +                             return -EINVAL;
> +                     }
> +                     break;

I think that pointer offset has to be checked as well,
otherwise the following program verifies w/o error:

--- 8< ----------------------------

#include <linux/bpf.h>
#include <time.h>
#include <errno.h>
#include <bpf/bpf_helpers.h>
#include "bpf_tcp_helpers.h"

extern int bpf_timer_set_sleepable_cb_impl(struct bpf_timer *timer,
                int (callback_fn)(void *map, int *key, struct bpf_timer 
*timer), void *aux__ign) __ksym;

#define bpf_timer_set_sleepable_cb(timer, cb) \
        bpf_timer_set_sleepable_cb_impl(timer, cb, NULL)

struct elem {
        struct bpf_timer t;
};

struct {
        __uint(type, BPF_MAP_TYPE_ARRAY);
        __uint(max_entries, 2);
        __type(key, int);
        __type(value, struct elem);
} array SEC(".maps");

static int cb_sleepable(void *map, int *key, struct bpf_timer *timer)
{
        return 0;
}

SEC("fentry/bpf_fentry_test5")
int BPF_PROG2(test_sleepable, int, a)
{
        struct bpf_timer *arr_timer;
        int array_key = 1;

        arr_timer = bpf_map_lookup_elem(&array, &array_key);
        if (!arr_timer)
                return 0;
        bpf_timer_init(arr_timer, &array, CLOCK_MONOTONIC);
        bpf_timer_set_sleepable_cb((void *)arr_timer + 1, // <-- note incorrect 
offset
                                   cb_sleepable);
        bpf_timer_start(arr_timer, 0, 0);
        return 0;
}

char _license[] SEC("license") = "GPL";

---------------------------- >8 ---