函数逻辑报告

Linux Kernel

v5.5.9

Brick Technologies Co., Ltd

Source Code:kernel\bpf\verifier.c Create Date:2022-07-27 14:11:26
Last Modify:2022-05-19 20:02:10 Copyright©Brick
首页 函数Tree
注解内核,赢得工具下载SCCTEnglish

函数名称：heck read/write into a map element with possible variable offset

函数原型：static int check_map_access(struct bpf_verifier_env *env, u32 regno, int off, int size, bool zero_size_allowed)

返回类型：int

参数：

类型参数名称
struct bpf_verifier_env *env
u32regno
intoff
intsize
boolzero_size_allowed
2237  vstate等于current verifier state
2238  state等于 call stack tracking [curframe]
2239  reg等于regs[regno]
2246  如果level按位与BPF_LOG_LEVEL则print_verifier_state(env, state)
2255  如果 minimum possible (s64)value 小于0且 minimum possible (s64)value 恒等于S64_MIN或off加 minimum possible (s64)value 不等于off加 minimum possible (s64)value 或 minimum possible (s64)value 加off小于0的值则
2259  verbose(env, "R%d min value is negative, either use unsigned index or do a if (index >=0) check.\n", regno)
2261  返回:负EACCES
2263  err等于heck read/write into map element returned by bpf_map_lookup_elem()
2265  如果err则
2266  verbose(env, "R%d min value is outside of the array range\n", regno)
2268  返回:err
2275  如果 maximum possible (u64)value 大于等于Maximum variable offset umax_value permitted when resolving memory accesses.* In practice this is far bigger than any realistic pointer offset; this limit* ensures that umax_value + (int)off + (int)size cannot overflow a u64.则
2276  verbose(env, "R%d unbounded memory access, make sure to bounds check any array access into a map\n", regno)
2278  返回:负EACCES
2280  err等于heck read/write into map element returned by bpf_map_lookup_elem()
2282  如果err则verbose(env, "R%d max value is outside of the array range\n", regno)
2286  如果map_value_has_spin_lock( valid when type == CONST_PTR_TO_MAP | PTR_TO_MAP_VALUE | * PTR_TO_MAP_VALUE_OR_NULL)则
2287  lock等于 >=0 valid offset, <0 error
2294  如果 minimum possible (s64)value 加off小于lock加sizeof(structbpf_spin_lock)且lock小于 maximum possible (u64)value 加off加size则
2296  verbose(env, "bpf_spin_lock cannot be accessed directly by load/store\n")
2297  返回:负EACCES
2300  返回:err
调用者
名称描述
check_mem_accessheck whether memory at (regno + off) is accessible for t = (read | write)* if t==write, value_regno is a register which value is stored into memory* if t==read, value_regno is a register which will receive the value from memory* if t==write &&
check_helper_mem_access
adjust_ptr_min_max_valsHandles arithmetic on a pointer and a scalar: computes new min/max and var_off.* Caller should also handle BPF_MOV case separately.* If we return -EACCES, caller may want to try again treating pointer as a* scalar